- openldap-bugs - openldap.org

Re: (ITS#7495) access filter not correctly validated if assertion attribute not requested
by michael＠stroeder.com 23 Jan '13

23 Jan '13

Using extra_attrs would be a possible work-around (tested). Unfortunately it seems to trigger a seg fault in slapo-rwm in my setup which is hard to track down to a certain cause. slapd starts ok but quite soon a seg fault message is written to syslog. Just before the seg fault I see the usual search requests of sssd in the logs... Ciao, Michael.

1 0

Re: (ITS#7498) Openldap syncrepl issue
by quanah＠zimbra.com 23 Jan '13

23 Jan '13

--On Wednesday, January 23, 2013 11:59 AM +0000 arunkumar_1123(a)yahoo.com wrote: > Full_Name: Arunkumar shanmugam > Version: 2.4.33 > OS: rhel5 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (203.83.248.32) > > > Hi, > > I've been having issues with syncrepl in openldap. This is plain > syncrepl. I'm not using delta-syncrepl as I run with mirror mode on. MMR has supported delta-syncrepl since 2.4.27. You should use it. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7498) Openldap syncrepl issue
by arunkumar_1123＠yahoo.com 23 Jan '13

23 Jan '13

Full_Name: Arunkumar shanmugam Version: 2.4.33 OS: rhel5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (203.83.248.32) Hi, I've been having issues with syncrepl in openldap. This is plain syncrepl. I'm not using delta-syncrepl as I run with mirror mode on. I've noticed that when there are a large number of writes on the writemaster (Typically around 10 per second) the data on the readslave goes out of sync with the master, typically having entries which have been deleted on the master. The contextCSNs on both the readslaves and writemaster match eventually, but the data doesn't. I'm running the readslave in refreshOnly mode with an interval of 1 minute. I'm using a reasonably large DB of size ~ 2 GB. I turned on the sync logs and found lots of entries with "nonpresent_callback" and "syncrepl_del_nonpresent". Tested this and found it occurring in both 2.4.29 and 2.4.33 (Latest as of this time), and with BDB 4.2.36 as the backend. I was wondering if anyone has faced similar issues before, and if there exists a solution to this problem. I will send any relevant configuration and log snippets as needed. Thanks

1 0

(ITS#7497) ldif_read_record line number overflow
by hyc＠OpenLDAP.org 22 Jan '13

22 Jan '13

Full_Name: Howard Chu Version: RE24/master OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc While trying to load a 150 million entry LDIF file using slapadd, it would finish with no errors but only ~107 million entries were loaded. This turns out to be because at 20 lines per record, the LDIF file contained 3 billion lines, and the line number counter is a signed int. And in slapadd, we have the "jumpline" option to skip some number of input lines, when resuming an interrupted load. The jumpline defaults to 0, if the input line number is less than the jumpline the record is silently skipped. After reading the 2147483647th line of the file, it discards all of the rest until hitting EOF. Will fix this by changing the parameter to unsigned long. This is unfortunately going to require a libldap version bump.

1 0

Re: (ITS#7475) documenting that dynamic lists/groups overlays are mutually exclusive with the memberof overlay
by tedcheng＠symas.com 22 Jan '13

22 Jan '13

On Jan 22, 2013, at 4:40 AM, Howard Chu wrote: > tedcheng(a)symas.com wrote: >> Full_Name: Ted C. Cheng >> Version: trunk >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (76.174.253.197) >> >> >> Document enhancement request: >> >> Dynamic lists/groups do not involve group entry modification. As a result, they >> cannot be used with the memberof overlay. Would the above text, in one single paragraph, be good enough for the documentation? >> >> It would be great to document explicitly, man pages and admin guide, that >> dynamic lists/groups overlays and memberof overlay are mutually exclusive. > > If you have suggested text, please submit the patch here. > Ted C. Cheng Symas Corporation

1 0

Re: (ITS#7475) documenting that dynamic lists/groups overlays are mutually exclusive with the memberof overlay
by hyc＠symas.com 22 Jan '13

22 Jan '13

tedcheng(a)symas.com wrote: > Full_Name: Ted C. Cheng > Version: trunk > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (76.174.253.197) > > > Document enhancement request: > > Dynamic lists/groups do not involve group entry modification. As a result, they > cannot be used with the memberof overlay. > > It would be great to document explicitly, man pages and admin guide, that > dynamic lists/groups overlays and memberof overlay are mutually exclusive. If you have suggested text, please submit the patch here. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7496) Segemtation fault in mdb_entry_decode
by hyc＠symas.com 22 Jan '13

22 Jan '13

meike.stone(a)googlemail.com wrote: > Full_Name: Meike Stone > Version: 2.4.33 and git > OS: Linux / SLES11 SP2 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (193.200.138.3) > > > I use a Database with about 1,500,000 entires and 2,5GByte ldif from slapcat. > This database was exported from our production system running bdb-backend. > > The Problem exist in Version 2.4.33, therefore I took the slapd source from git > (2013/01/21) and I compiled slapd with debugging symbols. > Thread 1 (Thread 0x7f738b21c700 (LWP 19394)): > #1 0x0000000000501d30 in mdb_search (op=0xc3a020, rs=0x7f738b21ba30) at > search.c:720 > scopeok = 1 > edata = {mv_size = 0, mv_data = 0x7f74bbb99728} This indicates that the entry being debugged is actually zero bytes, i.e. it's not a valid entry at all. Nodes like this get stored in the database during slapadd when a child entry gets added before its parent; a zero-byte stub is stored as a placeholder for the missing parent. When you ran slapadd you should have seen warning messages about missing entries, telling you that your LDIF is incomplete. We can prevent the SEGV but your database is still invalid because your LDIF is invalid. > mdb = 0x7f760eff4010 > id = 1156449 > cursor = 1156449 > lastid = 18446744073709551615 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7496) Segemtation fault in mdb_entry_decode
by meike.stone＠googlemail.com 22 Jan '13

22 Jan '13

Full_Name: Meike Stone Version: 2.4.33 and git OS: Linux / SLES11 SP2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (193.200.138.3) I use a Database with about 1,500,000 entires and 2,5GByte ldif from slapcat. This database was exported from our production system running bdb-backend. The Problem exist in Version 2.4.33, therefore I took the slapd source from git (2013/01/21) and I compiled slapd with debugging symbols. My test configuration is simple: -------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/my_ldap_attributes.schema include /etc/openldap/schema/my_ldap_ObjectClasses.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 ############################ # mdb database definitions ############################ database mdb suffix "ou=root" rootdn "cn=admin,ou=root" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 envflags writemap,nometasync index objectClass,entryUUID,entryCSN eq index cn eq,sub . . . some other own indexes here -------------------------------------------- I started my search via: /tmp/ol/usr/local/bin/ldapsearch -x -h localhost -w password -D cn=admin,ou=root -b'ou=root' '(objectClass=*)' >/dev/null and got in the syslog following meassge: Jan 21 17:50:31 debld02 kernel: [348860.053152] slapd[19394]: segfault at 7f760f974ce8 ip 000000000053bea1 sp 00007f738b10a650 error 4 in slapd [400000+227000] Because of this, I configured the kernel to core dump: sysctl -w kernel.core_pattern=/tmp/core sysctl -w kernel.core_uses_pid=1 sysctl -w kernel.suid_dumpable=2 ulimit -c unlimited ulimit -v unlimited Here is the output from Backtrace: (gdb) bt #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 #1 0x0000000000501d30 in mdb_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:720 #2 0x0000000000433d41 in fe_op_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:402 #3 0x0000000000433647 in do_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:247 #4 0x00000000004300f5 in connection_operation (ctx=0x7f738b21bb80, arg_v=0xc3a020) at connection.c:1150 #5 0x0000000000430694 in connection_read_thread (ctx=0x7f738b21bb80, argv=0x9) at connection.c:1286 #6 0x0000000000566c0b in ldap_int_thread_pool_wrapper (xpool=0x8ef460) at tpool.c:688 #7 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 #8 0x00007f760db31c5d in clone () from /lib64/libc.so.6 #9 0x0000000000000000 in ?? () ======================================== (gdb) bt full #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 have_nval = 0 mdb = 0x7f760eff4010 i = 0 j = 0 nattrs = 2600 nvals = 524289 rc = 32627 a = 0x7f73886fa060 x = 0x7f73886fa010 text = 0x1 <Address 0x1 out of bounds> ad = 0x11a561 lp = 0x7f74bbb99738 ptr = 0x7f74bbb99738 <Address 0x7f74bbb99738 out of bounds> bptr = 0x7f73887187e0 #1 0x0000000000501d30 in mdb_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:720 scopeok = 1 edata = {mv_size = 0, mv_data = 0x7f74bbb99728} mdb = 0x7f760eff4010 id = 1156449 cursor = 1156449 lastid = 18446744073709551615 candidates = {18446744073709551615, 1, 18446744073709551615, 0 <repeats 130260 times>, 140145012714441, 0, 140145012852253, 8589940736, 0, 1102570112642121728, 140134232198960, 0, 0, 4294969344, 0, 144115737831604224, 140134232199008, 0, 0, 4294969344, 0, 72058143793676288, 0, 0, 140145012852253, 562962838323220, 83263594790786, 4294967296, 72058139498840072, 72058139498905608, 18446743519659032584, 122509647347719, 563035852767288, 83263594790786, 8564836354, 144115733536768008, 144115733536833544, 18446743519659032584, 122509647347719, 563035852767292, 83263594790786, 8598329346, 1102570108347285512, 1102570108347351048, 18396392677450186760, 3488165888539164681, 0 <repeats 252 times>, 140145015511498, 24, 140134232201360, 140134232201280, 0, 0, 0, 2050, 0, 0, 0, 0, 140134232201392, 140134240594784, 5912807, 0, 38654705665, 0, 8804682956800, 140134232205552, 5910925, 4294967296, 140144980134384, 17179869184, 10555744, 0 <repeats 35 times>, 4764301, 0, 0, 9576736, 140134232205088, 0, 140134232205088, 9576736, 0, 140134232201856, 5642426, 9576736, 4764202, 140134232205088, 9576768, 0, 0, 140134232201920, 4764448, 0, 9576416, 9576416, 140134232205088, 0, 9576736, 140134232205248, 4752534, 0, 4764301, 140134232205360, 12821496, 9317456, 140134232205312, 0, 140134232205312, 9317456, 0, 140134232202080, 5642426, 9317456, 4764202, 140134232205312, 9317488, 0, 0, 140134232202144, 4764448, 0, 9317136, 9317136, 140134232205312, 0, 9317456, 140134232205472, 4752534, 0, 140134232210000, 140134232205576, 140134232205552, 0 <repeats 42 times>, 3, 140134232204592, 140134232204608, 12, 3, 140145012098155, 18446730733541130240, 140134232204444, 140134232204432, 140134232204488, 0, 0, 140134232204336, 140134232213248, 0, 0, 0, 0, 0, 140134232203296, 0, 0, 0, 0, 5956991, 5956996, 0, 18446744073709551615, 140134232202872, 64, 140145015434880...} scopes = 0x7f7389f1a010 e = 0x0 base = 0xc3a548 matched = 0x0 attrs = 0x0 mask = 5119 stoptime = 1358790564 manageDSAit = 0 tentries = -1 isc = {mt = 0xd3bd50, mc = 0xd3d840, id = 1156449, scopes = 0x7f7389f1a010, numrdns = 7, nscope = 1, rdns = {{bv_len = 19, bv_val = 0x7f74bbba594e <Address 0x7f74bbba594e out of bounds>}, {bv_len = 19, bv_val = 0x7f74bbba29b8 <Address 0x7f74bbba29b8 out of bounds>}, {bv_len = 9, bv_val = 0x7f738e1bffee <Address 0x7f738e1bffee out of bounds>}, {bv_len = 19, bv_val = 0x7f74ad2f49b4 <Address 0x7f74ad2f49b4 out of bounds>}, {bv_len = 18, bv_val = 0x7f74ad2f4821 <Address 0x7f74ad2f4821 out of bounds>}, {bv_len = 19, bv_val = 0x7f74a7f47696 <Address 0x7f74a7f47696 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bbd <Address 0x7f74bc3d2bbd out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bbd <Address 0x7f74bc3d2bbd out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bbd <Address 0x7f74bc3d2bbd out of bounds>}, {bv_len = 0, bv_val = 0x0} <repeats 2039 times>}, nrdns = {{bv_len = 19, bv_val = 0x7f74bbba593a <Address 0x7f74bbba593a out of bounds>}, {bv_len = 19, bv_val = 0x7f74bbba29a4 <Address 0x7f74bbba29a4 out of bounds>}, {bv_len = 9, bv_val = 0x7f738e1bffe4 <Address 0x7f738e1bffe4 out of bounds>}, {bv_len = 19, bv_val = 0x7f74ad2f49a0 <Address 0x7f74ad2f49a0 out of bounds>}, {bv_len = 18, bv_val = 0x7f74ad2f480e <Address 0x7f74ad2f480e out of bounds>}, {bv_len = 19, bv_val = 0x7f74a7f47682 <Address 0x7f74a7f47682 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bb0 <Address 0x7f74bc3d2bb0 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bb0 <Address 0x7f74bc3d2bb0 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bb0 <Address 0x7f74bc3d2bb0 out of bounds>}, {bv_len = 0, bv_val = 0x0} <repeats 2039 times>}} mci = 0xd3d6b0 opinfo = {moi_oe = {oe_next = {sle_next = 0x0}, oe_key = 0x7f760eff4010}, moi_txn = 0xd3bd50, moi_ref = 1, moi_flag = 1 '\001'} moi = 0x7f738b10a7c0 ltid = 0xd3bd50 #2 0x0000000000433d41 in fe_op_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:402 bd = 0x836180 #3 0x0000000000433647 in do_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:247 base = {bv_len = 7, bv_val = 0xc39f97 "ou=root"} siz = 0 off = 0 i = 0 #4 0x00000000004300f5 in connection_operation (ctx=0x7f738b21bb80, arg_v=0xc3a020) at connection.c:1150 rc = 80 cancel = 0 op = 0xc3a020 rs = {sr_type = REP_SEARCH, sr_tag = 0, sr_msgid = 0, sr_err = 0, sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = { sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 1156423, r_v2ref = 0x0}, sru_sasl = { r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} tag = 99 opidx = SLAP_OP_SEARCH conn = 0x7f760bc209f0 memctx = 0xa11320 memctx_null = 0x0 memsiz = 1048576 __PRETTY_FUNCTION__ = "connection_operation" #5 0x0000000000430694 in connection_read_thread (ctx=0x7f738b21bb80, argv=0x9) at connection.c:1286 rc = 0 cri = {op = 0xc3a020, func = 0, arg = 0x0, ctx = 0x7f738b21bb80, nullop = 0} s = 9 #6 0x0000000000566c0b in ldap_int_thread_pool_wrapper (xpool=0x8ef460) at tpool.c:688 pool = 0x8ef460 task = 0xa11490 work_list = 0x8ef4f8 ctx = {ltu_id = 140134232213248, ltu_key = {{ltk_key = 0x42fbef, ltk_data = 0xc39d50, ltk_free = 0x42fa3b <conn_counter_destroy>}, { ltk_key = 0x4a2675, ltk_data = 0xa11320, ltk_free = 0x4a24a4 <slap_sl_mem_destroy>}, {ltk_key = 0x44aba4, ltk_data = 0x0, ltk_free = 0x44aafc <slap_op_q_destroy>}, {ltk_key = 0x7f760ba1e010, ltk_data = 0xd3bd50, ltk_free = 0x53b0f7 <mdb_reader_free>}, { ltk_key = 0x502c94, ltk_data = 0x7f7388f19010, ltk_free = 0x502c74 <search_stack_free>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 27 times>}} kctx = 0x0 i = 32 keyslot = 805 hash = 2547932965 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #7 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #8 0x00007f760db31c5d in clone () from /lib64/libc.so.6 No symbol table info available. #9 0x0000000000000000 in ?? () No symbol table info available. ======================================== (gdb) thread apply all bt Thread 4 (Thread 0x7f760f155700 (LWP 19386)): #0 0x00007f760ddd6f95 in pthread_join () from /lib64/libpthread.so.0 #1 0x000000000056814b in ldap_pvt_thread_join (thread=140134240605952, thread_return=0x0) at thr_posix.c:197 #2 0x000000000042d01e in slapd_daemon () at daemon.c:2935 #3 0x0000000000409029 in main (argc=11, argv=0x7fffd76de248) at main.c:1013 Thread 3 (Thread 0x7f738ba1d700 (LWP 19387)): #0 0x00007f760db322e3 in epoll_wait () from /lib64/libc.so.6 #1 0x000000000042be25 in slapd_daemon_task (ptr=0xa10ec0) at daemon.c:2542 #2 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 #3 0x00007f760db31c5d in clone () from /lib64/libc.so.6 #4 0x0000000000000000 in ?? () Thread 2 (Thread 0x7f738aa1b700 (LWP 19395)): #0 0x00007f760ddda61c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 #1 0x00000000005681f3 in ldap_pvt_thread_cond_wait (cond=0x8ef490, mutex=0x8ef468) at thr_posix.c:277 #2 0x0000000000566b6c in ldap_int_thread_pool_wrapper (xpool=0x8ef460) at tpool.c:675 #3 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 #4 0x00007f760db31c5d in clone () from /lib64/libc.so.6 #5 0x0000000000000000 in ?? () Thread 1 (Thread 0x7f738b21c700 (LWP 19394)): #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 #1 0x0000000000501d30 in mdb_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:720 #2 0x0000000000433d41 in fe_op_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:402 #3 0x0000000000433647 in do_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:247 #4 0x00000000004300f5 in connection_operation (ctx=0x7f738b21bb80, arg_v=0xc3a020) at connection.c:1150 #5 0x0000000000430694 in connection_read_thread (ctx=0x7f738b21bb80, argv=0x9) at connection.c:1286 #6 0x0000000000566c0b in ldap_int_thread_pool_wrapper (xpool=0x8ef460) at tpool.c:688 #7 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 #8 0x00007f760db31c5d in clone () from /lib64/libc.so.6 #9 0x0000000000000000 in ?? () ======================================== (gdb) thread apply all bt full Thread 4 (Thread 0x7f760f155700 (LWP 19386)): #0 0x00007f760ddd6f95 in pthread_join () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000056814b in ldap_pvt_thread_join (thread=140134240605952, thread_return=0x0) at thr_posix.c:197 No locals. #2 0x000000000042d01e in slapd_daemon () at daemon.c:2935 i = 0 rc = 0 #3 0x0000000000409029 in main (argc=11, argv=0x7fffd76de248) at main.c:1013 i = 11 no_detach = 0 rc = -12 urls = 0x8bf090 "ldap:/// " username = 0x8bf0e0 "root" groupname = 0x8bf100 "ldap" sandbox = 0x0 syslogUser = 160 pid = 0 waitfds = {8, 9} g_argc = 11 g_argv = 0x7fffd76de248 configfile = 0x8bf0b0 "/etc/openldap/slapd.conf" configdir = 0x0 serverName = 0x7fffd76df6c0 "slapd" serverMode = 1 scp = 0x0 scp_entry = 0x0 debug_unknowns = 0x0 syslog_unknowns = 0x0 serverNamePrefix = 0x5a4ebd "" l = 4218987 slapd_pid_file_unlink = 1 slapd_args_file_unlink = 1 firstopt = 0 __PRETTY_FUNCTION__ = "main" Thread 3 (Thread 0x7f738ba1d700 (LWP 19387)): #0 0x00007f760db322e3 in epoll_wait () from /lib64/libc.so.6 No symbol table info available. #1 0x000000000042be25 in slapd_daemon_task (ptr=0xa10ec0) at daemon.c:2542 ns = 1 at = 0 nfds = 3 revents = 0x8c4700 tvp = 0x0 cat = {tv_sec = 0, tv_usec = 0} i = 1 nwriters = 0 now = 1358790631 tv = {tv_sec = 0, tv_usec = 0} tdelta = 1 rtask = 0x0 l = 1 last_idle_check = 1358790529 ebadf = 0 tid = 0 #2 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x00007f760db31c5d in clone () from /lib64/libc.so.6 No symbol table info available. #4 0x0000000000000000 in ?? () No symbol table info available. Thread 2 (Thread 0x7f738aa1b700 (LWP 19395)): #0 0x00007f760ddda61c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 No symbol table info available. #1 0x00000000005681f3 in ldap_pvt_thread_cond_wait (cond=0x8ef490, mutex=0x8ef468) at thr_posix.c:277 No locals. #2 0x0000000000566b6c in ldap_int_thread_pool_wrapper (xpool=0x8ef460) at tpool.c:675 pool = 0x8ef460 task = 0x0 work_list = 0x8ef4f8 ctx = {ltu_id = 140134223820544, ltu_key = {{ltk_key = 0x42fbef, ltk_data = 0xb39c30, ltk_free = 0x42fa3b <conn_counter_destroy>}, { ltk_key = 0x4a2675, ltk_data = 0xb397b0, ltk_free = 0x4a24a4 <slap_sl_mem_destroy>}, {ltk_key = 0x44aba4, ltk_data = 0xb39870, ltk_free = 0x44aafc <slap_op_q_destroy>}, {ltk_key = 0x7f760ba1e010, ltk_data = 0xd3a3f0, ltk_free = 0x53b0f7 <mdb_reader_free>}, { ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 28 times>}} kctx = 0x0 i = 32 keyslot = 660 hash = 2646102676 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #3 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #4 0x00007f760db31c5d in clone () from /lib64/libc.so.6 No symbol table info available. #5 0x0000000000000000 in ?? () No symbol table info available. Thread 1 (Thread 0x7f738b21c700 (LWP 19394)): #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 have_nval = 0 mdb = 0x7f760eff4010 i = 0 j = 0 nattrs = 2600 nvals = 524289 rc = 32627 a = 0x7f73886fa060 x = 0x7f73886fa010 ---Type <return> to continue, or q <return> to quit--- text = 0x1 <Address 0x1 out of bounds> ad = 0x11a561 lp = 0x7f74bbb99738 ptr = 0x7f74bbb99738 <Address 0x7f74bbb99738 out of bounds> bptr = 0x7f73887187e0 #1 0x0000000000501d30 in mdb_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:720 scopeok = 1 edata = {mv_size = 0, mv_data = 0x7f74bbb99728} mdb = 0x7f760eff4010 id = 1156449 cursor = 1156449 lastid = 18446744073709551615 candidates = {18446744073709551615, 1, 18446744073709551615, 0 <repeats 130260 times>, 140145012714441, 0, 140145012852253, 8589940736, 0, 1102570112642121728, 140134232198960, 0, 0, 4294969344, 0, 144115737831604224, 140134232199008, 0, 0, 4294969344, 0, 72058143793676288, 0, 0, 140145012852253, 562962838323220, 83263594790786, 4294967296, 72058139498840072, 72058139498905608, 18446743519659032584, 122509647347719, 563035852767288, 83263594790786, 8564836354, 144115733536768008, 144115733536833544, 18446743519659032584, 122509647347719, 563035852767292, 83263594790786, 8598329346, 1102570108347285512, 1102570108347351048, 18396392677450186760, 3488165888539164681, 0 <repeats 252 times>, 140145015511498, 24, 140134232201360, 140134232201280, 0, 0, 0, 2050, 0, 0, 0, 0, 140134232201392, 140134240594784, 5912807, 0, 38654705665, 0, 8804682956800, 140134232205552, 5910925, 4294967296, 140144980134384, 17179869184, 10555744, 0 <repeats 35 times>, 4764301, 0, 0, 9576736, 140134232205088, 0, 140134232205088, 9576736, 0, 140134232201856, 5642426, 9576736, 4764202, 140134232205088, 9576768, 0, 0, 140134232201920, 4764448, 0, 9576416, 9576416, 140134232205088, 0, 9576736, 140134232205248, 4752534, 0, 4764301, 140134232205360, 12821496, 9317456, 140134232205312, 0, 140134232205312, 9317456, 0, 140134232202080, 5642426, 9317456, 4764202, 140134232205312, 9317488, 0, 0, 140134232202144, 4764448, 0, 9317136, 9317136, 140134232205312, 0, 9317456, 140134232205472, 4752534, 0, 140134232210000, 140134232205576, 140134232205552, 0 <repeats 42 times>, 3, 140134232204592, 140134232204608, 12, 3, 140145012098155, 18446730733541130240, 140134232204444, 140134232204432, 140134232204488, 0, 0, 140134232204336, 140134232213248, 0, 0, 0, 0, 0, 140134232203296, 0, 0, 0, 0, 5956991, 5956996, 0, 18446744073709551615, 140134232202872, 64, 140145015434880...} scopes = 0x7f7389f1a010 e = 0x0 base = 0xc3a548 matched = 0x0 attrs = 0x0 mask = 5119 stoptime = 1358790564 manageDSAit = 0 tentries = -1 isc = {mt = 0xd3bd50, mc = 0xd3d840, id = 1156449, scopes = 0x7f7389f1a010, numrdns = 7, nscope = 1, rdns = {{bv_len = 19, bv_val = 0x7f74bbba594e <Address 0x7f74bbba594e out of bounds>}, {bv_len = 19, bv_val = 0x7f74bbba29b8 <Address 0x7f74bbba29b8 out of bounds>}, {bv_len = 9, bv_val = 0x7f738e1bffee <Address 0x7f738e1bffee out of bounds>}, {bv_len = 19, bv_val = 0x7f74ad2f49b4 <Address 0x7f74ad2f49b4 out of bounds>}, {bv_len = 18, bv_val = 0x7f74ad2f4821 <Address 0x7f74ad2f4821 out of bounds>}, {bv_len = 19, bv_val = 0x7f74a7f47696 <Address 0x7f74a7f47696 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bbd <Address 0x7f74bc3d2bbd out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bbd <Address 0x7f74bc3d2bbd out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bbd <Address 0x7f74bc3d2bbd out of bounds>}, {bv_len = 0, bv_val = 0x0} <repeats 2039 times>}, nrdns = {{bv_len = 19, bv_val = 0x7f74bbba593a <Address 0x7f74bbba593a out of bounds>}, {bv_len = 19, bv_val = 0x7f74bbba29a4 <Address 0x7f74bbba29a4 out of bounds>}, {bv_len = 9, bv_val = 0x7f738e1bffe4 <Address 0x7f738e1bffe4 out of bounds>}, {bv_len = 19, bv_val = 0x7f74ad2f49a0 <Address 0x7f74ad2f49a0 out of bounds>}, {bv_len = 18, bv_val = 0x7f74ad2f480e <Address 0x7f74ad2f480e out of bounds>}, {bv_len = 19, bv_val = 0x7f74a7f47682 <Address 0x7f74a7f47682 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bb0 <Address 0x7f74bc3d2bb0 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bb0 <Address 0x7f74bc3d2bb0 out of bounds>}, {bv_len = 12, bv_val = 0x7f74bc3d2bb0 <Address 0x7f74bc3d2bb0 out of bounds>}, {bv_len = 0, bv_val = 0x0} <repeats 2039 times>}} mci = 0xd3d6b0 opinfo = {moi_oe = {oe_next = {sle_next = 0x0}, oe_key = 0x7f760eff4010}, moi_txn = 0xd3bd50, moi_ref = 1, moi_flag = 1 '\001'} moi = 0x7f738b10a7c0 ltid = 0xd3bd50 #2 0x0000000000433d41 in fe_op_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:402 bd = 0x836180 #3 0x0000000000433647 in do_search (op=0xc3a020, rs=0x7f738b21ba30) at search.c:247 base = {bv_len = 7, bv_val = 0xc39f97 "ou=root"} siz = 0 off = 0 i = 0 #4 0x00000000004300f5 in connection_operation (ctx=0x7f738b21bb80, arg_v=0xc3a020) at connection.c:1150 rc = 80 cancel = 0 op = 0xc3a020 rs = {sr_type = REP_SEARCH, sr_tag = 0, sr_msgid = 0, sr_err = 0, sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = { sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 1156423, r_v2ref = 0x0}, sru_sasl = { r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} tag = 99 opidx = SLAP_OP_SEARCH conn = 0x7f760bc209f0 memctx = 0xa11320 memctx_null = 0x0 memsiz = 1048576 __PRETTY_FUNCTION__ = "connection_operation" #5 0x0000000000430694 in connection_read_thread (ctx=0x7f738b21bb80, argv=0x9) at connection.c:1286 rc = 0 cri = {op = 0xc3a020, func = 0, arg = 0x0, ctx = 0x7f738b21bb80, nullop = 0} s = 9 #6 0x0000000000566c0b in ldap_int_thread_pool_wrapper (xpool=0x8ef460) at tpool.c:688 pool = 0x8ef460 task = 0xa11490 work_list = 0x8ef4f8 ctx = {ltu_id = 140134232213248, ltu_key = {{ltk_key = 0x42fbef, ltk_data = 0xc39d50, ltk_free = 0x42fa3b <conn_counter_destroy>}, { ltk_key = 0x4a2675, ltk_data = 0xa11320, ltk_free = 0x4a24a4 <slap_sl_mem_destroy>}, {ltk_key = 0x44aba4, ltk_data = 0x0, ltk_free = 0x44aafc <slap_op_q_destroy>}, {ltk_key = 0x7f760ba1e010, ltk_data = 0xd3bd50, ltk_free = 0x53b0f7 <mdb_reader_free>}, { ltk_key = 0x502c94, ltk_data = 0x7f7388f19010, ltk_free = 0x502c74 <search_stack_free>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 27 times>}} kctx = 0x0 i = 32 keyslot = 805 hash = 2547932965 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #7 0x00007f760ddd67b6 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #8 0x00007f760db31c5d in clone () from /lib64/libc.so.6 No symbol table info available. #9 0x0000000000000000 in ?? () No symbol table info available.

1 0

Re: (ITS#7495) access filter not correctly validated if assertion attribute not requested
by michael＠stroeder.com 18 Jan '13

18 Jan '13

This is a cryptographically signed message in MIME format. --------------ms090800020408080308010509 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hallvard B Furuseth wrote: > Cannot reproduce on RedHat Linux, x86_64. But then, the info was > rather brief. (E.g. which backend? Was that a per-backend or global > ACL? Might some overlays or other access statements interefere?) >=20 > Anyway, please provide a complete config and preferably LDIF which > demonstrates the problem. Thanks for looking it this. As usual this is a more complex customer setup with many ACLs and several= overlays. I tried to provide a simple example but I also see that this do= es not show the issue on my local machine. I will try to strip down the complex config. But this will take a while. Ciao, Michael. --------------ms090800020408080308010509 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTMwMTE4MDk1MDEwWjAjBgkq hkiG9w0BCQQxFgQU1RpOiulz4kW+ZHL3/+Odrcd/p7YwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEANO11SaHS/pNHgOfahbUWbbKPUehk1rFyEtJsKkofAgVQ4JAmRTgOhv6vnVCSv915I3dR uPYCaZWi8QR/lG7p1mVsjCVVSiXrGYysZ4mXnFs5TMyWQTla6FkFH6KdKLU25gbJQy1O2QXV 4enTezhwFCct+ALDMjQXS5ZbWcS3opyrslna4KNypUluj4HQ58DiLdDBnMOSvdpN3mpPheLd oH9+vHRKiPFJQQu2bVBPwWWY4cXvha3SSHRCqDKBTRAtegjTiO1Y6R57Q6vtLFyIouMKyaEA MDpbMCAUAmVcJmm1YTMtfMTjmyxiZyAU6YY7hb5ISHMGYJTuOofdpjsWBgAAAAAAAA== --------------ms090800020408080308010509--

1 0

Re: (ITS#7495) access filter not correctly validated if assertion attribute not requested
by michael＠stroeder.com 17 Jan '13

17 Jan '13

Sorry for the confusion caused by editing what I've copied from the real system before which uses a group for several Samba DC instances. In this example the ACL part should be more simple like this: access to dn.subtree="o=example" attrs=sambaNTPassword filter="(organizationalStatus=0)" by dn.exact="uid=samba_dc,o=example" write by group="cn=slapd Admins,ou=groups,o=example" =sw by self =w by * none Ciao, Michael.

1 0

(ITS#7495) access filter not correctly validated if assertion attribute not requested
by michael＠stroeder.com 17 Jan '13

17 Jan '13

Full_Name: Michael Ströder Version: RE24 6f33e2c OS: Debian Squeeze URL: Submission from: (NULL) (2001:8d8:1fe:1:d6be:d9ff:fe06:a14f) This is tested with RE24 built for Debian Squeeze: It seems that ACLs are not correctly evaluated when processing a search request if the assertion type is not requested in the search request. Example: access to dn.subtree="o=example" attrs=sambaNTPassword filter="(organizationalStatus=0)" by group="uid=samba_dc,o=example" write by group="cn=slapd Admins,ou=groups,o=example" =sw by self =w by * none The following search correctly returns attribute sambaNTPassword of the entry: ldapsearch -LLL -X "dn:uid=samba_dc,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" organizationalStatus sambaNTPassword But this search does not return sambaNTPassword: ldapsearch -LLL -X "dn:uid=samba_dc,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword I cannot find any hint in slapd.access(5) that this is expected behaviour.

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by hyc＠symas.com 16 Jan '13

16 Jan '13

masarati(a)aero.polimi.it wrote: >> Michael Ströder wrote: >>> hyc(a)symas.com wrote: >>>> masarati(a)aero.polimi.it wrote: >>>>> On 01/15/2013 07:40 PM, michael(a)stroeder.com wrote: >>>>> >>>>>> Please consider the attached patch which sets allowed >>>>>> "USAGE dSAOperation". This seems to be the most appropriate USAGE >>>>>> compara= >>>>>> ble >>>>>> to what's set for entryTTL in slapo-dds. >>>>> >>>>> No objection with this patch, since those properties were >>>>> "arbitrarily" >>>>> assigned to attributes defined by others to provide software >>>>> interoperability. Unless anyone has objections, I'd commit it. >>>> >>>> Go ahead. Please add a comment about the origin of the schema >>>> definitions and >>>> these interoperability concerns. >>> >>> These attribute type descriptions were roughly taken from MS AD. >> >> I meant, please add a comment *in the patch* so it will remain in the >> source code. > > There's already a detailed comment to this end in the related README, > which links the attribute definitions on <http://msdn.microsoft.com/>. As already noted, those links don't provide actual schema definitions, nor do they define the USAGE. We're making a judgement call here with no documentation to support it. We should document why we're defining it this way so we don't have to repeat this conversation again down the road. > > p. > >>> Today I've checked the subschema of a W2K8R2 AD server: >>> I did not find a single attribute type description with USAGE although >>> there >>> were attribute types formally defined in RFCs. One example is 'entryTTL' >>> defined with "USAGE dSAOperation" in RFC 2589 which in fact was >>> co-authored by >>> Microsoft employees. >>> >>> The official Microsoft documentation is here [MS-ADA1]: >>> >>> http://msdn.microsoft.com/en-us/library/cc219752.aspx >>> >>> Ciao, Michael. >>> >> >> >> >> > >

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by masarati＠aero.polimi.it 16 Jan '13

16 Jan '13

> Michael Ströder wrote: >> hyc(a)symas.com wrote: >>> masarati(a)aero.polimi.it wrote: >>>> On 01/15/2013 07:40 PM, michael(a)stroeder.com wrote: >>>> >>>>> Please consider the attached patch which sets allowed >>>>> "USAGE dSAOperation". This seems to be the most appropriate USAGE >>>>> compara= >>>>> ble >>>>> to what's set for entryTTL in slapo-dds. >>>> >>>> No objection with this patch, since those properties were >>>> "arbitrarily" >>>> assigned to attributes defined by others to provide software >>>> interoperability. Unless anyone has objections, I'd commit it. >>> >>> Go ahead. Please add a comment about the origin of the schema >>> definitions and >>> these interoperability concerns. >> >> These attribute type descriptions were roughly taken from MS AD. > > I meant, please add a comment *in the patch* so it will remain in the > source code. There's already a detailed comment to this end in the related README, which links the attribute definitions on <http://msdn.microsoft.com/>. p. >> Today I've checked the subschema of a W2K8R2 AD server: >> I did not find a single attribute type description with USAGE although >> there >> were attribute types formally defined in RFCs. One example is 'entryTTL' >> defined with "USAGE dSAOperation" in RFC 2589 which in fact was >> co-authored by >> Microsoft employees. >> >> The official Microsoft documentation is here [MS-ADA1]: >> >> http://msdn.microsoft.com/en-us/library/cc219752.aspx >> >> Ciao, Michael. >> > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by hyc＠symas.com 16 Jan '13

16 Jan '13

Michael Ströder wrote: > hyc(a)symas.com wrote: >> masarati(a)aero.polimi.it wrote: >>> On 01/15/2013 07:40 PM, michael(a)stroeder.com wrote: >>> >>>> Please consider the attached patch which sets allowed >>>> "USAGE dSAOperation". This seems to be the most appropriate USAGE compara= >>>> ble >>>> to what's set for entryTTL in slapo-dds. >>> >>> No objection with this patch, since those properties were "arbitrarily" >>> assigned to attributes defined by others to provide software >>> interoperability. Unless anyone has objections, I'd commit it. >> >> Go ahead. Please add a comment about the origin of the schema definitions and >> these interoperability concerns. > > These attribute type descriptions were roughly taken from MS AD. I meant, please add a comment *in the patch* so it will remain in the source code. > Today I've checked the subschema of a W2K8R2 AD server: > I did not find a single attribute type description with USAGE although there > were attribute types formally defined in RFCs. One example is 'entryTTL' > defined with "USAGE dSAOperation" in RFC 2589 which in fact was co-authored by > Microsoft employees. > > The official Microsoft documentation is here [MS-ADA1]: > > http://msdn.microsoft.com/en-us/library/cc219752.aspx > > Ciao, Michael. >

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 16 Jan '13

16 Jan '13

hyc(a)symas.com wrote: > masarati(a)aero.polimi.it wrote: >> On 01/15/2013 07:40 PM, michael(a)stroeder.com wrote: >> >>> Please consider the attached patch which sets allowed >>> "USAGE dSAOperation". This seems to be the most appropriate USAGE compara= >>> ble >>> to what's set for entryTTL in slapo-dds. >> >> No objection with this patch, since those properties were "arbitrarily" >> assigned to attributes defined by others to provide software >> interoperability. Unless anyone has objections, I'd commit it. > > Go ahead. Please add a comment about the origin of the schema definitions and > these interoperability concerns. These attribute type descriptions were roughly taken from MS AD. Today I've checked the subschema of a W2K8R2 AD server: I did not find a single attribute type description with USAGE although there were attribute types formally defined in RFCs. One example is 'entryTTL' defined with "USAGE dSAOperation" in RFC 2589 which in fact was co-authored by Microsoft employees. The official Microsoft documentation is here [MS-ADA1]: http://msdn.microsoft.com/en-us/library/cc219752.aspx Ciao, Michael.

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by hyc＠symas.com 16 Jan '13

16 Jan '13

masarati(a)aero.polimi.it wrote: > On 01/15/2013 07:40 PM, michael(a)stroeder.com wrote: > >> Please consider the attached patch which sets allowed >> "USAGE dSAOperation". This seems to be the most appropriate USAGE compara= >> ble >> to what's set for entryTTL in slapo-dds. > > No objection with this patch, since those properties were "arbitrarily" > assigned to attributes defined by others to provide software > interoperability. Unless anyone has objections, I'd commit it. Go ahead. Please add a comment about the origin of the schema definitions and these interoperability concerns. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by masarati＠aero.polimi.it 16 Jan '13

16 Jan '13

On 01/15/2013 07:40 PM, michael(a)stroeder.com wrote: > Please consider the attached patch which sets allowed > "USAGE dSAOperation". This seems to be the most appropriate USAGE compara= > ble > to what's set for entryTTL in slapo-dds. No objection with this patch, since those properties were "arbitrarily" assigned to attributes defined by others to provide software interoperability. Unless anyone has objections, I'd commit it. Thanks, p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7490) Security weakness in sha2 password module
by quanah＠zimbra.com 15 Jan '13

15 Jan '13

--On Friday, January 11, 2013 6:19 AM +0000 mhardin(a)symas.com wrote: > Full_Name: Matthew Hardin > Version: 2.4.33+ > OS: All > URL: ftp://ftp.openldap.org/incoming/sha2.c-diff.txt > Submission from: (NULL) (69.43.206.100) > > > contrib/slapd-modules/passwd/sha2/sha2.c uses a series of context buffers > and zeros them out in several places using the following macro: > > MEMSET_BZERO(context, sizeof(context)) > > The variable 'context' is a pointer to a context buffer, so sizeof will > evaluate to the size of a pointer for the particular platform. As a > result, the context buffer is only partially zeroed. > > The correct invocation is: > > MEMSET_BZERO(context, sizeof(*context)) > > which will zero out the complete context buffer. > > The referenced diff details the changes to sha2.c that are necessary to > correct this issue. > > Note this also cleans up warnings reported by MacOS's clang compiler. > > I, Matthew Hardin, hereby place the following modifications to OpenLDAP > Software (and only these modifications) into the public domain. Hence, > these modifications may be freely used and/or redistributed for any > purpose with or without attribution and/or other notice. Can you resubmit the patch using git-format-patch? Or at least using unified diff format? ;) --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated (re-sent)
by michael＠stroeder.com 15 Jan '13

15 Jan '13

This is a multi-part message in MIME format. --------------090002030703010005000105 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit (Re-sent without S/MIME signature to make ITS software happy) Please consider the attached patch which sets allowed "USAGE dSAOperation". This seems to be the most appropriate USAGE comparable to what's set for entryTTL in slapo-dds. I, Michael Ströder, hereby place the attached modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. Ciao, Michael. --------------090002030703010005000105 Content-Type: text/x-patch; name="openldap_its7493.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="openldap_its7493.patch" diff --git a/contrib/slapd-modules/allowed/allowed.c b/contrib/slapd-modules/allowed/allowed.c index b44461a..0099b70 100644 --- a/contrib/slapd-modules/allowed/allowed.c +++ b/contrib/slapd-modules/allowed/allowed.c @@ -73,7 +73,7 @@ static struct { /* added by me :) */ "DESC 'Child classes allowed for a given object' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedChildClasses }, + "USAGE dSAOperation )", &ad_allowedChildClasses }, { "( " AA_SCHEMA_AT ".912 " "NAME 'allowedChildClassesEffective' " "EQUALITY objectIdentifierMatch " @@ -81,7 +81,7 @@ static struct { /* added by me :) */ "DESC 'Child classes allowed for a given object according to ACLs' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedChildClassesEffective }, + "USAGE dSAOperation )", &ad_allowedChildClassesEffective }, { "( " AA_SCHEMA_AT ".913 " "NAME 'allowedAttributes' " "EQUALITY objectIdentifierMatch " @@ -89,7 +89,7 @@ static struct { /* added by me :) */ "DESC 'Attributes allowed for a given object' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedAttributes }, + "USAGE dSAOperation )", &ad_allowedAttributes }, { "( " AA_SCHEMA_AT ".914 " "NAME 'allowedAttributesEffective' " "EQUALITY objectIdentifierMatch " @@ -97,7 +97,7 @@ static struct { /* added by me :) */ "DESC 'Attributes allowed for a given object according to ACLs' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedAttributesEffective }, + "USAGE dSAOperation )", &ad_allowedAttributesEffective }, /* TODO: add objectClass stuff? */ --------------090002030703010005000105--

1 0

Re: (ITS#7494) dynlist overlay and DSAmanageIT control
by masarati＠aero.polimi.it 15 Jan '13

15 Jan '13

> Full_Name: Jon Kidder > Version: 2.4.33 > OS: RHEL 5.0 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (167.239.222.81) > > > I have discovered that the dynamic list overlay in 2.4.33 refuses to > supply > defined dynamic attributes when the DSAmanageIT control is present in a > search > request. How did you discover it, by reading the slapo-dynlist(5) manpage? This has been slapo-dynlist's behavior by design from the beginning. The manageDSAit control is used to inhibit dynamic list expansion and access the actual content of the entry instead (e.g. for DSAit management purposes). p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 15 Jan '13

15 Jan '13

This is a cryptographically signed message in MIME format. --------------ms020008020506010505010302 Content-Type: multipart/mixed; boundary="------------080000060105060705050402" This is a multi-part message in MIME format. --------------080000060105060705050402 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Please consider the attached patch which sets allowed "USAGE dSAOperation". This seems to be the most appropriate USAGE compara= ble to what's set for entryTTL in slapo-dds. I, Michael Str=F6der, hereby place the attached modifications to OpenLDAP= Software (and only these modifications) into the public domain. Hence, th= ese modifications may be freely used and/or redistributed for any purpose wit= h or without attribution and/or other notice. Ciao, Michael. --------------080000060105060705050402 Content-Type: text/x-patch; name="openldap_its7493.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="openldap_its7493.patch" diff --git a/contrib/slapd-modules/allowed/allowed.c b/contrib/slapd-modu= les/allowed/allowed.c index b44461a..0099b70 100644 --- a/contrib/slapd-modules/allowed/allowed.c +++ b/contrib/slapd-modules/allowed/allowed.c @@ -73,7 +73,7 @@ static struct { /* added by me :) */ "DESC 'Child classes allowed for a given object' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedChildClasses }, + "USAGE dSAOperation )", &ad_allowedChildClasses }, { "( " AA_SCHEMA_AT ".912 " "NAME 'allowedChildClassesEffective' " "EQUALITY objectIdentifierMatch " @@ -81,7 +81,7 @@ static struct { /* added by me :) */ "DESC 'Child classes allowed for a given object according to ACLs' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedChildClassesEffective }, + "USAGE dSAOperation )", &ad_allowedChildClassesEffective }, { "( " AA_SCHEMA_AT ".913 " "NAME 'allowedAttributes' " "EQUALITY objectIdentifierMatch " @@ -89,7 +89,7 @@ static struct { /* added by me :) */ "DESC 'Attributes allowed for a given object' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedAttributes }, + "USAGE dSAOperation )", &ad_allowedAttributes }, { "( " AA_SCHEMA_AT ".914 " "NAME 'allowedAttributesEffective' " "EQUALITY objectIdentifierMatch " @@ -97,7 +97,7 @@ static struct { /* added by me :) */ "DESC 'Attributes allowed for a given object according to ACLs' " "NO-USER-MODIFICATION " - "USAGE directoryOperation )", &ad_allowedAttributesEffective }, + "USAGE dSAOperation )", &ad_allowedAttributesEffective }, =20 /* TODO: add objectClass stuff? */ =20 --------------080000060105060705050402-- --------------ms020008020506010505010302 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTMwMTE1MTg0MDAwWjAjBgkq hkiG9w0BCQQxFgQUpoVTENSoP9NXF741WIXk6TTjK0gwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAnErBsB1Irvgi6SFHujzKoEbcOV6VxNDlc7dGSZtr55YPnJ0vvZjPOpXpQ/o+SpeUswFp dLLv1RSwdL/ahZ9L5FFVMcbX9khvD+1beRYFFkhGg/UuVHEQWdZnRRacUT+v93tj9t4Sr526 Wcn7K0if4KtLCkPh0sh4MilBSLScENbWJppsr2sq/K5zy9R0u1XAev2R2qnhlsdnCEqfoLQ3 gISQIM+wmAbn+Az6TYw/vabVYA/pKM4Fbiah3sRfrItVPDMOzYm59CyfjFrjvTSZcH93lUmx iC3GYilhfuyHS9RxO6wIbIjje41x4+Ogm/3FSgfPl6IkiOZepAMHHeiXOQAAAAAAAA== --------------ms020008020506010505010302--

1 0

(ITS#7494) dynlist overlay and DSAmanageIT control
by jckidder＠aep.com 15 Jan '13

15 Jan '13

Full_Name: Jon Kidder Version: 2.4.33 OS: RHEL 5.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (167.239.222.81) I have discovered that the dynamic list overlay in 2.4.33 refuses to supply defined dynamic attributes when the DSAmanageIT control is present in a search request.

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 15 Jan '13

15 Jan '13

On Tue, 15 Jan 2013 13:37:06 GMT masarati(a)aero.polimi.it wrote > Their value depends on ACLs, so in order to reflect ACLs on a specific > DSA they should be generated; however, I concur ACLs should not depend > on the specific DSA of a replication setup. BTW: It does make sense to have different ACLs on different replicas! Think of a master with fine-grained ACLs for entry management and read-only consumers with simpler ACLs for better performance. Ciao, Michael.

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 15 Jan '13

15 Jan '13

On Tue, 15 Jan 2013 13:37:06 GMT masarati(a)aero.polimi.it wrote > On 01/15/2013 01:56 PM, hyc(a)symas.com wrote: > > On Tue, Jan 15, 2013 at 12:18:59PM +0000, michael(a)stroeder.com wrote: > >> Full_Name: > >> Version: RE24 6f33e2c > >> OS: > >> URL: > >> Submission from: (NULL) (2001:8d8:1fe:1:d6be:d9ff:fe06:a14f) > >> > >> > >> It seems that operational attributes generated by slapo-allowed are > >> replicated. > > > Works as designed. These attributes are directoryOperation, not > > DSA-specific. > > I see the point; since they're generated by the overlay in response to > search operations, either they should not be replicated, or replication > should accept them. > > Their value depends on ACLs, so in order to reflect ACLs on a specific > DSA they should be generated; however, I concur ACLs should not depend > on the specific DSA of a replication setup. The values depend on local ACLs *and* current authz-DN. => These attributes MUST NOT be replicated. Ciao, Michael.

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 15 Jan '13

15 Jan '13

On Tue, 15 Jan 2013 12:56:35 GMT hyc(a)symas.com wrote > > It seems that operational attributes generated by slapo-allowed are > > replicated. > > Works as designed. These attributes are directoryOperation, not DSA-specific. > Closing this ITS. The fact that slapo-allowed in contrib/ does not declare the attribute types as DSA-specific does not mean that they are not DSA-specific. I guess MS AD does not care about subschema DSA-specific or not so we have to apply common sense here. The allowed* attr values are supposed to be generated based on the local access control configuration. Since with OpenLDAP local configuration and therefore local ACLs can differ on different replicas these attrs MUST NOT be replicated. Please re-open the ITS. Ciao, Michael.

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by masarati＠aero.polimi.it 15 Jan '13

15 Jan '13

On 01/15/2013 01:56 PM, hyc(a)symas.com wrote: > On Tue, Jan 15, 2013 at 12:18:59PM +0000, michael(a)stroeder.com wrote: >> Full_Name: >> Version: RE24 6f33e2c >> OS: >> URL: >> Submission from: (NULL) (2001:8d8:1fe:1:d6be:d9ff:fe06:a14f) >> >> >> It seems that operational attributes generated by slapo-allowed are replicated. > > Works as designed. These attributes are directoryOperation, not DSA-specific. I see the point; since they're generated by the overlay in response to search operations, either they should not be replicated, or replication should accept them. Their value depends on ACLs, so in order to reflect ACLs on a specific DSA they should be generated; however, I concur ACLs should not depend on the specific DSA of a replication setup. I'm open to suggestions about how to fix this. p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by hyc＠symas.com 15 Jan '13

15 Jan '13

On Tue, Jan 15, 2013 at 12:18:59PM +0000, michael(a)stroeder.com wrote: > Full_Name: > Version: RE24 6f33e2c > OS: > URL: > Submission from: (NULL) (2001:8d8:1fe:1:d6be:d9ff:fe06:a14f) > > > It seems that operational attributes generated by slapo-allowed are replicated. Works as designed. These attributes are directoryOperation, not DSA-specific. Closing this ITS. > Syslog shows: > mods check (allowedAttributes: value #0 invalid per syntax) >

1 0

(ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 15 Jan '13

15 Jan '13

Full_Name: Version: RE24 6f33e2c OS: URL: Submission from: (NULL) (2001:8d8:1fe:1:d6be:d9ff:fe06:a14f) It seems that operational attributes generated by slapo-allowed are replicated. Syslog shows: mods check (allowedAttributes: value #0 invalid per syntax)

1 0

(ITS#7492) add "onerr" to back-ldap
by masarati＠aero.polimi.it 11 Jan '13

11 Jan '13

Full_Name: Pierangelo Masarati Version: HEAD OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2.40.21.25) Submitted by: ando back-meta supports "onerr" to determine search behavior when an error is returned by a remote server; a similar behavior may be desirable for back-ldap. Right now, when an error occurs, back-ldap stops sending entries and returns success. The "onerr stop" directive makes back-ldap return the error instead; "onerr continue" produces the current behavior.

1 0

Re: (ITS#7491) mdb write bus error before adding 5 million keys
by clayton.stangeland＠gmail.com 11 Jan '13

11 Jan '13

Thank you. I did not consider the transaction size. On 1/11/13, Howard Chu <hyc(a)symas.com> wrote: > clayton.stangeland(a)gmail.com wrote: >> Full_Name: Clayton Stangeland >> Version: git mdb.master last commit >> fed573cb86ed99f37bd062908ec814ee0ca47053 >> OS: Fedora 17 64 bit >> URL: ftp://ftp.openldap.org/incoming/mtest-big.c >> Submission from: (NULL) (192.94.73.31) >> >> >> Building and running mdb from git branch mdb.master commit >> fed573cb86ed99f37bd062908ec814ee0ca47053 on Fedora 17 64 bit I get a bus >> error. > > Thanks for the report. The bus error is now fixed in git mdb.master. We > assume > that most users will not batch so many operations into a single > transaction. >> >> When running the test below, which is a modification of mtest.c, I get a >> Bus >> error. This happens while trying to write the file. gdb reports line 3936 >> of >> mdb.c as the erroring line inside mdb_page_search_root: while >> (IS_BRANCH(mp)) { >> >> If I set count to 4 million instead of 5 million it works, and adding back >> in >> all the other mtest.c tests works as well then. >> >> Here is the code: >> /* mtest.c - memory-mapped database tester/toy */ >> /* >> * Copyright 2011 Howard Chu, Symas Corp. >> * All rights reserved. >> * >> * Redistribution and use in source and binary forms, with or without >> * modification, are permitted only as authorized by the OpenLDAP >> * Public License. >> * >> * A copy of this license is available in the file LICENSE in the >> * top-level directory of the distribution or, alternatively, at >> * <http://www.OpenLDAP.org/license.html>. >> */ >> #define _XOPEN_SOURCE 500 /* srandom(), random() */ >> #include <stdio.h> >> #include <stdlib.h> >> #include <time.h> >> #include "lmdb.h" >> >> int main(int argc,char * argv[]) >> { >> int i = 0, j = 0, rc; >> MDB_env *env; >> MDB_dbi dbi; >> MDB_val key, data; >> MDB_txn *txn; >> MDB_stat mst; >> MDB_cursor *cursor; >> int count; >> int *values; >> char sval[32]; >> >> srandom(time(NULL)); >> >> count = (5000000) + 64; >> values = (int *)malloc(count*sizeof(int)); >> >> for(i = 0;i<count;i++) { >> values[i] = random()%1000000000; >> } >> >> rc = mdb_env_create(&env); >> rc = mdb_env_set_mapsize(env, 10485760000); >> rc = mdb_env_open(env, "./testdb", MDB_FIXEDMAP >> /*|MDB_NOSYNC*/, >> 0664); >> rc = mdb_txn_begin(env, NULL, 0, &txn); >> rc = mdb_open(txn, NULL, 0, &dbi); >> >> key.mv_size = sizeof(sval); >> key.mv_data = sval; >> data.mv_size = sizeof(sval); >> data.mv_data = sval; >> >> for (i=0;i<count;i++) { >> sprintf(sval, "%08x %d foo bar", values[i], >> values[i]); >> rc = mdb_put(txn, dbi, &key, &data, >> MDB_NOOVERWRITE); >> if (rc) j++; >> } >> if (j) printf("%d duplicates skipped\n", j); >> rc = mdb_txn_commit(txn); >> rc = mdb_env_stat(env, &mst); >> >> free(values); >> mdb_close(env, dbi); >> mdb_env_close(env); >> >> return 0; >> >> } >> >> > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

1 0

Re: (ITS#7491) mdb write bus error before adding 5 million keys
by hyc＠symas.com 11 Jan '13

11 Jan '13

clayton.stangeland(a)gmail.com wrote: > Full_Name: Clayton Stangeland > Version: git mdb.master last commit fed573cb86ed99f37bd062908ec814ee0ca47053 > OS: Fedora 17 64 bit > URL: ftp://ftp.openldap.org/incoming/mtest-big.c > Submission from: (NULL) (192.94.73.31) > > > Building and running mdb from git branch mdb.master commit > fed573cb86ed99f37bd062908ec814ee0ca47053 on Fedora 17 64 bit I get a bus error. Thanks for the report. The bus error is now fixed in git mdb.master. We assume that most users will not batch so many operations into a single transaction. > > When running the test below, which is a modification of mtest.c, I get a Bus > error. This happens while trying to write the file. gdb reports line 3936 of > mdb.c as the erroring line inside mdb_page_search_root: while (IS_BRANCH(mp)) { > > If I set count to 4 million instead of 5 million it works, and adding back in > all the other mtest.c tests works as well then. > > Here is the code: > /* mtest.c - memory-mapped database tester/toy */ > /* > * Copyright 2011 Howard Chu, Symas Corp. > * All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted only as authorized by the OpenLDAP > * Public License. > * > * A copy of this license is available in the file LICENSE in the > * top-level directory of the distribution or, alternatively, at > * <http://www.OpenLDAP.org/license.html>. > */ > #define _XOPEN_SOURCE 500 /* srandom(), random() */ > #include <stdio.h> > #include <stdlib.h> > #include <time.h> > #include "lmdb.h" > > int main(int argc,char * argv[]) > { > int i = 0, j = 0, rc; > MDB_env *env; > MDB_dbi dbi; > MDB_val key, data; > MDB_txn *txn; > MDB_stat mst; > MDB_cursor *cursor; > int count; > int *values; > char sval[32]; > > srandom(time(NULL)); > > count = (5000000) + 64; > values = (int *)malloc(count*sizeof(int)); > > for(i = 0;i<count;i++) { > values[i] = random()%1000000000; > } > > rc = mdb_env_create(&env); > rc = mdb_env_set_mapsize(env, 10485760000); > rc = mdb_env_open(env, "./testdb", MDB_FIXEDMAP /*|MDB_NOSYNC*/, > 0664); > rc = mdb_txn_begin(env, NULL, 0, &txn); > rc = mdb_open(txn, NULL, 0, &dbi); > > key.mv_size = sizeof(sval); > key.mv_data = sval; > data.mv_size = sizeof(sval); > data.mv_data = sval; > > for (i=0;i<count;i++) { > sprintf(sval, "%08x %d foo bar", values[i], values[i]); > rc = mdb_put(txn, dbi, &key, &data, MDB_NOOVERWRITE); > if (rc) j++; > } > if (j) printf("%d duplicates skipped\n", j); > rc = mdb_txn_commit(txn); > rc = mdb_env_stat(env, &mst); > > free(values); > mdb_close(env, dbi); > mdb_env_close(env); > > return 0; > > } > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7491) mdb write bus error before adding 5 million keys
by clayton.stangeland＠gmail.com 11 Jan '13

11 Jan '13

Full_Name: Clayton Stangeland Version: git mdb.master last commit fed573cb86ed99f37bd062908ec814ee0ca47053 OS: Fedora 17 64 bit URL: ftp://ftp.openldap.org/incoming/mtest-big.c Submission from: (NULL) (192.94.73.31) Building and running mdb from git branch mdb.master commit fed573cb86ed99f37bd062908ec814ee0ca47053 on Fedora 17 64 bit I get a bus error. When running the test below, which is a modification of mtest.c, I get a Bus error. This happens while trying to write the file. gdb reports line 3936 of mdb.c as the erroring line inside mdb_page_search_root: while (IS_BRANCH(mp)) { If I set count to 4 million instead of 5 million it works, and adding back in all the other mtest.c tests works as well then. Here is the code: /* mtest.c - memory-mapped database tester/toy */ /* * Copyright 2011 Howard Chu, Symas Corp. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted only as authorized by the OpenLDAP * Public License. * * A copy of this license is available in the file LICENSE in the * top-level directory of the distribution or, alternatively, at * <http://www.OpenLDAP.org/license.html>. */ #define _XOPEN_SOURCE 500 /* srandom(), random() */ #include <stdio.h> #include <stdlib.h> #include <time.h> #include "lmdb.h" int main(int argc,char * argv[]) { int i = 0, j = 0, rc; MDB_env *env; MDB_dbi dbi; MDB_val key, data; MDB_txn *txn; MDB_stat mst; MDB_cursor *cursor; int count; int *values; char sval[32]; srandom(time(NULL)); count = (5000000) + 64; values = (int *)malloc(count*sizeof(int)); for(i = 0;i<count;i++) { values[i] = random()%1000000000; } rc = mdb_env_create(&env); rc = mdb_env_set_mapsize(env, 10485760000); rc = mdb_env_open(env, "./testdb", MDB_FIXEDMAP /*|MDB_NOSYNC*/, 0664); rc = mdb_txn_begin(env, NULL, 0, &txn); rc = mdb_open(txn, NULL, 0, &dbi); key.mv_size = sizeof(sval); key.mv_data = sval; data.mv_size = sizeof(sval); data.mv_data = sval; for (i=0;i<count;i++) { sprintf(sval, "%08x %d foo bar", values[i], values[i]); rc = mdb_put(txn, dbi, &key, &data, MDB_NOOVERWRITE); if (rc) j++; } if (j) printf("%d duplicates skipped\n", j); rc = mdb_txn_commit(txn); rc = mdb_env_stat(env, &mst); free(values); mdb_close(env, dbi); mdb_env_close(env); return 0; }

1 0

(ITS#7490) Security weakness in sha2 password module
by mhardin＠symas.com 10 Jan '13

10 Jan '13

Full_Name: Matthew Hardin Version: 2.4.33+ OS: All URL: ftp://ftp.openldap.org/incoming/sha2.c-diff.txt Submission from: (NULL) (69.43.206.100) contrib/slapd-modules/passwd/sha2/sha2.c uses a series of context buffers and zeros them out in several places using the following macro: MEMSET_BZERO(context, sizeof(context)) The variable 'context' is a pointer to a context buffer, so sizeof will evaluate to the size of a pointer for the particular platform. As a result, the context buffer is only partially zeroed. The correct invocation is: MEMSET_BZERO(context, sizeof(*context)) which will zero out the complete context buffer. The referenced diff details the changes to sha2.c that are necessary to correct this issue. Note this also cleans up warnings reported by MacOS's clang compiler. I, Matthew Hardin, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

RE: (ITS#7434) idassert-bind fails after restarting slapd
by blance3459＠hotmail.com 10 Jan '13

10 Jan '13

Okay, trying again with Thunderbird since Hotmail is determined only to send in HTML format... Quanah, Trying to post a reply using my Hotmail account. Sorry for the unreadable output previously posted. I'm almost embarrassed to say I've been involved in IT for over 15 years and never used a mailing list before. Anyhow, I did download the source packages and compiled them. However, the semester was winding down and I was under a lot of pressure to have something completed before the end of finals week so my professor could assign me a grade for the work I had done. I revered back to my previous version to to get some stuff written. Not to mention, my algorithms professor was kicking my butt too. Will I ever "really" need an FFT in the real world? lol The more I looked at what I was trying to accomplish, I realized I was attacking the problem all wrong. What I was being asked to do was something more like configuring my two slapd servers to act more like Active Directory global catalog servers. GC's utilize MM instead of single master replication so I scrapped the SM replication design in favor of MM. Once this was done, I no longer needed the chaining overlay or proxy auth. I now have MM replication of both cn=config and my directory data (with delta) working and my Kerberos KDC's are happy. One thing I did find was that configuring MM replication made me learn a little more about how to "properly" name/configure an overlay with the syncprov and accesslog modules by digging into the test scripts. I had some issues with sync state on the consumers , but I found a post you made to someone else a few years back that solved my delta replication issue by configuring an syncprov overlay on the accesslog db. Not sure I remember seeing that in the Admin Guide. Looking back at the original post I noticed the chain overlay I had configured was dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend, cn=config. knowing what I know now, I'm not 100% sure that was correct. Shouldn't that overlay have been in either config database of my directory or ldap backend database for the chain rather than a "frontend"? Just a thought I've been kicking around in my head. Either way, I have my ldap config working. We can either close this issue if you'd like or leave it open and I'll attempt to confirm my theory on the overlay not being properly located when I get a chance. Completely your choice. But I do have a couple questions on my MM replication of cn=config if you want to take them. First, does it make sense or is it possible to do delta replication on cn=config? The data "on the wire" seems like it would be much smaller and less frequent than directory data so perhaps it's not as beneficial? Secondly, I am using a simple bind with this replication agreement (versus sasl/gssapi and tls for my directory data). When configuring limits and acl's for replication of my dit, I created a groupofnames (cn=replicators, ou=groups, dc=example,dc=net) that has each ldap server as a member. My thought process was that this made the solution a bit more scalable. As ldap servers were added to the topology, they could be added to the group of names and automatically be given the correct permissions an limits. Likewise, as server are decommissioned, they could easily be removed by deleting them from the group and directory. Can I use this same group of names in cn=config replication by creating a similar limit and acl using this group of names? Since I am handling the formatting of the gssapi uid in cn=config (maybe a mistake if I ever wanted to be able to handle multiple directories/domains), can I use the gssapi authentication of hosts in dc=example,dc=net? Seems I should be able to since it appears that when the authorization occurs in the database, the bind id is assumed to be already authenticated and accepted as presented with no further authentication taking place. I'm thinking that so long as that uid is formatted into a db listed in an acl, the matching access is applied? Am I way off base in my thinking? Now that I have a rough workable solution I'm just trying to pretty it up a bit and make the design more efficient and scalable. Thanks Barry

1 0

(ITS#7489) Update slapd.overlays.5 manpage index
by ebackes＠symas.com 10 Jan '13

10 Jan '13

Full_Name: Emily Backes Version: HEAD, RE24 OS: URL: Submission from: (NULL) (98.155.30.248) The slapd.overlays (5) manpage index of overlays is out of date and doesn't list all included documentation. This patch fixes it, and should be applicable against both master and RE24 branches. http://www.symas.com/lucca/Update-slapd.overlays.5-manpage-index.patch.txt This patch is summary of existing OpenLDAP materials and already included under the copyright and licensing terms of the OpenLDAP project.

1 0

ITS#7434
by blance3459＠hotmail.com 10 Jan '13

10 Jan '13

--_2dfc1396-6cab-4ee1-b5cd-ec8dfb5286a7_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Quanah=2C Trying to post a reply using my hotmail account. Sorry for the = unreadable output previously posted. I'm almost embarassed to say I've bee= n involved in IT for over 15 years and never used a mailing list before. An= yhow=2C I did download the source packages and compiled them. However=2C t= he semester was winding down and I was under a lot of pressure to have some= thing completed before the end of finals week so my professor could assgn m= e a grade for the work I had done. I revered back to my previous version t= o to get some stuff written. Not to mention=2C my algorithms professor was= kicking my butt too. Wil I ever "really" need an FFT in the real world? l= ol The more I looked at what I was trying to accomplish=2C I realized I was= attaking the problem all wrong. What I was being asked to do was somethin= g more like configuring my two slapd servers to act more like Active Direct= ory global catalog servers. GC's utilitze MM instead of single master repl= ication so I scrapped the SM replication design in favor of MM. Once this = was done=2C I no longer needed the chaining overlay or proxy auth. I now h= ave MM replication of both cn=3Dconfig and my directory data (with delta) w= orking and my Kerberos KDC's are happy. One thing I did find was that confi= guring MM replication made me learn a little more about how to "properly" n= ame/configure an overlay with the syncprov and accesslog modules by digging= into the test scripts. I had some issues with sync state on the consumer= s =2C but I found a post you made to someone else a few years back that sol= ved my delta replication issue by configuring an syncprov overlay on the ac= cesslog db. Not sure I remember seeing that in the Admin Guide. Looking ba= ck at the orignal post I noticed the chain overlay I had configured was dn:= olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2C= cn=3Dconfig. knowing what I know now=2C I'm not 100% sure that was correc= t. Shouldn't that overlay have been in either config database of my direct= ory or ldap backend database for the chain rather than a "frontend"? Just= a thought I've been kicking around in my head. Either way=2C I have my lda= p config working. We can either close this issue if you'd like or leave it= open and I'll attempt to confirm my theory on the overlay not being proper= ly located when I get a chance. Completely your choice. But I do have a couple questions on my MM replication of cn=3Dconfig if you= want to take them. First=2C does it make sense or is it possible to do de= lta replication on cn=3Dconfig? The data "on the wire" seems like it would= be much smaller and less frequent than directory data so perhaps it's not = as beneficial? Secondly=2C I am using a simple bind with this replication= agreement (versus sasl/gssapi and tls for my directoiry data). When confi= guring limits and acl's for replication of my dit=2C I created a groupofnam= es (cn=3Dreplicators=2C ou=3Dgroups=2C dc=3Dexample=2Cdc=3Dnet) that has ea= ch ldap server as a member. My thought process was that this made the solu= tion a bit more scalable. As ldap servers were added to the topology=2C th= ey could be added to the group of names and automtically be given the corre= ct permissions an limits. Likewise=2C as server are decomisioned=2C they c= ould easily be removed by deleteing them from the group and directory. Ca= n I use this same group of names in cn=3Dconfig replication by creating a s= imilar limit and acl using this group of names? Since I am handling the fo= rmatting of the gssapi uid in cn=3Dconfig (maybe a mistake if I ever wanted= to be able to handle multiple directories/domains)=2C can I use the gssapi= authtication of hosts in dc=3Dexample=2Cdc=3Dnet? Seems I sould be able t= o since it appears that when the authorization occurs in the database=2C th= e bind id is assumed to be already authenticated and accepted as presented = with no further authentication taking place. I'm thinking that so long as = that uid is formatted into a dn listed in an acl=2C the matching access is = applied? Am I way off base in my thinking? Now that I have a rough workab= le solution I'm just trying to pretty it up a bit and make the design more = efficient and scalable. Thanks Barry = --_2dfc1396-6cab-4ee1-b5cd-ec8dfb5286a7_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <style></style></head> <body class=3D'hmmessage'><div dir=3D'ltr'>Quanah=2C <BR>&nbsp=3B<BR>Trying= to post a reply using my hotmail account.&nbsp=3B Sorry for the unreadable= output previously posted.&nbsp=3B I'm almost embarassed to say I've been i= nvolved in IT for over 15 years and never used a mailing list before.<BR>&n= bsp=3B<BR>Anyhow=2C I did download the source packages and compiled them.&n= bsp=3B However=2C the semester was winding down and I was under a lot of pr= essure to have something completed before the end of finals week so my prof= essor could assgn me a grade for the work I had done.&nbsp=3B I revered bac= k to my previous version to to get some stuff written.&nbsp=3B Not to menti= on=2C my algorithms professor was kicking my butt too. Wil I ever "really" = need an FFT in the real world?&nbsp=3B lol<BR>&nbsp=3B<BR>The more I looked= at what I was trying to accomplish=2C I realized I was attaking the proble= m all wrong.&nbsp=3B What I was being asked to do was something more like c= onfiguring my two slapd servers to act more like Active Directory global ca= talog servers. GC's utilitze MM instead of&nbsp=3B single master replicatio= n so I scrapped the SM replication design in favor of MM.&nbsp=3B Once this= was done=2C I no longer needed the chaining overlay or proxy auth.&nbsp=3B= I now have MM replication of both cn=3Dconfig and my directory data (with = delta) working and my Kerberos KDC's are happy.<BR>&nbsp=3B<BR>One thing I = did find was that configuring MM replication made me learn a little more ab= out how to "properly" name/configure an overlay with the syncprov and acces= slog modules by digging into the test scripts.&nbsp=3B&nbsp=3B&nbsp=3BI had= some issues with sync state on the consumers&nbsp=3B=2C but I found a post= you made to someone else a few years back that solved my delta replication= issue by configuring an syncprov overlay on the accesslog db.&nbsp=3B Not = sure I remember seeing that in the Admin Guide.<BR>&nbsp=3B<BR>Looking back= at the orignal post I noticed the chain overlay I had configured was dn: o= lcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2C c= n=3Dconfig.&nbsp=3B knowing what I know now=2C I'm not 100% sure that was c= orrect.&nbsp=3B Shouldn't that overlay have been in&nbsp=3Beither config da= tabase&nbsp=3Bof my directory&nbsp=3B or ldap backend database for the chai= n rather than a "frontend"?&nbsp=3B Just a thought I've been kicking around= in my head.<BR>&nbsp=3B<BR>Either way=2C I have my ldap config working.&nb= sp=3B We can either close this issue if you'd like or leave it open and I'l= l attempt to confirm my theory on the overlay not being properly located wh= en I get a chance.&nbsp=3B&nbsp=3B&nbsp=3BCompletely your choice.<br><BR>Bu= t I do have a couple questions on my MM replication of cn=3Dconfig if you w= ant to take them.&nbsp=3B First=2C does it make sense or is it possible to = do delta replication on cn=3Dconfig?&nbsp=3B The data "on the wire" seems l= ike it would be much smaller and less frequent than directory data so perha= ps it's&nbsp=3Bnot as beneficial?&nbsp=3B&nbsp=3B Secondly=2C I am using a = simple bind with this replication agreement (versus sasl/gssapi and tls for= my directoiry data).&nbsp=3B When configuring limits and acl's for replica= tion of my dit=2C I created a groupofnames (cn=3Dreplicators=2C ou=3Dgroups= =2C dc=3Dexample=2Cdc=3Dnet) that has each ldap server as a member.&nbsp=3B= My thought process was that this made the solution a bit more scalable.&nb= sp=3B As ldap servers were added to the topology=2C they could be added to = the group of names and automtically be given the correct permissions an lim= its.&nbsp=3B Likewise=2C as server are decomisioned=2C they could easily be= removed&nbsp=3Bby deleteing them from the group and directory.&nbsp=3B&nbs= p=3B Can I use this same group of names in cn=3Dconfig replication by creat= ing a similar limit and acl using this group of names?&nbsp=3B Since I am h= andling the formatting of the gssapi uid in cn=3Dconfig (maybe&nbsp=3Ba mis= take if I ever wanted to be able to handle multiple directories/domains)=2C= can I use the gssapi authtication of hosts in dc=3Dexample=2Cdc=3Dnet?&nbs= p=3B Seems I sould be able to since it appears that when the authorization = occurs in the database=2C the bind id is assumed to be already authenticate= d and accepted as presented with no further authentication taking place.&nb= sp=3B I'm thinking that so long as that uid is formatted into a dn listed i= n an acl=2C the matching access is applied?&nbsp=3B Am I way off base in my= thinking?&nbsp=3B Now that I have a rough workable solution I'm just tryin= g to pretty it up a bit and make the design more efficient and scalable.<BR= >&nbsp=3B<BR>Thanks<BR>&nbsp=3B<BR>Barry<BR>&nbsp=3B<BR> </div><= /body> </html>= --_2dfc1396-6cab-4ee1-b5cd-ec8dfb5286a7_--

1 0

Re: (ITS#7406) Search with scope for newer entries don't work
by quanah＠zimbra.com 09 Jan '13

09 Jan '13

--On Monday, October 01, 2012 10:20 AM +0200 Andrea Stefanello <a.stefanello(a)mclink.eu> wrote: > Thanks, > > my 2 mirror (Master-Master) server say : > > ebuild U ] net-nds/openldap-2.4.30::gentoo [2.4.23-r1::MC-link-NOC] > > upgrading to 2.4.30 doesn't cause problems , its correct ? > > Can i upgrade quietly or i have to do some pre-operations ? You should be able to upgrade in place w/o issue. I would suggest OpenLDAP 2.4.33 instead of 2.4.30 though. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: (ITS#7434) idassert-bind fails after restarting slapd
by quanah＠zimbra.com 09 Jan '13

09 Jan '13

--On Tuesday, December 04, 2012 4:37 PM +0000 blance3459(a)hotmail.com wrote: > --_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_ > Content-Type: text/plain; charset="iso-8859-1" > Content-Transfer-Encoding: quoted-printable > > Quanah=2C=20 > =20 > I finally got back around to working on this over the last couple of > days. = Where I'm at with my project is: I have two servers (virtual > machines)=2C = named master and replica=2C with slapd configured with my > directory inform= ation and single-master replication between them. =20 > I created a Kerberos realm and various principals in open ldap. =20 > Replication access is authenticated using sasl/gssapi with the slapd > princ= ipal=2C ldap/replica.example.net. =20 > k5start has been added to system startup to buid the credential cache > for = slapd. Hi Barry, Two things: Please use an email client that can create emails that are readable, instead of whatever it is you're doing now. ;) Second, you never answered about trying a current release of OpenLDAP. I pointed out two bits that may have resulted in your situation being fixed. Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7476) patch for ldap_pvt_connect
by hyc＠symas.com 09 Jan '13

09 Jan '13

codehero(a)gmail.com wrote: > Full_Name: David Bender > Version: 2.4.32 > OS: Linux > URL: > Submission from: (NULL) (96.236.148.85) > > > ldap_pvt_connect() in libldap/os-ip.c fails intermittently when the calling > program also runs child processes. The connect() call fails with EINTR, but no > effort is made to retry the connect(). The following patches add support for > retrying in this case, as well as toggling the behaviour with LDAP_OPT_RESTART. > > > Patches are available and should be applied in this order (applied to current > HEAD): > > https://github.com/benegon/openldap/commit/8e4fee39bfccaa3dd15179fb6451d397… > https://github.com/benegon/openldap/commit/991941e3b51fea44d5f123f24a0f3206… Thanks for the patches, now in master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7488) back-mdb: corrupt indices with bad toolthreads setting
by quanah＠OpenLDAP.org 08 Jan '13

08 Jan '13

Full_Name: Quanah Gibson-Mount Version: RE24 12/11/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) When running slapadd in quick mode, with a toolthreads setting higher than 2, index generation is broken, breaking the ability to search the resulting database with indexed attributes.

1 0

Re: (ITS#7486) slapo-dynlist.5 enhancement request
by masarati＠aero.polimi.it 08 Jan '13

08 Jan '13

Clarifications added to HEAD, please check. Thanks, p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7487) memberof & mirrormode with delta-syncrepl crashing when using dynamic configuration
by afrunning＠gmail.com 08 Jan '13

08 Jan '13

> Indeed, sm_op == SLAP_MOD_SOFTDEL, as I inferred from syncrepl code, > thanks for the feedback. Internal special modification types should be > handled now in HEAD code. Could you pull it from git and test, please? > Instructions here <http://www.openldap.org/software/repo.html>. Looks good! I can add and remove users to groups in my setup without issue. Thanks for your quick response. Al

1 0

Re: (ITS#7487) memberof & mirrormode with delta-syncrepl crashing when using dynamic configuration
by masarati＠aero.polimi.it 08 Jan '13

08 Jan '13

>> > slapd: memberof.c:1465: memberof_res_modify: Assertion `0' failed. >> >> If you have the core file handy, or if you can quickly reproduce the >> problem, could you print the value of ml->sml_mod, i.e. from within gdb: >> >> (to see the backtrace) >> $ bt >> (where <x> is the number of the frame of function memberof_res_modify) >> $ f <x> >> (to see the value) >> $ print ml->sml_mod > > (gdb) bt > #0 0x00000032b04328a5 in raise () from /lib64/libc.so.6 > #1 0x00000032b0434085 in abort () from /lib64/libc.so.6 > #2 0x00000032b042ba1e in __assert_fail_base () from /lib64/libc.so.6 > #3 0x00000032b042bae0 in __assert_fail () from /lib64/libc.so.6 > #4 0x00000000004fc989 in memberof_res_modify (op=0x7fffebffe330, > rs=<value optimized out>) at memberof.c:1465 > #5 0x000000000042f91e in slap_response_play (op=0x7fffebffe330, > rs=0x7fffebffd620) at result.c:507 > #6 0x00000000004304a9 in send_ldap_response (op=0x7fffebffe330, > rs=0x7fffebffd620) at result.c:582 > #7 0x000000000043119c in slap_send_ldap_result (op=0x7fffebffe330, > rs=0x7fffebffd620) at result.c:860 > #8 0x00000000004b4035 in mdb_modify (op=0x7fffebffe330, > rs=0x7fffebffd620) at modify.c:656 > #9 0x00000000004845a7 in overlay_op_walk (op=0x7fffebffe330, > rs=0x7fffebffd620, which=op_modify, oi=0x963b20, on=0x0) at > backover.c:671 > #10 0x0000000000484f87 in over_op_func (op=0x7fffebffe330, rs=<value > optimized out>, which=<value optimized out>) at backover.c:723 > #11 0x000000000047738d in syncrepl_message_to_op (si=0x9636f0, > op=0x7fffebffe330, msg=<value optimized out>) at syncrepl.c:2318 > #12 0x000000000047b1bf in do_syncrep2 (op=0x7fffebffe330, si=0x9636f0) > at syncrepl.c:986 > #13 0x00000000004809c2 in do_syncrepl (ctx=<value optimized out>, > arg=0x963ee0) at syncrepl.c:1523 > #14 0x00000000004210e1 in connection_read_thread (ctx=0x7fffebffeab0, > argv=<value optimized out>) at connection.c:1288 > #15 0x00000000005230a0 in ldap_int_thread_pool_wrapper > (xpool=0x8b7640) at tpool.c:688 > #16 0x00000032b0807851 in start_thread () from /lib64/libpthread.so.0 > #17 0x00000032b04e811d in clone () from /lib64/libc.so.6 > (gdb) f 4 > #4 0x00000000004fc989 in memberof_res_modify (op=0x7fffebffe330, > rs=<value optimized out>) at memberof.c:1465 > 1465 assert( 0 ); > (gdb) print ml->sml_mod > $1 = {sm_desc = 0x9640f0, sm_values = 0x7fffe00009b0, sm_nvalues = > 0x7fffe00009d0, sm_numvals = 1, sm_op = 4097, sm_flags = 0, sm_type = > {bv_len = 48, > bv_val = 0x70756f72673d6e63 <Address 0x70756f72673d6e63 out of > bounds>}} > (gdb) Indeed, sm_op == SLAP_MOD_SOFTDEL, as I inferred from syncrepl code, thanks for the feedback. Internal special modification types should be handled now in HEAD code. Could you pull it from git and test, please? Instructions here <http://www.openldap.org/software/repo.html>. Thanks, p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7487) memberof & mirrormode with delta-syncrepl crashing when using dynamic configuration
by afrunning＠gmail.com 08 Jan '13

08 Jan '13

> > slapd: memberof.c:1465: memberof_res_modify: Assertion `0' failed. > > If you have the core file handy, or if you can quickly reproduce the > problem, could you print the value of ml->sml_mod, i.e. from within gdb: > > (to see the backtrace) > $ bt > (where <x> is the number of the frame of function memberof_res_modify) > $ f <x> > (to see the value) > $ print ml->sml_mod (gdb) bt #0 0x00000032b04328a5 in raise () from /lib64/libc.so.6 #1 0x00000032b0434085 in abort () from /lib64/libc.so.6 #2 0x00000032b042ba1e in __assert_fail_base () from /lib64/libc.so.6 #3 0x00000032b042bae0 in __assert_fail () from /lib64/libc.so.6 #4 0x00000000004fc989 in memberof_res_modify (op=0x7fffebffe330, rs=<value optimized out>) at memberof.c:1465 #5 0x000000000042f91e in slap_response_play (op=0x7fffebffe330, rs=0x7fffebffd620) at result.c:507 #6 0x00000000004304a9 in send_ldap_response (op=0x7fffebffe330, rs=0x7fffebffd620) at result.c:582 #7 0x000000000043119c in slap_send_ldap_result (op=0x7fffebffe330, rs=0x7fffebffd620) at result.c:860 #8 0x00000000004b4035 in mdb_modify (op=0x7fffebffe330, rs=0x7fffebffd620) at modify.c:656 #9 0x00000000004845a7 in overlay_op_walk (op=0x7fffebffe330, rs=0x7fffebffd620, which=op_modify, oi=0x963b20, on=0x0) at backover.c:671 #10 0x0000000000484f87 in over_op_func (op=0x7fffebffe330, rs=<value optimized out>, which=<value optimized out>) at backover.c:723 #11 0x000000000047738d in syncrepl_message_to_op (si=0x9636f0, op=0x7fffebffe330, msg=<value optimized out>) at syncrepl.c:2318 #12 0x000000000047b1bf in do_syncrep2 (op=0x7fffebffe330, si=0x9636f0) at syncrepl.c:986 #13 0x00000000004809c2 in do_syncrepl (ctx=<value optimized out>, arg=0x963ee0) at syncrepl.c:1523 #14 0x00000000004210e1 in connection_read_thread (ctx=0x7fffebffeab0, argv=<value optimized out>) at connection.c:1288 #15 0x00000000005230a0 in ldap_int_thread_pool_wrapper (xpool=0x8b7640) at tpool.c:688 #16 0x00000032b0807851 in start_thread () from /lib64/libpthread.so.0 #17 0x00000032b04e811d in clone () from /lib64/libc.so.6 (gdb) f 4 #4 0x00000000004fc989 in memberof_res_modify (op=0x7fffebffe330, rs=<value optimized out>) at memberof.c:1465 1465 assert( 0 ); (gdb) print ml->sml_mod $1 = {sm_desc = 0x9640f0, sm_values = 0x7fffe00009b0, sm_nvalues = 0x7fffe00009d0, sm_numvals = 1, sm_op = 4097, sm_flags = 0, sm_type = {bv_len = 48, bv_val = 0x70756f72673d6e63 <Address 0x70756f72673d6e63 out of bounds>}} (gdb) Regards, Al

1 0

Re: (ITS#7487) memberof & mirrormode with delta-syncrepl crashing when using dynamic configuration
by masarati＠aero.polimi.it 08 Jan '13

08 Jan '13

> Full_Name: Al F > Version: 2.4.33 > OS: Redhat 6.3 x64 > URL: ftp://ftp.openldap.org/incoming/openldap-af.zip > Submission from: (NULL) (74.123.146.10) > > > I'm having an issue with mirrormode replication (via delta syncrepl) and > the > memberof overlay when using dynamic configuration. When a group member is > deleted on the first instance, slapd on the second instance is crashing > with the > following error (as seen from running slapd with -d-1): > > slapd: memberof.c:1465: memberof_res_modify: Assertion `0' failed. If you have the core file handy, or if you can quickly reproduce the problem, could you print the value of ml->sml_mod, i.e. from within gdb: (to see the backtrace) $ bt (where <x> is the number of the frame of function memberof_res_modify) $ f <x> (to see the value) $ print ml->sml_mod Thanks, p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7487) memberof & mirrormode with delta-syncrepl crashing when using dynamic configuration
by afrunning＠gmail.com 08 Jan '13

08 Jan '13

Full_Name: Al F Version: 2.4.33 OS: Redhat 6.3 x64 URL: ftp://ftp.openldap.org/incoming/openldap-af.zip Submission from: (NULL) (74.123.146.10) I'm having an issue with mirrormode replication (via delta syncrepl) and the memberof overlay when using dynamic configuration. When a group member is deleted on the first instance, slapd on the second instance is crashing with the following error (as seen from running slapd with -d-1): slapd: memberof.c:1465: memberof_res_modify: Assertion `0' failed. If I disable either memberof or mirrormode, the change replicates correctly. If I use an identical static configuration file instead of a dynamic configuration, the change replicates correctly. This behavior happens on both bdb and mdb backends. I have setup a very basic test and have included the configurations for server1 and server2 in both static and dynamic configuration (both running on the same machine, just different ports), ldif file to populate tree (ldifs/basic.ldif), as well as the ldif file to crash the second node (ldifs/crash.ldif). the zip file contents (ftp://ftp.openldap.org/incoming/openldap-af.zip) are: openldap-af/ openldap-af/bt full.txt (output from gdb bt full) openldap-af/config.txt (output from source compilation) openldap-af/debug level logging.txt (output of the crash while running debug logs) openldap-af/ldifs/basic.ldif (the basic tree) openldap-af/ldifs/crash.ldif (ldif file applied to cause the failure) openldap-af/server1slapd.conf (server1's static configuration) openldap-af/server1slapd.d/* (server1's dynamic configuration - produced directly from static configuration with slaptest) openldap-af/server2slapd.conf (server2's static configuration) openldap-af/server2slapd.d/* (server2's dynamic configuration - produced directly from static configuration with slaptest) openldap-af/thread apply all bt.txt (output from gdb thread apply all bt) version & config information: OL_PACKAGE="OpenLDAP" OL_MAJOR=2 OL_MINOR=4 OL_PATCH=33 OL_API_INC=20433 OL_API_LIB_RELEASE=2.4 OL_API_LIB_VERSION=10:5:8 OL_VERSION=2.4.33 OL_TYPE=Release OL_STRING="OpenLDAP 2.4.33-Release" OL_RELEASE_DATE="2012/10/10" Red Hat Enterprise Linux Server release 6.3 (Santiago) kernel 2.6.32-279.19.1.el6.x86_64 running on a vmware esx host, with a single AMD Opteron(tm) Processor 6134. 4Gig RAM. please let me know if you need any more information. This is my first time using gdb, so I appologize if I missed something critical.

1 0

(ITS#7486) slapo-dynlist.5 enhancement request
by tedcheng＠symas.com 07 Jan '13

07 Jan '13

Full_Name: Ted C. Cheng Version: trunk OS: Linux/Solaris URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.174.253.197) This is an enhancement request to the slapo-dynlist.5 man page to call out the fact that searches with filters based on dynamic lists/groups attributes will not produce the desired results: Dynamic lists/groups, as their names suggest, are constructed dynamically when the entries are to be returned. Their attributes and values are not available at the time when searches based on filters are performed. As a result, searches with dynamic lists/groups attributes in filters will not produce the desired results.

1 0

(ITS#7485) libmdb key/data limits not checked/documented.
by h.b.furuseth＠usit.uio.no 06 Jan '13

06 Jan '13

Full_Name: Hallvard B Furuseth Version: mdb.master 057e0686303444d56f29a7bee0536e261fdf0b6a OS: Linux x86_64 URL: Submission from: (NULL) (193.69.163.163) Submitted by: hallvard mdb_put() not check for too big data. mdb_cursor_put() does not check for too big key either. Nor can I see that ldmb.h documents the limits, and there is no way to ask liblmdb what the limits are. This can write an item of size (5000000000 & 0xffffffff) or crash: MDB_val k1 = {3, "foo"}, x = {5000000000, NULL}; mdb_dbi_open(txn, NULL, MDB_CREATE, &dbi); mdb_put(txn, dbi, &k1, &x, MDB_RESERVE); Crash: MDB_val k1 = {3, "foo"}, y = {5, "xyzzy"}, z = {10000, calloc(1,10000)}; mdb_dbi_open(txn, NULL, MDB_CREATE|MDB_DUPSORT, &dbi); mdb_put(txn, dbi, &k1, &y, 0); mdb_put(txn, dbi, &k1, &z, 0); /* segfault */ Crash: MDB_val k2 = {8000, calloc(1, 8000)}, y = {5, "xyzzy"}; mdb_cursor_put(mc, &k2, &y, 0); while this gives a proper EINVAL: mdb_put(txn, dbi, &k2, &y, 0);

1 0

Re: (ITS#7462) olcPcache cannot be modified
by masarati＠aero.polimi.it 06 Jan '13

06 Jan '13

> Full_Name: Tio Teath > Version: 2.4.33 > OS: Debian GNU Linux Wheezy > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (178.172.239.4) > > > I'm getting 'LDAP: error code 80 - cannot delete olcPcache' while I'm > trying to > perform olcPcache modification: > dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config > changetype: modify > replace: olcPcache > olcPcache: hdb 10000 4 500 100 > - > > I have to perform this action in case, I need to extend the number of > pcacheAttrset directives. Although the impossibility to modify olcPcache may be viewed as a bug, I have the impression that a broad class of modifications e.g. to olcPcacheTemplate are likely to invalidate an existing cache. The fix should also consider the opportunity of thrashing the whole cache, unless a clever means to only address entries associated with the olcPcacheTemplate involved in the modification is found. My 2c. p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7484) sssvlv-maxpercon(n) configuration option
by masarati＠aero.polimi.it 06 Jan '13

06 Jan '13

> Full_Name: Liam Gretton > Version: 2.4.33 > OS: SLES 11 SP 2 > URL: > Submission from: (NULL) (143.210.13.77) > > > There's a mismatch between the documentation for the sssvlv-maxpercon > option and > the actual configuration option name. > > The man page documentation for slapo-sssvlv states that the maximum number > of > concurrent paged search requests per connection option is > 'sssvlv-maxperconn'. > For an LDAP-based configuration the option is 'olcSssVlvMaxPerConn' but > for a > slapd.conf based configuration the option is 'sssvlv-maxpercon' (note only > one > 'n', not two). Good catch; should be fixed now in HEAD, please test. Thanks, p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs