- openldap-bugs - openldap.org

(ITS#7516) Mysql backend is readonly with included metadata sql files
by povilas＠Daukas.lt 01 Feb '13

01 Feb '13

Full_Name: Povilas Daukas Version: any OS: Ubuntu URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.63.107.40) Hi, While trying to setup mysql as backend to the openldap server i noticed that it only allowed reading from the database but not updating as the metadata was not there to handle the updates. So I adopted the functions and sql from PostgreSQL to make it read write. the file to modify is below. Hope you and others will find it useful. Kind regards Paul ---------------------------------------------------------------------- File: servers/slapd/back-sql/rdbms_depend/mysql/testdb_metadata.sql ---------------------------------------------------------------------- -- mappings -- objectClass mappings: these may be viewed as structuralObjectClass, the ones that are used to decide how to build an entry -- id a unique number identifying the objectClass -- name the name of the objectClass; it MUST match the name of an objectClass that is loaded in slapd's schema -- keytbl the name of the table that is referenced for the primary key of an entry -- keycol the name of the column in "keytbl" that contains the primary key of an entry; the pair "keytbl.keycol" uniquely identifies an entry of objectClass "id" -- create_proc a procedure to create the entry -- delete_proc a procedure to delete the entry; it takes "keytbl.keycol" of the row to be deleted -- expect_return a bitmap that marks whether create_proc (1) and delete_proc (2) return a value or not INSERT INTO `ldap_oc_mappings` (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) VALUES ('1', 'inetOrgPerson', 'persons', 'id', 'SELECT create_person()', 'DELETE FROM persons WHERE id=?', 0); INSERT INTO `ldap_oc_mappings` (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) VALUES ('2', 'document', 'documents', 'id', 'SELECT create_doc()', 'DELETE FROM documents WHERE id=?', 0); INSERT INTO `ldap_oc_mappings` (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) VALUES ('3', 'organization', 'institutes', 'id', 'SELECT create_o()', 'DELETE FROM institutes WHERE id=?', 0); INSERT INTO `ldap_oc_mappings` (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) VALUES ('4', 'referral', 'referrals', 'id', 'SELECT create_referral()', 'DELETE FROM referrals WHERE id=?', 0); -- attributeType mappings: describe how an attributeType for a certain objectClass maps to the SQL data. -- id a unique number identifying the attribute -- oc_map_id the value of "ldap_oc_mappings.id" that identifies the objectClass this attributeType is defined for -- name the name of the attributeType; it MUST match the name of an attributeType that is loaded in slapd's schema -- sel_expr the expression that is used to select this attribute (the "select <sel_expr> from ..." portion) -- from_tbls the expression that defines the table(s) this attribute is taken from (the "select ... from <from_tbls> where ..." portion) -- join_where the expression that defines the condition to select this attribute (the "select ... where <join_where> ..." portion) -- add_proc a procedure to insert the attribute; it takes the value of the attribute that is added, and the "keytbl.keycol" of the entry it is associated to -- delete_proc a procedure to delete the attribute; it takes the value of the attribute that is added, and the "keytbl.keycol" of the entry it is associated to -- param_order a mask that marks if the "keytbl.keycol" value comes before or after the value in add_proc (1) and delete_proc (2) -- expect_return a mask that marks whether add_proc (1) and delete_proc(2) are expected to return a value or not INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('1', '1', 'cn', 'concat(persons.name,\' \',persons.surname)', null, 'persons', null, 'SELECT update_person_cn(?,?)', 'SELECT 1 FROM persons WHERE persons.name=? AND persons.id=? AND 1=0', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('2', '1', 'telephoneNumber', 'phones.phone', null, 'persons,phones', 'phones.pers_id=persons.id', 'SELECT add_phone(?,?)', 'DELETE FROM phones WHERE phone=? AND pers_id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('3', '1', 'givenName', 'persons.name', null, 'persons', null, 'UPDATE persons SET name=? WHERE id=?', 'UPDATE persons SET name=\'\' WHERE (name=? OR name=\'\') AND id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('4', '1', 'sn', 'persons.surname', null, 'persons', null, 'UPDATE persons SET surname=? WHERE id=?', 'UPDATE persons SET surname=\'\' WHERE (surname=? OR surname=\'\') AND id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('5', '1', 'userPassword', 'persons.password', null, 'persons', 'persons.password IS NOT NULL', 'UPDATE persons SET password=? WHERE id=?', 'UPDATE persons SET password=NULL WHERE password=? AND id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('6', '1', 'seeAlso', 'seeAlso.dn', null, 'ldap_entries AS seeAlso,documents,authors_docs,persons', 'seeAlso.keyval=documents.id AND seeAlso.oc_map_id=2 AND authors_docs.doc_id=documents.id AND authors_docs.pers_id=persons.id', null, 'DELETE from authors_docs WHERE authors_docs.doc_id=(SELECT documents.id FROM documents,ldap_entries AS seeAlso WHERE seeAlso.keyval=documents.id AND seeAlso.oc_map_id=2 AND seeAlso.dn=?) AND authors_docs.pers_id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('7', '2', 'description', 'documents.abstract', null, 'documents', null, 'UPDATE documents SET abstract=? WHERE id=?', 'UPDATE documents SET abstract=\'\'\'\' WHERE abstract=? AND id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('8', '2', 'documentTitle', 'documents.title', null, 'documents', null, 'UPDATE documents SET title=? WHERE id=?', 'UPDATE documents SET title=\'\' WHERE title=? AND id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('9', '2', 'documentAuthor', 'documentAuthor.dn', null, 'ldap_entries AS documentAuthor,documents,authors_docs,persons', 'documentAuthor.keyval=persons.id AND documentAuthor.oc_map_id=1 AND authors_docs.doc_id=documents.id AND authors_docs.pers_id=persons.id', 'INSERT INTO authors_docs (pers_id,doc_id) VALUES ((SELECT ldap_entries.keyval FROM ldap_entries WHERE upper(?)=upper(ldap_entries.dn)),?)', 'DELETE FROM authors_docs WHERE authors_docs.pers_id=(SELECT ldap_entries.keyval FROM ldap_entries WHERE upper(?)=upper(ldap_entries.dn)) AND authors_docs.doc_id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('10', '2', 'documentIdentifier', 'concat(\'document \',documents.id)', null, 'documents', null, null, 'SELECT 1 FROM documents WHERE title=? AND id=? AND 1=0', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('11', '3', 'o', 'institutes.name', null, 'institutes', null, 'UPDATE institutes SET name=? WHERE id=?', 'UPDATE institutes SET name=\'\' WHERE name=? AND id=?', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('12', '3', 'dc', 'lower(institutes.name)', null, 'institutes,ldap_entries AS dcObject,ldap_entry_objclasses as auxObjectClass', 'institutes.id=dcObject.keyval AND dcObject.oc_map_id=3 AND dcObject.id=auxObjectClass.entry_id AND auxObjectClass.oc_name=\'dcObject\'', null, 'SELECT 1 FROM institutes WHERE lower(name)=? AND id=? and 1=0', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('13', '4', 'ou', 'referrals.name', null, 'referrals', null, 'UPDATE referrals SET name=? WHERE id=?', 'SELECT 1 FROM referrals WHERE name=? AND id=? and 1=0', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('14', '4', 'ref', 'referrals.url', null, 'referrals', null, 'UPDATE referrals SET url=? WHERE id=?', 'SELECT 1 FROM referrals WHERE url=? and id=? and 1=0', '3', '0'); INSERT INTO `ldap_attr_mappings` into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) VALUES ('15', '1', 'userCertificate', 'certs.cert', null, 'persons,certs', 'certs.pers_id=persons.id', null, null, '3', '0'); -- entries mapping: each entry must appear in this table, with a unique DN rooted at the database naming context -- id a unique number > 0 identifying the entry -- dn the DN of the entry, in "pretty" form -- oc_map_id the "ldap_oc_mappings.id" of the main objectClass of this entry (view it as the structuralObjectClass) -- parent the "ldap_entries.id" of the parent of this objectClass; 0 if it is the "suffix" of the database -- keyval the value of the "keytbl.keycol" defined for this objectClass insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values (1,'dc=example,dc=com',3,0,1); insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values (2,'cn=Mitya Kovalev,dc=example,dc=com',1,1,1); insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values (3,'cn=Torvlobnor Puzdoy,dc=example,dc=com',1,1,2); insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values (4,'cn=Akakiy Zinberstein,dc=example,dc=com',1,1,3); insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values (5,'documentTitle=book1,dc=example,dc=com',2,1,1); insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values (6,'documentTitle=book2,dc=example,dc=com',2,1,2); insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values (7,'ou=Referral,dc=example,dc=com',4,1,1); -- objectClass mapping: entries that have multiple objectClass instances are listed here with the objectClass name (view them as auxiliary objectClass) -- entry_id the "ldap_entries.id" of the entry this objectClass value must be added -- oc_name the name of the objectClass; it MUST match the name of an objectClass that is loaded in slapd's schema insert into ldap_entry_objclasses (entry_id,oc_name) values (1,'dcObject'); insert into ldap_entry_objclasses (entry_id,oc_name) values (4,'pkiUser'); insert into ldap_entry_objclasses (entry_id,oc_name) values (7,'extensibleObject'); ---------------------------------- -- FUNCTIONS TO SUPPORT UPDATES AND DELETIONS -- ---------------------------- -- Function structure for `add_phone` -- ---------------------------- DROP FUNCTION IF EXISTS `add_phone`; DELIMITER ;; CREATE FUNCTION `add_phone`(`input_value` varchar(255),`input_id` int(11)) RETURNS int(11) BEGIN DECLARE return_value int(11); SET return_value = 0; insert into phones (phone,pers_id) values (input_value, input_id); select max(id) into return_value from phones; RETURN return_value; END ;; DELIMITER ; -- ---------------------------- -- Function structure for `create_doc` -- ---------------------------- DROP FUNCTION IF EXISTS `create_doc`; DELIMITER ;; CREATE FUNCTION `create_doc`() RETURNS int(11) BEGIN DECLARE return_value int(11); SET return_value = 0; insert into documents(id,title,abstract) values (null,'',''); select max(id) into return_value from documents; RETURN return_value; END ;; DELIMITER ; -- ---------------------------- -- Function structure for `create_o` -- ---------------------------- DROP FUNCTION IF EXISTS `create_o`; DELIMITER ;; CREATE FUNCTION `create_o`() RETURNS int(11) BEGIN DECLARE return_value int(11); SET return_value = 0; insert into institutes(id,name) values (null,''); select max(id) into return_value from institutes; RETURN return_value; END ;; DELIMITER ; -- ---------------------------- -- Function structure for `create_person` -- ---------------------------- DROP FUNCTION IF EXISTS `create_person`; DELIMITER ;; CREATE FUNCTION `create_person`() RETURNS int(11) BEGIN DECLARE return_value int(11); SET return_value = 0; insert into persons (id,name,surname) values (null,'',''); select max(id) into return_value from persons; RETURN return_value; END ;; DELIMITER ; -- ---------------------------- -- Function structure for `create_referral` -- ---------------------------- DROP FUNCTION IF EXISTS `create_referral`; DELIMITER ;; CREATE FUNCTION `create_referral`() RETURNS int(11) BEGIN DECLARE return_value int(11); SET return_value = 0; insert into referrals(id,name, url) values (null, '', ''); select max(id) into return_value from referrals; RETURN return_value; END ;; DELIMITER ; -- ---------------------------- -- Function structure for `update_person_cn` -- ---------------------------- DROP FUNCTION IF EXISTS `update_person_cn`; DELIMITER ;; CREATE FUNCTION `update_person_cn`(`input_value` varchar(255),`input_id` int(11)) RETURNS int(11) BEGIN #Routine body goes here... update persons set name = ( select case when position(' ' in input_value) = 0 then input_value else substr($1, 1, position(' ' in input_value) - 1) end ),surname = ( select case when position(' ' in input_value) = 0 then '' else substr(input_value, position(' ' in input_value) + 1) end ) where id = input_id; RETURN input_id; END ;; DELIMITER ;

1 0

Re: (ITS#7515) Nested liblmdb transaction bugs
by hyc＠symas.com 31 Jan '13

31 Jan '13

hyc(a)symas.com wrote: > h.b.furuseth(a)usit.uio.no wrote: >> Can't use a DBI from an aborted child txn, unlike aborted main txn: >> >> $ ./bug R[cp] # Create a named DB and put an item there >> $ ./bug [[o}g] # Open that DB in a child, abort, use the DBI >> 40: mdb_get(txn, dbi, &key, &rdata): Invalid argument >> $ ./bug [[o]g] # Success: Commit instead of abort the child >> $ ./bug [o}[g] # Success: Use the DBI from an aborted main txn > > Sounds like the latter is a different bug - a DBI opened in an aborted txn > should not be valid after the abort. > This bit is now fixed in mdb.master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7515) Nested liblmdb transaction bugs
by hyc＠symas.com 31 Jan '13

31 Jan '13

h.b.furuseth(a)usit.uio.no wrote: > Can't use a DBI from an aborted child txn, unlike aborted main txn: > > $ ./bug R[cp] # Create a named DB and put an item there > $ ./bug [[o}g] # Open that DB in a child, abort, use the DBI > 40: mdb_get(txn, dbi, &key, &rdata): Invalid argument > $ ./bug [[o]g] # Success: Commit instead of abort the child > $ ./bug [o}[g] # Success: Use the DBI from an aborted main txn Sounds like the latter is a different bug - a DBI opened in an aborted txn should not be valid after the abort. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7505) liblmdb can fail with MDB_PAGE_FULL on a delete
by sruo＠vmware.com 31 Jan '13

31 Jan '13

Hi Howard: Our test finished last night and the news is GOOD. We did not see MDB_PAGE_FULL error using patch 7505. At the same time, the other test ended with MDB_PAGE_FULL running older drop. Thank you very much for the fix. --Sung

1 0

(ITS#7515) Nested liblmdb transaction bugs
by h.b.furuseth＠usit.uio.no 31 Jan '13

31 Jan '13

Full_Name: Hallvard B Furuseth Version: mdb.master 27aaecc744955d08d2bfe7a3ca786d742267c5bd OS: Linux x86_64 URL: Submission from: (NULL) (193.69.163.163) Submitted by: hallvard Here are some crashes with nested liblmdb transactions. The ./bug test program takes the following commands: R Remove old database file, if any. [,],} Begin/commit/abort txn - nested if already in a txn. O Open main DB. c,o Create/open named DB "db". p,g,d Put/get/del {key="foo\0": data="bar\0"} to last opened DB. $ ./bug R[Op[d # Put an item, delete it in a child txn Bus Error Replace mdb_page_get() with the version below, and it works. But: $ ./bug R[Op[d]p # As above, then put the item again in top txn bug: mdb.c:3786: mdb_node_search: Assertion `nkeys > 0' failed. #3 0x0000003911c2bae0 in __assert_fail () from /lib64/libc.so.6 #4 0x0000000000406c49 in mdb_node_search (mc=0x7fffffffde80, key=0x7fffffffe070, exactp=0x7fffffffc934) at mdb.c:3786 #5 0x0000000000408846 in mdb_cursor_set (mc=0x7fffffffde80, key=0x7fffffffe070, data=0x7fffffffc920, op=MDB_SET, exactp=0x7fffffffc934) at mdb.c:4472 #6 0x0000000000409c7a in mdb_cursor_put (mc=0x7fffffffde80, key=0x7fffffffe070, data=0x7fffffffe060, flags=0) at mdb.c:4879 #7 0x00000000004109b4 in mdb_put (txn=0x615110, dbi=1, key=0x7fffffffe070, data=0x7fffffffe060, flags=0) at mdb.c:6852 #8 0x00000000004016fb in main (argc=2, argv=0x7fffffffe1e8) at bug.c:39 Successful child txns can create broken output: $ ./bug R[O[p]] # Put an item in a child txn. Success, but: $ ../mdb_stat -n -a -f test.mdb; du test.mdb db_stat reports only zeroes, but the DB is 12 K. $ ./bug R[Op][[d]][g] # Put, delete in child, then Get incorrectly succeeds $ ../mdb_stat -n -a -f test.mdb <prints freelist status, then coredump> $ ./bug R[Op][d][g] # The get fails as expected if the del is not in a child 40: mdb_get(txn, dbi, &key, &rdata): MDB_NOTFOUND: No matching key/data pair found Can't use a DBI from an aborted child txn, unlike aborted main txn: $ ./bug R[cp] # Create a named DB and put an item there $ ./bug [[o}g] # Open that DB in a child, abort, use the DBI 40: mdb_get(txn, dbi, &key, &rdata): Invalid argument $ ./bug [[o]g] # Success: Commit instead of abort the child $ ./bug [o}[g] # Success: Use the DBI from an aborted main txn static int mdb_page_get(MDB_txn *txn, pgno_t pgno, MDB_page **ret) { MDB_page *p = NULL; if (!((txn->mt_flags & MDB_TXN_RDONLY) | (txn->mt_env->me_flags & MDB_WRITEMAP))) { MDB_txn *tx2 = txn; do { MDB_ID2L dl = tx2->mt_u.dirty_list; if (dl[0].mid) { unsigned x = mdb_mid2l_search(dl, pgno); if (x <= dl[0].mid && dl[x].mid == pgno) { p = dl[x].mptr; goto done; } } } while ((tx2 = tx2->mt_parent) != NULL); } if (pgno < txn->mt_next_pgno) { p = (MDB_page *)(txn->mt_env->me_map + txn->mt_env->me_psize * pgno); } else { DPRINTF("page %zu not found", pgno); assert(p != NULL); } done: *ret = p; return (p != NULL) ? MDB_SUCCESS : MDB_PAGE_NOTFOUND; } bug.c: /* Commands: * R Remove old database file, if any. * [,],} Begin/commit/abort txn - nested if already in a txn. * O Open main DB. * c,o Create/open named DB "db". * p,g,d Put/get/del {key="foo\0": data="bar\0"} to last opened DB. */ #include <lmdb.h> #include <stdio.h> #include <stdlib.h> #include <string.h> int main(int argc, char **argv) { char c, *cmd = argc < 2 ? "" : argv[1]; int rc, ti = 0; MDB_txn *txn, *txs[9] = {NULL}; /* The loop maintains txn==txs[ti] */ MDB_val key = {4, "foo"}, data = {4, "bar"}, rdata; MDB_env *env; MDB_dbi dbi; # define envname "test.mdb" # define E(e) { rc = (e); if (rc) { fprintf(stderr, "%d: %s: %s\n", \ __LINE__, #e, mdb_strerror(rc)); abort(); } } if (*cmd == 'R') { cmd++; remove(envname); } E(mdb_env_create(&env)); E(mdb_env_set_maxdbs(env, 1)); E(mdb_env_open(env, envname, MDB_NOSYNC|MDB_NOSUBDIR, 0666)); # define C(ch, expr) case ch: E(expr); break while (txn=txs[ti], c=*cmd++) switch (c) { C('[', mdb_txn_begin(env, txn, 0, &txs[++ti])); C(']', mdb_txn_commit(txs[ti--])); C('}', (mdb_txn_abort(txs[ti--]), 0)); C('O', mdb_dbi_open(txn, NULL, 0, &dbi)); C('c', mdb_dbi_open(txn, "db", MDB_CREATE, &dbi)); C('o', mdb_dbi_open(txn, "db", 0, &dbi)); C('p', mdb_put(txn, dbi, &key, &data, 0)); C('g', mdb_get(txn, dbi, &key, &rdata)); C('d', mdb_del(txn, dbi, &key, NULL)); } if (txn) E(mdb_txn_commit(txs[1])); mdb_env_close(env); return 0; }

1 0

(ITS#7514) Optimize OpenLDAP with paged results
by quanah＠OpenLDAP.org 30 Jan '13

30 Jan '13

Full_Name: Quanah Gibson-Mount Version: 2.4.33 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) Currently, searches of back-mdb using paged results are extremely slow. Up to 300 times slower than when not using paged results: Without paged results: time ldapsearch -LLL -x -H ldap://zre-ldap002.eng.vmware.com -b "ou=people,dc=xxxx,dc=com" -s sub -D uid=zimbra,cn=admins,cn=zimbra -w zimbra '(objectClass=zimbraAccount)' uid real 0m0.004s user 0m0.010s sys 0m0.000s With paged results: zimbra@zre-ldap002:~$ time ldapsearch -LLL -x -H ldap://zre-ldap002.eng.vmware.com -b "ou=people,dc=xxxxx,dc=com" -s sub -D uid=zimbra,cn=admins,cn=zimbra -w zimbra '(objectClass=zimbraAccount)' uid -E pr=1000 real 0m1.204s user 0m0.010s sys 0m0.000s Using paged results is fairly standard in Java clients, to prevent them from hitting OOME's based on the way in which results are returned into a single object.

1 0

(ITS#7513) added TCP keepalive support to back_meta
by tedcheng＠symas.com 30 Jan '13

30 Jan '13

Full_Name: Ted C. Cheng Version: Head OS: Linux/Solaris URL: https://dl.dropbox.com/u/94235048/back_meta_tcp_keepalive.patch Submission from: (NULL) (76.174.253.197) Please find in the link a patch against HEAD for TCP keepalive support for back_meta.

1 0

(ITS#7512) MDB page leaks
by h.b.furuseth＠usit.uio.no 30 Jan '13

30 Jan '13

Full_Name: Hallvard B Furuseth Version: mdb.master 27aaecc744955d08d2bfe7a3ca786d742267c5bd OS: Linux x86_64 URL: Submission from: (NULL) (193.69.163.163) Submitted by: hallvard If the malloc at mdb_page_malloc() line 1348 fails, me_pgfirst has already been incremented and those pages can be lost. I'll fix that one. Not this, however: If a child transaction aborts, it loses pages it used up: It does not give them back to me_pghead, nor to the parent's mt_free_pgs. It does not rewind me_pgfirst/me_last to their state at txn_begin. This program illustrates. The DB grows to 107 pages. mdb_stat can see 10 of them, same as if everything was done in the main txn. MainDB will have max 1 entry while running. #include <lmdb.h> #include <stdio.h> #include <stdlib.h> int main(void) { int rc, i; MDB_val key = { sizeof(i), &i }, data = { 0, "" }; MDB_env *env; MDB_txn *txn, *ctxn; MDB_dbi dbi; # define dbname "test.mdb" # define E(e) { rc = (e); if (rc) { fprintf(stderr, "%d: %s: %s\n", \ __LINE__, #e, mdb_strerror(rc)); return rc; } } E(mdb_env_create(&env)); E(mdb_env_open(env, dbname, MDB_NOSYNC|MDB_NOSUBDIR, 0666)); for (i = 0; i < 100; ) { E(mdb_txn_begin(env, NULL, 0, &txn)); if (!i) { E(mdb_dbi_open(txn, NULL, MDB_CREATE, &dbi)); } else { E(mdb_txn_begin(env, txn, 0, &ctxn)); E(mdb_put(ctxn, dbi, &key, &data, 0)); mdb_txn_abort(ctxn); E(mdb_del(txn, dbi, &key, NULL)); } i++; E(mdb_put(txn, dbi, &key, &data, 0)); E(mdb_txn_commit(txn)); if (i % 20 == 0) system("du " dbname); } mdb_env_close(env); return 0; }

1 0

Re: (ITS#7505) liblmdb can fail with MDB_PAGE_FULL on a delete
by hyc＠symas.com 29 Jan '13

29 Jan '13

Sung Ruo wrote: > Hi Howard: > Our test program has been running for about a day now and the fix is holding up good still. > We used to reproduce this in about 1~2 days. So I'll let it runs for another day. > > Will update again sometime tomorrow. That's good news, thanks for the followup. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7505) liblmdb can fail with MDB_PAGE_FULL on a delete
by quanah＠zimbra.com 29 Jan '13

29 Jan '13

--On Tuesday, January 29, 2013 5:36 PM +0000 sruo(a)vmware.com wrote: > Hi Howard: > Our test program has been running for about a day now and the fix is > holding up good still. We used to reproduce this in about 1~2 days. So > I'll let it runs for another day. > > Will update again sometime tomorrow. Hi Sung, I don't know if you saw, but Howard made a tweak to the 7505 commit yesterday. If you could try current mdb.master from git, that would be helpful. It also has a commit addressing ITS#7511. Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7505) liblmdb can fail with MDB_PAGE_FULL on a delete
by sruo＠vmware.com 29 Jan '13

29 Jan '13

Hi Howard: Our test program has been running for about a day now and the fix is holding up good still. We used to reproduce this in about 1~2 days. So I'll let it runs for another day. Will update again sometime tomorrow. Thanks. --Sung

1 0

(ITS#7511) EINVAL in internal mdb_cursor_del()
by h.b.furuseth＠usit.uio.no 28 Jan '13

28 Jan '13

Full_Name: Hallvard B Furuseth Version: master, d235778c71a50da91741b8b17c572a44b143831b OS: Linux x86_64 URL: Submission from: (NULL) (193.69.163.163) Submitted by: hallvard mdb_cursor_put() can return MDB_SUCCESS with mc.mc_flags == 0. mdb_cursor_del() requires mc.mc_flags & C_INITIALIZED. mdb_txn_commit() can call _del() which fails after _put() succeeds, at the /* was completely used up */ case. This breaks slapadd -l frontier.ldif (without -q) at ada.openldap.org, at "uid=smithhehehe,ou=people,dc=frontiernet,dc=net" (line=527182). Config ~hallvard/frontiercf.ldif. Or to trigger it a lot quicker, insert assert(rc || (mc->mc_flags & C_INITIALIZED)); before 'done:' in mdb_cursor_put(). I'm guessing that is required, since ldbm.h says _put() positions the cursor at the newly inserted item. Or is that only when _inserting_ a new item, not _modifying_ an existing one? The mdb_cursor_del() check for C_INITIALIZED is incorrect, it is evaluated as if ((!mc->mc_flags) & C_INITIALIZED). Maybe that's why this has not been caught before. Same with the test in mdb_cursor_get case MDB_GET_CURRENT.

1 0

(ITS#7510) Group ACL's not cached
by tioteath＠gmail.com 28 Jan '13

28 Jan '13

Full_Name: Tio Teath Version: 2.4.33 OS: Debian GNU Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (178.120.33.222) For some reason group ACL's not cached by slapd during single connection. This behavior lead to major efficiency decrease, especially when groups provided by ldap-proxy. Each ACL produces separate request to the back-end database. Not sure if ACL cached at all, but I tend to think this is inappropriate behavior.

1 0

(ITS#7509) 2.4 Admin Guide olcDatabase={0}config Clarification w.r.t. olcRootDN
by selling＠vml.com 28 Jan '13

28 Jan '13

Full_Name: Steven Elling Version: 2.4.* OS: Irrelevant URL: http://www.openldap.org/doc/admin24/ Submission from: (NULL) (205.240.253.201) The OpenLDAP 2.4 Admin Guide makes no mention of the fact that the "olcRootDN" defined in "olcDatabase={0}config,cn=config" has full access to the "cn=config" DIT (i.e. That there is an implied "olcSuffix" value of "cn=config"). While I now understand this important detail, I think it is best to add this information to the documentation for clarification (or as a reminder) to new and current users of the OpenLDAP software.

1 0

(ITS#7508) 2.4 Administrator's Guide Missing Date on PDF Version
by selling＠vml.com 28 Jan '13

28 Jan '13

Full_Name: Steven Elling Version: 2.4.* OS: Irrelevant URL: http://www.openldap.org/doc/admin24/OpenLDAP-Admin-Guide.pdf Submission from: (NULL) (205.240.253.201) The modified date of the OpenLDAP Software 2.4 Administrator's Guide really needs to be included in the PDF version like it is for both HTML versions. Without the modified date, it is difficult to tell whether a downloaded copy of the PDF is out of date or not.

1 0

(ITS#7507) OpenLDAP Software 2.4 Administrator's Guide PDF Correction (N-Way Multi-Master)
by selling＠vml.com 28 Jan '13

28 Jan '13

Full_Name: Steven Elling Version: 2.4.* OS: Irrelevant URL: http://www.openldap.org/doc/admin24/OpenLDAP-Admin-Guide.pdf Submission from: (NULL) (205.240.253.201) In the "18.3.3. N-Way Multi-Master" section page 171 of the PDF formatted OpenLDAP Software 2.4 Administrator's Guide, the "olcLimits" option of the "olcDatabase={1}$BACKEND,cn=config" example provided is incomplete. It appears the PDF generator cut off the text of "olcLimits" that extended beyond the bounding box.

1 0

Re: (ITS#7506) Diffie-Hellman parameters (DHParamFile) are improperly handled
by ben＠bjencks.net 27 Jan '13

27 Jan '13

I suppose I should attach a test case: cd $WORKDIR openssl dhparam 1536 > dh1536.pem openssl req -new -newkey rsa:2048 -keyout server.key \ -out server.crt -sha256 -nodes -subj '/CN=localhost/' -x509 For GnuTLS, load the following config: dn: cn=config objectClass: olcGlobal cn: config olcTLSCertificateFile: $WORKDIR/server.crt olcTLSCertificateKeyFile: $WORKDIR/server.key olcTLSCipherSuite: NONE:+VERS-TLS1.1:+VERS-TLS1.0:+AES-128-CBC: +DHE-RSA:+SHA1:+COMP-NULL olcTLSDHParamFile: $WORKDIR/dh1536.pem dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config For Openssl, change olcTLSCipherSuite to: olcTLSCipherSuite: aRSA+AES128+kEDH Start up slapd with the config, listening on ldaps://localhost:6636. openssl s_client -connect localhost:6636 With GnuTLS this will fail negotiation; with OpenSSL it will use 1024 bit parameters rather than the 1536 bits params we specified. The only way I've found to find the actual parameter size is to tcpdump the negotiation. First, verify that the negotiated cipher suite is DHE-RSA-AES128-SHA according to s_client, then: tcpdump -i lo -wldap.pcap port 6636 wireshark ldap.pcap Apply the SSL decode to the traffic (right click on packet, Decode As, Transport tab, SSL), find the Server Key Exchange packet, select the Server Key Exchange portion of the handshake message, and look at the hex dump. It should start with 0c, followed by a three byte size, then the next two bytes are the length of the DH parameters: 0080 for 1024 bits, 00c0 for 1536 bits. On 01/27/2013 07:13 PM, openldap-its(a)OpenLDAP.org wrote: > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** > > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7506. > > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. > > If you need to provide additional information in regards to your > issue report, you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7506) > in the subject will automatically be attached to the issue report. > > mailto:openldap-its@openldap.org?subject=(ITS#7506) > > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=7506 > > Please remember to retain your issue tracking number (ITS#7506) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. > > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. > > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ > > -------------- > Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved. >

1 0

(ITS#7506) Diffie-Hellman parameters (DHParamFile) are improperly handled
by ben＠bjencks.net 27 Jan '13

27 Jan '13

Full_Name: Ben Jencks Version: git master OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2601:8:580:1d:5e6:2c43:96d0:4503) Both tls_g.c for GnuTLS and tls_o.c for OpenSSL have major problems in their handling of DHParamFile. Additionally, the documentation is not entirely accurate. For GnuTLS, DH parameters are entirely unimplemented. There appears to be an attempt at generating them in tlsg_ctx_init, but they're never attached to ctx->cred, so they're unused. Additionally, the size is hardcoded. For OpenSSL, there's an attempt to support multiple sizes, but unfortunately it's misusing the OpenSSL API and only 512 or 1024 bit parameters will ever be used. The callback with specified size is only useful for export ciphers: the size isn't negotiated, it's only specified as a maximum when the export flag is set [1]. You want to specify exactly one size and parameter set. The documentation refers to a non-existent TLSEphemeralDHParamFile option. Patches are available below: http://www.bjencks.net/openldap/0001-tls_g.c-Properly-support-DHParamFile.p… http://www.bjencks.net/openldap/0002-tls_o.c-Fix-Diffie-Hellman-parameter-u… http://www.bjencks.net/openldap/0003-DHParamFile-Update-docs.patch I'm a little uncomfortable with leaving a hardcoded parameter set in the OpenSSL code, but I figured it would break compatibility to remove it. A better solution (and the one recommended by OpenSSL) is to add parameter generation to the install scripts. If you'd prefer that, I can modify the patch to get rid of the hardcoded parameter and just not set a DH on the SSL_CTX without a file specified. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Meddius. Meddius has not assigned rights and/or interest in this work to any party. I, Ben Jencks am authorized by Meddius, my employer, to release this work under the following terms. Meddius hereby places the attached modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. [1] http://permalink.gmane.org/gmane.comp.encryption.openssl.user/45805

1 0

Re: (ITS#7503) slapcat: retry a few times when retrieving an entry
by quanah＠zimbra.com 27 Jan '13

27 Jan '13

--On Sunday, January 27, 2013 10:03 PM +0100 Bálint Réczey <balint(a)balintreczey.hu> wrote: > I'll let OpenLDAP developers fix the problem where they find it > appropriate instead. > My intention was adding a retry logic where there was a skip and > continue logic already, in slapcat. Hi Balint, I understand your intent, I'm simply noting it was the wrong approach. Supplying a patch that fixes the actual issue, if you choose to do so, simply means it will have a greater chance of being fixed sooner than later. I.e., it is not a high priority issue at this time for the openldap devs. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7501) added TCP keepalive support to back_ldap
by quanah＠zimbra.com 27 Jan '13

27 Jan '13

--On Sunday, January 27, 2013 7:56 PM +0000 tedcheng(a)symas.com wrote: > Hi Quanah, > > On Jan 27, 2013, at 10:02 AM, Quanah Gibson-Mount wrote: >> >> This has been applied to HEAD and RE24, but it has exposed two issues. >> >> 1) This has broken back-ldap with dynamic configuration > > I got a bug report that the static configuration of the keepalive > parameter does not get successfully converted to dynamic configuration. > Is this the same issue as yours? If not, could you elaborate further? Hi Ted, Yes, the same issue. Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7503) slapcat: retry a few times when retrieving an entry
by balint＠balintreczey.hu 27 Jan '13

27 Jan '13

2013/1/27 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Friday, January 25, 2013 10:26 PM +0000 balint(a)balintreczey.hu wrote: > >> Full_Name: Balint Reczey >> Version: master >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (84.0.168.17) > > > Hi Balint, > > The patch as submitted is rejected, due to the fact that it changes slapadd, > rather than fixing back-bdb/hdb, which is where the actual problem occurs. > I.e., your change is too broad. Feel free to submit an updated patch > correctly updating the back-bdb/hdb code rather than slapadd. > > Thanks, > Quanah > Hi Quanah, I'll let OpenLDAP developers fix the problem where they find it appropriate instead. My intention was adding a retry logic where there was a skip and continue logic already, in slapcat. Cheers, Balint

1 0

Re: (ITS#7501) added TCP keepalive support to back_ldap
by tedcheng＠symas.com 27 Jan '13

27 Jan '13

Hi Quanah, On Jan 27, 2013, at 10:02 AM, Quanah Gibson-Mount wrote: > > This has been applied to HEAD and RE24, but it has exposed two issues. > > 1) This has broken back-ldap with dynamic configuration I got a bug report that the static configuration of the keepalive parameter does not get successfully converted to dynamic configuration. Is this the same issue as yours? If not, could you elaborate further? Thanks, Ted C. Cheng Symas Corporation

1 0

Re: (ITS#7503) slapcat: retry a few times when retrieving an entry
by quanah＠zimbra.com 27 Jan '13

27 Jan '13

--On Sunday, January 27, 2013 6:09 PM +0000 quanah(a)zimbra.com wrote: > --On Friday, January 25, 2013 10:26 PM +0000 balint(a)balintreczey.hu wrote: > >> Full_Name: Balint Reczey >> Version: master >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (84.0.168.17) > > Hi Balint, > > The patch as submitted is rejected, due to the fact that it changes > slapadd, rather than fixing back-bdb/hdb, which is where the actual > problem occurs. I.e., your change is too broad. Feel free to submit > an updated patch correctly updating the back-bdb/hdb code rather than > slapadd. s/slapadd/slapcat/g ;) --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7503) slapcat: retry a few times when retrieving an entry
by quanah＠zimbra.com 27 Jan '13

27 Jan '13

--On Friday, January 25, 2013 10:26 PM +0000 balint(a)balintreczey.hu wrote: > Full_Name: Balint Reczey > Version: master > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (84.0.168.17) Hi Balint, The patch as submitted is rejected, due to the fact that it changes slapadd, rather than fixing back-bdb/hdb, which is where the actual problem occurs. I.e., your change is too broad. Feel free to submit an updated patch correctly updating the back-bdb/hdb code rather than slapadd. Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7501) added TCP keepalive support to back_ldap
by quanah＠zimbra.com 27 Jan '13

27 Jan '13

--On Thursday, January 24, 2013 4:16 PM +0000 tedcheng(a)symas.com wrote: > > On Jan 24, 2013, at 5:32 AM, Howard Chu wrote: > >> tedcheng(a)symas.com wrote: >>> Full_Name: Ted C. Cheng >>> Version: master >>> OS: Linux/Solaris >>> URL: https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch >>> Submission from: (NULL) (76.174.253.197) Hi Ted, This has been applied to HEAD and RE24, but it has exposed two issues. 1) This has broken back-ldap with dynamic configuration 2) back-meta should be updated to support this parameter as well. Can you please supply an updated patch based off current RE24 and HEAD addressing these two issues. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7505) liblmdb can fail with MDB_PAGE_FULL on a delete
by hyc＠OpenLDAP.org 27 Jan '13

27 Jan '13

Full_Name: Howard Chu Version: RE24/master OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc This is the last remaining FIXME in liblmdb/mdb.c... mdb_rebalance() is always called after a delete operation. If the tree needs balancing and it needs to move a node from one page to its sibling, the parent page's separator keys will need updating. If the new separator key is larger than the old one, it may not fit into the parent page, and mdb_update_key() will return MDB_PAGE_FULL. Instead of giving up, mdb_update_key() should invoke mdb_page_split() to make room for the new key.

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 26 Jan '13

26 Jan '13

Any chance to see this patch appear in 2.4.34? Ciao, Michael.

1 0

(ITS#7504) document slapcat exit codes in man page
by balint＠balintreczey.hu 25 Jan '13

25 Jan '13

Full_Name: Balint Reczey Version: master OS: Linux URL: http://rbalint.cs.bme.hu/0002-document-slapcat-exit-codes-in-man-page.patch Submission from: (NULL) (84.0.168.17) Slapcat's exit value was undocumented, this patch aims to fix that. Copyright 2013 Balint Reczey <balint(a)balintreczey.hu> Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License.

1 0

(ITS#7503) slapcat: retry a few times when retrieving an entry
by balint＠balintreczey.hu 25 Jan '13

25 Jan '13

Full_Name: Balint Reczey Version: master OS: Linux URL: http://rbalint.cs.bme.hu/0001-slapcat-retry-a-few-times-when-retrieving-an-… Submission from: (NULL) (84.0.168.17) From: Axel Beckert <beckert(a)phys.ethz.ch> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: slapd: slapcat output truncated every now and then Date: Tue, 15 May 2012 18:33:57 +0200 Package: slapd Severity: grave Version: 2.4.23-7.2 Justification: Causes data loss Every now and then slapcat's output does not contain the whole content of the LDAP but is truncated at some LDIF entry border (i.e. all printed LDIF records seem complete). To reproduce run "while sleep 1; do slapcat | wc; done" on a moderately busy LDAP server (writes every few seconds to minutes; about 10000 entries) while slapd is running and notice the occasionally occurring huge change in wc's printed values, e.g.: # while sleep 1; do slapcat | wc; done 471698 1015498 15336677 471698 1015498 15336677 471698 1015498 15336677 ... 471698 1015497 15336635 471698 1015497 15336635 281829 606820 8632165 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336635 308627 664573 9476751 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336637 Please see email thread starting at http://www.openldap.org/lists/openldap-technical/201301/msg00195.html The attached modifications to OpenLDAP Software are subject to the following notice: Copyright 2013 Balint Reczey <balint(a)balintreczey.hu> Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License.

1 0

(ITS#7502) slapcat: retry a few times when retrieving an entry
by balint＠balintreczey.hu 25 Jan '13

25 Jan '13

Full_Name: Balint Reczey Version: master OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.0.168.17) From: Axel Beckert <beckert(a)phys.ethz.ch> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: slapd: slapcat output truncated every now and then Date: Tue, 15 May 2012 18:33:57 +0200 Package: slapd Severity: grave Version: 2.4.23-7.2 Justification: Causes data loss Every now and then slapcat's output does not contain the whole content of the LDAP but is truncated at some LDIF entry border (i.e. all printed LDIF records seem complete). To reproduce run "while sleep 1; do slapcat | wc; done" on a moderately busy LDAP server (writes every few seconds to minutes; about 10000 entries) while slapd is running and notice the occasionally occurring huge change in wc's printed values, e.g.: # while sleep 1; do slapcat | wc; done 471698 1015498 15336677 471698 1015498 15336677 471698 1015498 15336677 ... 471698 1015497 15336635 471698 1015497 15336635 281829 606820 8632165 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336635 308627 664573 9476751 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336637 Please see email thread starting at http://www.openldap.org/lists/openldap-technical/201301/msg00195.html

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 25 Jan '13

25 Jan '13

Le 25/01/2013 15:59, Howard Chu a écrit : > Benin Technologies wrote: >> i was just testing back-sql, so my slapd.conf is basically the one >> that's shipped with openldap, as in >> "servers/slapd/back-sql/rdbms_depend/pgsql/slapd.conf > > OK, found the bug, fixed now in master. YEP, just tested it, it works. Many thanks !

1 0

Re: (ITS#7499)
by hyc＠symas.com 25 Jan '13

25 Jan '13

Benin Technologies wrote: > i was just testing back-sql, so my slapd.conf is basically the one > that's shipped with openldap, as in > "servers/slapd/back-sql/rdbms_depend/pgsql/slapd.conf OK, found the bug, fixed now in master. > Le 24/01/2013 20:00, Howard Chu a écrit : >> Benin Technologies wrote: >>> Le 24/01/2013 13:31, Howard Chu a écrit : >>>> Ah. In that case the fix must still be wrong. (Sorry, I'm patching >>>> this blind as I don't have any current SQL installation to test with.) >> >>> OK let me know when you fixed it, it the meantime I'll switch back to >>> slapd.conf >> >> Can you please include your slapd.conf here in this ITS? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

i was just testing back-sql, so my slapd.conf is basically the one that's shipped with openldap, as in "servers/slapd/back-sql/rdbms_depend/pgsql/slapd.conf I just changed a few parameters, like the pid and argfile directory, odbc and database parameters here it is include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw secret dbname LdapTest dbuser ldaptest dbpasswd ldaptest insentry_stmt "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)" upper_func "upper" strcast_func "text" concat_pattern "?||?" has_ldapinfo_dn_ru no Le 24/01/2013 20:00, Howard Chu a écrit : > Benin Technologies wrote: >> Le 24/01/2013 13:31, Howard Chu a écrit : >>> Ah. In that case the fix must still be wrong. (Sorry, I'm patching >>> this blind as I don't have any current SQL installation to test with.) > >> OK let me know when you fixed it, it the meantime I'll switch back to >> slapd.conf > > Can you please include your slapd.conf here in this ITS? >

1 0

Re: (ITS#7499)
by hyc＠symas.com 24 Jan '13

24 Jan '13

Benin Technologies wrote: > Le 24/01/2013 13:31, Howard Chu a écrit : >> Ah. In that case the fix must still be wrong. (Sorry, I'm patching >> this blind as I don't have any current SQL installation to test with.) > OK let me know when you fixed it, it the meantime I'll switch back to > slapd.conf Can you please include your slapd.conf here in this ITS? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

Le 24/01/2013 13:31, Howard Chu a écrit : > Benin Technologies wrote: >> Yes the fix worked (I downloaded the latest openldap.tar.gz on your >> gitweb and installed it). Now slapd starts after having converted to >> cn=config >> >> But after the conversion my ldapsearch returns an 80 error (with >> slapd.conf it worked, the data from PostgreSQL where returned) >> Thus my question : are there other steps to be taken after the >> conversion (all I did was : slaptest -f slapd.conf -F slapd.d) > > Ah. In that case the fix must still be wrong. (Sorry, I'm patching > this blind as I don't have any current SQL installation to test with.) > OK let me know when you fixed it, it the meantime I'll switch back to slapd.conf Thanks BT

1 0

Re: (ITS#7501) added TCP keepalive support to back_ldap
by tedcheng＠symas.com 24 Jan '13

24 Jan '13

On Jan 24, 2013, at 5:32 AM, Howard Chu wrote: > tedcheng(a)symas.com wrote: >> Full_Name: Ted C. Cheng >> Version: master >> OS: Linux/Solaris >> URL: https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch >> Submission from: (NULL) (76.174.253.197) >> >> >> >> Please find in the URL a patch that adds TCP keepalive support to back_ldap. >> >> Please review and apply the patch. > > Note - constructs like "#if 0" are only used for tentative/experimental changes. For patches intended to be released to the public, just delete the blocked out lines. > "#if 0" seems to be a common practice in the code. I only removed the one in the patch. Please find in the link below. https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch Ted C. Cheng Symas Corporation

1 0

Re: (ITS#7501) added TCP keepalive support to back_ldap
by hyc＠symas.com 24 Jan '13

24 Jan '13

tedcheng(a)symas.com wrote: > Full_Name: Ted C. Cheng > Version: master > OS: Linux/Solaris > URL: https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch > Submission from: (NULL) (76.174.253.197) > > > > Please find in the URL a patch that adds TCP keepalive support to back_ldap. > > Please review and apply the patch. Note - constructs like "#if 0" are only used for tentative/experimental changes. For patches intended to be released to the public, just delete the blocked out lines. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7496) Segemtation fault in mdb_entry_decode
by meike.stone＠googlemail.com 24 Jan '13

24 Jan '13

>> Thread 1 (Thread 0x7f738b21c700 (LWP 19394)): > > >> #1 0x0000000000501d30 in mdb_search (op=0xc3a020, rs=0x7f738b21ba30) at >> search.c:720 >> scopeok = 1 >> edata = {mv_size = 0, mv_data = 0x7f74bbb99728} > > > This indicates that the entry being debugged is actually zero bytes, i.e. > it's not a valid entry at all. Nodes like this get stored in the database > during slapadd when a child entry gets added before its parent; a zero-byte > stub is stored as a placeholder for the missing parent. > When you ran slapadd > you should have seen warning messages about missing entries, telling you > that your LDIF is incomplete. Yes you are right, I repeated the import via slapcat to test and got this error message: ~ # slapadd -w -q -f /etc/openldap/slapd.conf -l /backup.ldif 50f98421 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable -#################### 100.00% eta none elapsed 09m18s spd 4.6 M/s Closing DB...Error, entries missing! entry 1156449: cn=1356155776-83002,ou=... ,... ,ou=root (I shortened the entry DN in output with "...") I recognized this message before, but thought the entry was not imported ... > > We can prevent the SEGV but your database is still invalid because your LDIF > is invalid. Yes, will ask in the mailing list for additional information not directly releated to this SEGV. Thanks Kindly regards Maike

1 0

Re: (ITS#7499)
by hyc＠symas.com 24 Jan '13

24 Jan '13

Benin Technologies wrote: > Yes the fix worked (I downloaded the latest openldap.tar.gz on your > gitweb and installed it). Now slapd starts after having converted to > cn=config > > But after the conversion my ldapsearch returns an 80 error (with > slapd.conf it worked, the data from PostgreSQL where returned) > Thus my question : are there other steps to be taken after the > conversion (all I did was : slaptest -f slapd.conf -F slapd.d) Ah. In that case the fix must still be wrong. (Sorry, I'm patching this blind as I don't have any current SQL installation to test with.) > I don't think this has something to do with that 7499 bug, so I'll post > the question on the technical mailing list (but if nobody bumped into > that 7499 bug before, it logically means that nobody is using back-sql > with cn=config yet) Agreed, I think it's unlikely that anyone else has used this yet. > > ldapsearch -x -h localhost -b "dc=example,dc=com" "(objectClass=*)" > # extended LDIF > # > # LDAPv3 > # base <dc=example,dc=com> with scope subtree > # filter: (objectClass=*) > # requesting: ALL > # > > # search result > search: 2 > result: 80 Other (e.g., implementation specific) error > > # numResponses: 1 > > > Le 24/01/2013 04:46, Howard Chu a écrit : >> Benin Technologies wrote: >>>>>>> Yes, it's a bug. The conversion should have used double-quotes on >>> these >>>>>>> parameters. Will be fixed shortly. >>> >>> >>> ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in >>> the file olcDatabase={1}sql.ldif, like this : >>> >>> olcSqlInsEntryStmt: "insert into ldap_entries >>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>> ldap_entries),?,?,?,?)" >>> >>> >>> Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation >>> specific error)". With the old "slapd.conf", ldapsearch works fine. Is >>> there anything else to do when converting slapd.conf to cn=config on a >>> back-sql implementation ? >> >> Yes, actually the quotes are optional, but you must get the fix from git. >> Commit 56a0d9004f0fba943028041ea5af62338b6dfccd >>> >>> >>> >>> >>> Le 24/01/2013 02:44, hyc(a)symas.com a écrit : >>>> benintechnologies(a)yahoo.fr wrote: >>>>> Hi, >>>>> >>>>> thank you for your reply >>>>> >>>>> I simply took the slapd.conf file adapted to PostgreSQL in the source >>>>> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >>>>> >>>>> In that file, we have : >>>>> olcSqlInsEntryStmt: insert into ldap_entries >>>>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>>>> ldap_entries),?,?,?,?) >>>>> >>>>> it works with static configuration (slapd.conf) : I successfully >>>>> managed >>>>> to insert some data into the postgresql tables >>>>> >>>>> But after having converted it to cn=config (slaptest -f slapd.conf -F >>>>> slapd.d) slapd doesn't start anymore : >>>>> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >>>>> <cn=root,dc=example,dc=com> >>>>> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra >>>>> cruft >>>>> after<SQL expression>. >>>>> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >>>>> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >>>>> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >>>>> 50ff3f0a send_ldap_result: err=19 matched="" text="" >>>>> 50ff3f0a slapd destroy: freeing system resources. >>>>> 50ff3f0a slapd stopped. >>>>> 50ff3f0a connections_destroy: nothing to destroy. >>>>> >>>>> I believe it's a bug, no ? >>> >>> >> >> > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

Yes the fix worked (I downloaded the latest openldap.tar.gz on your gitweb and installed it). Now slapd starts after having converted to cn=config But after the conversion my ldapsearch returns an 80 error (with slapd.conf it worked, the data from PostgreSQL where returned) Thus my question : are there other steps to be taken after the conversion (all I did was : slaptest -f slapd.conf -F slapd.d) I don't think this has something to do with that 7499 bug, so I'll post the question on the technical mailing list (but if nobody bumped into that 7499 bug before, it logically means that nobody is using back-sql with cn=config yet) ldapsearch -x -h localhost -b "dc=example,dc=com" "(objectClass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 Le 24/01/2013 04:46, Howard Chu a écrit : > Benin Technologies wrote: >> >>>>Yes, it's a bug. The conversion should have used double-quotes on >> these >> >>>>parameters. Will be fixed shortly. >> >> >> ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in >> the file olcDatabase={1}sql.ldif, like this : >> >> olcSqlInsEntryStmt: "insert into ldap_entries >> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >> ldap_entries),?,?,?,?)" >> >> >> Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation >> specific error)". With the old "slapd.conf", ldapsearch works fine. Is >> there anything else to do when converting slapd.conf to cn=config on a >> back-sql implementation ? > > Yes, actually the quotes are optional, but you must get the fix from git. > Commit 56a0d9004f0fba943028041ea5af62338b6dfccd >> >> >> >> >> Le 24/01/2013 02:44, hyc(a)symas.com a écrit : >>> benintechnologies(a)yahoo.fr wrote: >>>> Hi, >>>> >>>> thank you for your reply >>>> >>>> I simply took the slapd.conf file adapted to PostgreSQL in the source >>>> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >>>> >>>> In that file, we have : >>>> olcSqlInsEntryStmt: insert into ldap_entries >>>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>>> ldap_entries),?,?,?,?) >>>> >>>> it works with static configuration (slapd.conf) : I successfully >>>> managed >>>> to insert some data into the postgresql tables >>>> >>>> But after having converted it to cn=config (slaptest -f slapd.conf -F >>>> slapd.d) slapd doesn't start anymore : >>>> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >>>> <cn=root,dc=example,dc=com> >>>> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra >>>> cruft >>>> after<SQL expression>. >>>> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >>>> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >>>> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >>>> 50ff3f0a send_ldap_result: err=19 matched="" text="" >>>> 50ff3f0a slapd destroy: freeing system resources. >>>> 50ff3f0a slapd stopped. >>>> 50ff3f0a connections_destroy: nothing to destroy. >>>> >>>> I believe it's a bug, no ? >> >> > >

1 0

Re: (ITS#7498) Openldap syncrepl issue
by arunkumar_1123＠yahoo.com 23 Jan '13

23 Jan '13

> MMR has supported delta-syncrepl since 2.4.27. You should use it. I did consider delta-syncrepl, but given the high write load expected, I was not sure if it was the right decision. I am expecting an average load of 50-100 writes per second, and with 1 backup provider, and 10 consumers, it might get heavy on the provider which is serving the writes, given that OpenLDAP would be maintaining another DB for the access log. But with this syncrepl issue, it looks like I need to change the replication mode to refreshAndPersist anyway. As such it looks like delta syncrepl is also refreshAndPersist too. Is there any recommendation between simple refreshAndPersist and delta-syncrepl with refreshAndPersist for high write loads? Thanks PS: I see that delta syncrepl is compatible with MMR which I presume to be MultiMaster. I hope it works with Mirror Mode too. I did not find any documents supporting this.

1 0

(ITS#7501) added TCP keepalive support to back_ldap
by tedcheng＠symas.com 23 Jan '13

23 Jan '13

Full_Name: Ted C. Cheng Version: master OS: Linux/Solaris URL: https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch Submission from: (NULL) (76.174.253.197) Please find in the URL a patch that adds TCP keepalive support to back_ldap. Please review and apply the patch. Thanks, Ted C. Cheng Symas Corporation

1 0

Re: (ITS#7499)
by hyc＠symas.com 23 Jan '13

23 Jan '13

Benin Technologies wrote: > >>>>Yes, it's a bug. The conversion should have used double-quotes on these > >>>>parameters. Will be fixed shortly. > > > ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in > the file olcDatabase={1}sql.ldif, like this : > > olcSqlInsEntryStmt: "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)" > > > Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation > specific error)". With the old "slapd.conf", ldapsearch works fine. Is > there anything else to do when converting slapd.conf to cn=config on a > back-sql implementation ? Yes, actually the quotes are optional, but you must get the fix from git. Commit 56a0d9004f0fba943028041ea5af62338b6dfccd > > > > > Le 24/01/2013 02:44, hyc(a)symas.com a écrit : >> benintechnologies(a)yahoo.fr wrote: >>> Hi, >>> >>> thank you for your reply >>> >>> I simply took the slapd.conf file adapted to PostgreSQL in the source >>> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >>> >>> In that file, we have : >>> olcSqlInsEntryStmt: insert into ldap_entries >>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>> ldap_entries),?,?,?,?) >>> >>> it works with static configuration (slapd.conf) : I successfully managed >>> to insert some data into the postgresql tables >>> >>> But after having converted it to cn=config (slaptest -f slapd.conf -F >>> slapd.d) slapd doesn't start anymore : >>> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >>> <cn=root,dc=example,dc=com> >>> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft >>> after<SQL expression>. >>> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >>> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >>> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >>> 50ff3f0a send_ldap_result: err=19 matched="" text="" >>> 50ff3f0a slapd destroy: freeing system resources. >>> 50ff3f0a slapd stopped. >>> 50ff3f0a connections_destroy: nothing to destroy. >>> >>> I believe it's a bug, no ? > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 23 Jan '13

23 Jan '13

>>>>Yes, it's a bug. The conversion should have used double-quotes on these >>>>parameters. Will be fixed shortly. ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in the file olcDatabase={1}sql.ldif, like this : olcSqlInsEntryStmt: "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)" Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation specific error)". With the old "slapd.conf", ldapsearch works fine. Is there anything else to do when converting slapd.conf to cn=config on a back-sql implementation ? Le 24/01/2013 02:44, hyc(a)symas.com a écrit : > benintechnologies(a)yahoo.fr wrote: >> Hi, >> >> thank you for your reply >> >> I simply took the slapd.conf file adapted to PostgreSQL in the source >> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >> >> In that file, we have : >> olcSqlInsEntryStmt: insert into ldap_entries >> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >> ldap_entries),?,?,?,?) >> >> it works with static configuration (slapd.conf) : I successfully managed >> to insert some data into the postgresql tables >> >> But after having converted it to cn=config (slaptest -f slapd.conf -F >> slapd.d) slapd doesn't start anymore : >> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >> <cn=root,dc=example,dc=com> >> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft >> after<SQL expression>. >> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >> 50ff3f0a send_ldap_result: err=19 matched="" text="" >> 50ff3f0a slapd destroy: freeing system resources. >> 50ff3f0a slapd stopped. >> 50ff3f0a connections_destroy: nothing to destroy. >> >> I believe it's a bug, no ?

1 0

(ITS#7500) libldap starttls crashes if invalid GnuTLS cipher suite string
by jouko.orava＠iki.fi 23 Jan '13

23 Jan '13

Full_Name: Jouko Orava Version: 2.4.28, 2.4.33 OS: Debian/Ubuntu URL: Submission from: (NULL) (82.181.197.37) If the cipher suite string is unacceptable to GnuTLS, libldap_r-2.4 crashes in ldap_start_tls_s() due to a double free. See https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1103353 for my original bug submission, including a suggested patch, https://launchpadlibrarian.net/129174364/openldap-ciphersuite.patch and a simple example ldapsearch-like program that can be used to test the issue. This bug is not critical, since using a valid GnuTLS cipher suite does work, for example "NORMAL" or "SECURE256". However, trying to use anything more specific is exceedingly difficult -- basically trial and error, due to applications crashing in libldap with an invalid one. The two other TLS implementations in OpenLDAP are not affected by this bug. The double free occurs in openldap/libraries/libldap/tls2.c:ldap_int_tls_init_ctx(), in the ldap_pvt_tls_ctx_free(lo->ldo_tls_ctx); call in the error_exit: path. Because the cipher suite string was unacceptable to GnuTLS, the context is either released by GnuTLS or never properly initialized. The error_exit: path tries to release that context, and causes the C library to abort the program as it detects a double free. Simply commenting the ldap_pvt_tls_ctx_free(lo->ldo_tls_ctx); call in the error_exit: path in openldap/libraries/libldap/tls2.c:ldap_int_tls_init_ctx() masks the issue, but is obviously incorrect (as it affects the two other TLS implementations too). My suggested patch is to use the configured cipher suite string when creating the new TLS context, instead of "NORMAL" as is currently done, in openldap/libraries/libldap/tls_g.c:tlsg_ctx_new(). If there is a problem with the cipher suite priority string, the initial context is torn down, and caught earlier in openldap/libraries/libldap/tls2.c, avoiding the crash. (However, the cipher suite string will be parsed twice.) There seem to be numerous unhandled bug reports in various distributions and applications, including http://www.openldap.org/its/index.cgi/Incoming?id=6939#themesg which are quite tricky to investigate, as the actual bug occurs deep in libldap. Only user checks with a patched libldap will prove whether these are actually caused by this bug or not. It is very easy to assume it is an application bug, due to the symptoms and pretty limited circumstances. Recap: libldap + GnuTLS, application using ldap_start_tls, and any cipher suite string not acceptable to GnuTLS will cause libldap to crash due to a double free.

1 0

Re: (ITS#7499)
by hyc＠symas.com 23 Jan '13

23 Jan '13

benintechnologies(a)yahoo.fr wrote: > Hi, > > thank you for your reply > > I simply took the slapd.conf file adapted to PostgreSQL in the source > (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) > > In that file, we have : > olcSqlInsEntryStmt: insert into ldap_entries > (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from > ldap_entries),?,?,?,?) > > it works with static configuration (slapd.conf) : I successfully managed > to insert some data into the postgresql tables > > But after having converted it to cn=config (slaptest -f slapd.conf -F > slapd.d) slapd doesn't start anymore : > 0ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, > <cn=root,dc=example,dc=com> > 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft > after <SQL expression>. > 50ff3f0a config error processing olcDatabase={1}sql,cn=config: > <olcSqlInsEntryStmt> *extra cruft after <SQL expression>* > 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 > 50ff3f0a send_ldap_result: err=19 matched="" text="" > 50ff3f0a slapd destroy: freeing system resources. > 50ff3f0a slapd stopped. > 50ff3f0a connections_destroy: nothing to destroy. > > I believe it's a bug, no ? Yes, it's a bug. The conversion should have used double-quotes on these parameters. Will be fixed shortly. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 23 Jan '13

23 Jan '13

Hi, thank you for your reply I simply took the slapd.conf file adapted to PostgreSQL in the source (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) In that file, we have : olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?) it works with static configuration (slapd.conf) : I successfully managed to insert some data into the postgresql tables But after having converted it to cn=config (slaptest -f slapd.conf -F slapd.d) slapd doesn't start anymore : 0ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, <cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft after <SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> *extra cruft after <SQL expression>* 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. I believe it's a bug, no ? thanks BT Le 24/01/2013 00:39, quanah(a)zimbra.com a écrit : > --On Wednesday, January 23, 2013 10:58 PM +0000 benintechnologies(a)yahoo.fr > wrote: > >> I just noticed I forgot some infos, so here is the problem again : >> >> If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the >> line starting with olcSqlInsEntryStmt, then slapd starts fine. >> >> So what's the right syntax for olcSqlInsEntryStmt ??? > > From the man page: > > > insentry_stmt<SQL expression> > The statement that is used to insert a new entry in table > ldap_entries; see "METAINFORMATION USED" for details. The > default is "INSERT INTO ldap_entries (dn, oc_map_id, parent, > keyval) VALUES (?, ?, ?, ?)". > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > >

1 0

Re: (ITS#7499)
by quanah＠zimbra.com 23 Jan '13

23 Jan '13

--On Wednesday, January 23, 2013 10:58 PM +0000 benintechnologies(a)yahoo.fr wrote: > I just noticed I forgot some infos, so here is the problem again : > > If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the > line starting with olcSqlInsEntryStmt, then slapd starts fine. > > So what's the right syntax for olcSqlInsEntryStmt ??? >From the man page: insentry_stmt <SQL expression> The statement that is used to insert a new entry in table ldap_entries; see "METAINFORMATION USED" for details. The default is "INSERT INTO ldap_entries (dn, oc_map_id, parent, keyval) VALUES (?, ?, ?, ?)". --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7499)
by benintechnologies＠yahoo.fr 23 Jan '13

23 Jan '13

I just noticed I forgot some infos, so here is the problem again : Hi, Has anyone out there managed to successfully convert slapd.conf into cn=config with back-sql enabled ? I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql support (./configure --enable-sql) According tohttp://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>,<cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft after<SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after<SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. The error message seems to be "extra cruft after<SQL expression>" If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the line starting with olcSqlInsEntryStmt, then slapd starts fine. So what's the right syntax for olcSqlInsEntryStmt ??? Thanks Ben

1 0

(ITS#7499) bug on dynamic configuration with back-sql
by benintechnologies＠yahoo.fr 23 Jan '13

23 Jan '13

Full_Name: Ben Tech Version: 2.4.33 OS: Debian 6.0.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (41.85.161.126) Hi, I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql. According to http://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, <cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft after <SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after <SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. If I comment that line, the server starts fine # olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) v alues ((select max(id)+1 from ldap_entries),?,?,?,?)

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs