- openldap-bugs - openldap.org

(ITS#7426) contraints blocks syncreplication
by sascha.kuehndel＠deka.de 01 Nov '12

01 Nov '12

Full_Name: Sascha Kuehndel Version: 2.4.33 + ITS#7418 OS: HP-UX 11.31 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (192.166.104.102) Hallo, the constraints seams to block the sync-replication. constraint_attribute dekanetZielgruppenDN uri ldap:///ou=Zielgruppen,ou=dekanet,dc=dekager,dc=dekabank,dc=extern?entryDN?one?(objectClass=dekanetZielgruppe) restrict=ldap:///ou=Benutzer,ou=dekanet,dc=dekager,dc=dekabank,dc=extern??one the replication syncs the users in ou=Benutzer first, and later the groups of ou=Zielgruppen. The be_add of the user failed in the consumer, until commenting out the constraint. here the relevant part of the log file 50c84eff syncrepl_message_to_entry: rid=002 DN: uid=XXX,ou=Benutzer,ou=dekanet,dc=dekager,dc=dekabank,dc=extern, UUID: XXX-UUID 50c84eff syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) 50c84eff syncrepl_entry: rid=002 inserted UUID XXX-UUID 50c84eff syncrepl_entry: rid=002 be_search (0) 50c84eff syncrepl_entry: rid=002 uid=XXX,ou=Benutzer,ou=dekanet,dc=dekager,dc=dekabank,dc=extern 50c84f00 slap_queue_csn: queing 6000000000a1d9c0 20120926141541.717811Z#000000#002#000000 50c84f00 slap_graduate_commit_csn: removing 6000000012baa390 20120926141541.717811Z#000000#002#000000 50c84f00 null_callback : error code 0x13 50c84f00 syncrepl_entry: rid=002 be_add uid=XXX,ou=Benutzer,ou=dekanet,dc=dekager,dc=dekabank,dc=extern (19) 50c84f00 syncrepl_entry: rid=002 be_add uid=XXX,ou=Benutzer,ou=dekanet,dc=dekager,dc=dekabank,dc=extern failed (19) 50c84f00 do_syncrepl: rid=002 rc 19 retrying Greets, Sascha

1 0

Re: (ITS#7389) [PATCH] MozNSS: load certificates from certdb, fallback to PEM
by jvcelak＠redhat.com 31 Oct '12

31 Oct '12

I'm sorry, there is an updated version of the patch: ftp://ftp.openldap.org/incoming/jvcelak-20121031-update-moznss-load-certs-f… The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7367) [PATCH] MozNSS: update list of supported cipher suites
by hyc＠symas.com 30 Oct '12

30 Oct '12

Rich Megginson wrote: > On 10/03/2012 10:18 AM, Howard Chu wrote: >> Thanks for your comments, Rich. >>> Maybe we could use nss_compat_ossl to do the mapping of cipher names >>> from openssl to moznss? >> >> That makes sense to me, although if as you say it hasn't been actively >> maintained, that sounds like another problem. But certainly if other >> apps are using it, then aren't they going to want new cipher suite >> support too? >> > Yes, and imho nss_compat_ossl is the place to do this. > > But, would it be possible to update the cipher suite list in tls_m.c > first, to bring it up to date, then work on updating the compat library? I discussed this with Kurt; the Project's policy on issues like this in the past has been not to commit any backward-compatibility fixes of this sort until the real fix has already been released. I.e., we should wait until nss_compat_ossl has been updated. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7423) [PATCH] Update slapo-constraint tests
by michael＠stroeder.com 29 Oct '12

29 Oct '12

This is a cryptographically signed message in MIME format. --------------ms040205010803070807010603 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable jsynacek(a)redhat.com wrote: > On 10/27/2012 12:53 PM, Michael Str=F6der wrote: >> jsynacek(a)redhat.com wrote: >>> This patch updates the slapo-constraint testsuit. It adds additional = tests for >>> any constraints using 'uri'. Furthermore, it improves testing of the = 'restrict' >>> parameter. >> >> In my RE24 working tree: >> >> git apply --stat jsynacek-20121025-constraint-tests-update.patch >> >> Then I expected >> ./run -b hdb test064 to fail (without the patch in ITS#7418) but it re= turned >> "Test succeeded". > I'm sorry, one hunk didn't apply correctly. >=20 > New URL: > ftp://ftp.openldap.org/incoming/jsynacek-20121029-constraint-tests-upda= te.patch >=20 > All the tests should fail without the patch in ITS#7418. I can confirm that it now works as expected. Thank you. Ciao, Michael. --------------ms040205010803070807010603 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDI5MTg1NzA4WjAjBgkq hkiG9w0BCQQxFgQUz+3vB7XiNjVbIeSJjJ5+VggGD/4wbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAkvHorLvWhpJwgew8K8iwnc2cMUtOtcK4ZYYZCPThJIZSkfvVFhamuAO86D96VPsdU+rA +S6eohY9eGJwYHJJ+TqqVQXC7vl2odxBCLePbAkKVRaqTrgC3Mhl400pCWSVKVQjowGoVhfr xTSb1KGR09j4HnCGZhSSyTxHXTkQzrAIfY0ug8MFzliznTvI3WL+u1liy72a3sGn6HpZVCwe OgbIsv5Qz9PdtPuLRUNDmXLMP3dRZf0zoMpTtWZjEqgNifBUY9+mDlKUPaf1JHulz9FMdBU/ Qs7uTpByT7X52C4Oe5X9KlwmcdaLBYg3Z2NytP7m6pBPGQXT/iHIuRTYfwAAAAAAAA== --------------ms040205010803070807010603--

1 0

Re: (ITS#7423) [PATCH] Update slapo-constraint tests
by Sascha.Kuehndel＠deka.de 29 Oct '12

29 Oct '12

--_000_F12A906A1F17554CB9CDFC8F4779F3C469A05BD7F1EXCCREX9dekag_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello Jan, i tested the test-cases: without patch in 7418, all test cases of test064-constraint failed. with patch in 7418, test064-constraint was successful. Bye, Sascha --_000_F12A906A1F17554CB9CDFC8F4779F3C469A05BD7F1EXCCREX9dekag_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"><head><meta http-equiv=3DContent-Type content= =3D"text/html; charset=3Diso-8859-1"><meta name=3DGenerator content=3D"Micr= osoft Word 14 (filtered medium)"><style></style></head><body lang=3DDE link=3Dblue vlink= =3Dpurple><div class=3DWordSection1>Hello Jan,<o:p></o:p><o:p> </o:p></span= >i t= ested the test-cases:<o:p></o:p><o:p> </o:p>without patch in 74= 18, all test cases of test064-constraint failed.<o:p></o:p>with patch in= 7418, test064-constraint was successful.<o:p></o:p><o:p> </o:p></s= pan>= Bye,<o:p></o:p>Sascha<o:p></o:p></div></body></html>= --_000_F12A906A1F17554CB9CDFC8F4779F3C469A05BD7F1EXCCREX9dekag_--

1 0

Re: (ITS#7423) [PATCH] Update slapo-constraint tests
by jsynacek＠redhat.com 29 Oct '12

29 Oct '12

On 10/27/2012 12:53 PM, Michael Ströder wrote: > jsynacek(a)redhat.com wrote: >> This patch updates the slapo-constraint testsuit. It adds additional tests for >> any constraints using 'uri'. Furthermore, it improves testing of the 'restrict' >> parameter. > > In my RE24 working tree: > > git apply --stat jsynacek-20121025-constraint-tests-update.patch > > Then I expected > ./run -b hdb test064 to fail (without the patch in ITS#7418) but it returned > "Test succeeded". > > Ciao, Michael. > I'm sorry, one hunk didn't apply correctly. New URL: ftp://ftp.openldap.org/incoming/jsynacek-20121029-constraint-tests-update.p… All the tests should fail without the patch in ITS#7418. Cheers, -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat

1 0

(ITS#7425) documentation for slapo-pcache when using slapd-config
by btb＠bitrate.net 28 Oct '12

28 Oct '12

Full_Name: ben blewett Version: 2.4.31 OS: ubuntu 12.10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (216.176.19.106) documentation in the admin guide and the man pages for setup of slapo-pcache when using slapd-config [cn=config] seems to be a bit sparse. just wanted to put this on the list if it's not already.

1 0

Re: (ITS#7424) Accept patch? Add option for not folding ldapsearch LDIF output lines
by masarati＠aero.polimi.it 28 Oct '12

28 Oct '12

Upgrade? This ITS will be closed. > No such option in OpenLDAP 2.4.23 as delivered with RHEL 6. > > man ldapsearch shows the only general option documented > is nettimeout > > ?? > > On 10/28/2012 3:45 PM, Pierangelo Masarati wrote: >> Use ldapsearch -o ldif-wrap=no instead. >> >> p. >> >>> Full_Name: >>> Version: >>> OS: >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (96.228.233.77) >>> >>> >>> RFC 2849 states: >>> >>> 2) Any non-empty line, including comment lines, in an LDIF file >>> MAY be folded by inserting a line separator (SEP) and a >>> SPACE. >>> Folding MUST NOT occur before the first character of the >>> line. >>> In other words, folding a line into two lines, the first of >>> which is empty, is not permitted. Any line that begins with >>> a >>> single space MUST be treated as a continuation of the >>> previous >>> (non-empty) line. When joining folded lines, exactly one >>> space >>> character at the beginning of each continued line must be >>> discarded. Implementations SHOULD NOT fold lines in the >>> middle >>> of a multi-byte UTF-8 character. >>> >>> OpenLDAP (ldapsearch at least) has taken implemented that folding >>> behavior for LDIF output. >>> >>> This causes trouble for anyone trying to use 'ldapsearch | grep >>> <something>' >>> for one simple example. >>> >>> Would you accept a patch to allow an option which disables line >>> folding? >>> >>> >>> >>> >> >> > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7424) Accept patch? Add option for not folding ldapsearch LDIF output lines
by jblaine＠kickflop.net 28 Oct '12

28 Oct '12

No such option in OpenLDAP 2.4.23 as delivered with RHEL 6. man ldapsearch shows the only general option documented is nettimeout ?? On 10/28/2012 3:45 PM, Pierangelo Masarati wrote: > Use ldapsearch -o ldif-wrap=no instead. > > p. > >> Full_Name: >> Version: >> OS: >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (96.228.233.77) >> >> >> RFC 2849 states: >> >> 2) Any non-empty line, including comment lines, in an LDIF file >> MAY be folded by inserting a line separator (SEP) and a SPACE. >> Folding MUST NOT occur before the first character of the line. >> In other words, folding a line into two lines, the first of >> which is empty, is not permitted. Any line that begins with a >> single space MUST be treated as a continuation of the previous >> (non-empty) line. When joining folded lines, exactly one space >> character at the beginning of each continued line must be >> discarded. Implementations SHOULD NOT fold lines in the middle >> of a multi-byte UTF-8 character. >> >> OpenLDAP (ldapsearch at least) has taken implemented that folding >> behavior for LDIF output. >> >> This causes trouble for anyone trying to use 'ldapsearch | grep >> <something>' >> for one simple example. >> >> Would you accept a patch to allow an option which disables line folding? >> >> >> >> > >

1 0

Re: (ITS#7424) Accept patch? Add option for not folding ldapsearch LDIF output lines
by masarati＠aero.polimi.it 28 Oct '12

28 Oct '12

Use ldapsearch -o ldif-wrap=no instead. p. > Full_Name: > Version: > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (96.228.233.77) > > > RFC 2849 states: > > 2) Any non-empty line, including comment lines, in an LDIF file > MAY be folded by inserting a line separator (SEP) and a SPACE. > Folding MUST NOT occur before the first character of the line. > In other words, folding a line into two lines, the first of > which is empty, is not permitted. Any line that begins with a > single space MUST be treated as a continuation of the previous > (non-empty) line. When joining folded lines, exactly one space > character at the beginning of each continued line must be > discarded. Implementations SHOULD NOT fold lines in the middle > of a multi-byte UTF-8 character. > > OpenLDAP (ldapsearch at least) has taken implemented that folding > behavior for LDIF output. > > This causes trouble for anyone trying to use 'ldapsearch | grep > <something>' > for one simple example. > > Would you accept a patch to allow an option which disables line folding? > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7424) Accept patch? Add option for not folding ldapsearch LDIF output lines
by jblaine＠kickflop.net 28 Oct '12

28 Oct '12

Full_Name: Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (96.228.233.77) RFC 2849 states: 2) Any non-empty line, including comment lines, in an LDIF file MAY be folded by inserting a line separator (SEP) and a SPACE. Folding MUST NOT occur before the first character of the line. In other words, folding a line into two lines, the first of which is empty, is not permitted. Any line that begins with a single space MUST be treated as a continuation of the previous (non-empty) line. When joining folded lines, exactly one space character at the beginning of each continued line must be discarded. Implementations SHOULD NOT fold lines in the middle of a multi-byte UTF-8 character. OpenLDAP (ldapsearch at least) has taken implemented that folding behavior for LDIF output. This causes trouble for anyone trying to use 'ldapsearch | grep <something>' for one simple example. Would you accept a patch to allow an option which disables line folding?

1 0

Re: (ITS#7423) [PATCH] Update slapo-constraint tests
by michael＠stroeder.com 27 Oct '12

27 Oct '12

This is a cryptographically signed message in MIME format. --------------ms070008080905030605060503 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable jsynacek(a)redhat.com wrote: > This patch updates the slapo-constraint testsuit. It adds additional te= sts for > any constraints using 'uri'. Furthermore, it improves testing of the 'r= estrict' > parameter. In my RE24 working tree: git apply --stat jsynacek-20121025-constraint-tests-update.patch Then I expected =2E/run -b hdb test064 to fail (without the patch in ITS#7418) but it ret= urned "Test succeeded". Ciao, Michael. --------------ms070008080905030605060503 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDI3MTA1MzQ1WjAjBgkq hkiG9w0BCQQxFgQUbmzaJFtkRvKKODnnBAp8DLfiWrIwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAdf/2uF/F/Htah4Ot/ms0g9WO2JlUz97qvAXbU2mDCwC+VqjzfrRYDbSP9kxVwPGhh3/h Cp1GbtrPxzT7nhWhpdURwh6JULcOtAWMUawCwyY87DsbcrKD5kDZTi61lGpSO2JbMmfxcEft 1nlBhzuWFMsyPMjsunjumxstBpbn65+1vcaYN8KMz3CGP2gRniG411zOchah31lA6h+dvEnc z6zzsjw2Z7P8Xuqh1MV39im/HPsgnHEzMTyIwywlLNH6HEwqKH7ELjhlQEpNtIqRvdRQKLY8 85lnO/FMH2ujpxhx1c+FgjHtqOHXSJzzApWaIcqKC4yCxtLQ+EZebM3obgAAAAAAAA== --------------ms070008080905030605060503--

1 0

(ITS#7423) [PATCH] Update slapo-constraint tests
by jsynacek＠redhat.com 25 Oct '12

25 Oct '12

Full_Name: Jan Synacek Version: master OS: linux-fedora17 URL: ftp://ftp.openldap.org/incoming/jsynacek-20121025-constraint-tests-update.p… Submission from: (NULL) (209.132.186.34) This patch updates the slapo-constraint testsuit. It adds additional tests for any constraints using 'uri'. Furthermore, it improves testing of the 'restrict' parameter. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Synacek am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: AW: AW: (ITS#7418) slapo-constraint are broken
by jsynacek＠redhat.com 25 Oct '12

25 Oct '12

On 10/25/2012 01:41 PM, Sascha.Kuehndel(a)deka.de wrote: > Hi, > > it looks better. > make test an my own tests was successful. Great. URL: ftp://ftp.openldap.org/incoming/jsynacek-20121025-slapo-constraint-uri-rest… The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Synacek am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat

1 0

AW: AW: (ITS#7418) slapo-constraint are broken
by Sascha.Kuehndel＠deka.de 25 Oct '12

25 Oct '12

Hi, it looks better. make test an my own tests was successful. Thanks, Sascha --------------------------------------------------------------------------------------- #!RESULT OK dn: dc=1,ou=user,ou=deka,dc=example,dc=com changetype: modify replace: description description: ab - #!RESULT ERROR #!ERROR [LDAP: error code 19 - modify breaks constraint on associatedName] dn: dc=1,ou=user,ou=deka,dc=example,dc=com changetype: modify replace: associatedName associatedName: uid=15,ou=group,ou=deka,dc=example,dc=com - #!RESULT OK dn: uid=14,ou=group,ou=deka,dc=example,dc=com changetype: delete #!RESULT OK dn: dc=1,ou=user,ou=deka,dc=example,dc=com changetype: modify replace: description description: abc - #!RESULT ERROR #!ERROR [LDAP: error code 19 - modify breaks constraint on associatedName] dn: dc=1,ou=user,ou=deka,dc=example,dc=com changetype: modify replace: associatedName associatedName: uid=14,ou=group,ou=deka,dc=example,dc=com -

1 0

Re: AW: (ITS#7418) slapo-constraint are broken
by jsynacek＠redhat.com 24 Oct '12

24 Oct '12

This is a multi-part message in MIME format. --------------030809010302060201080601 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit On 10/22/2012 09:14 PM, Sascha.Kuehndel(a)deka.de wrote: > Hello, > > i have reduced the configuration and the DIT to a minium. > So i can now send the slapd.conf, the initial dit and the test-change. > > I hope you can reproduce the error, with it. > > The uses software: > OpenLDAP: 2.4.33 > BDB: 5.3.21 > OpenSSL: 1.0.1c > > Thanks, > Sascha Kuehndel > Could you please try the attached patch? Thank you, -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat --------------030809010302060201080601 Content-Type: text/x-patch; name="constraint2.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="constraint2.patch" diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c index 2d943a2..e7b5689 100644 --- a/servers/slapd/overlays/constraint.c +++ b/servers/slapd/overlays/constraint.c @@ -845,9 +845,6 @@ constraint_check_count_violation( Modifications *m, Entry *target_entry, constra unsigned ca; int j; - if ( cp->set ) - return 0; - for ( j = 0; cp->ap[j]; j++ ) { /* Get this attribute count */ if ( target_entry ) @@ -905,7 +902,6 @@ constraint_update( Operation *op, SlapReply *rs ) int rc; char *msg = NULL; int is_v; - int first = 1; if (get_relax(op)) { return SLAP_CB_CONTINUE; @@ -933,15 +929,17 @@ constraint_update( Operation *op, SlapReply *rs ) return(rs->sr_err); } + op->o_bd = on->on_info->oi_origdb; + rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &target_entry ); + op->o_bd = be; + /* Do we need to count attributes? */ for(cp = c; cp; cp = cp->ap_next) { - if (cp->count != 0 || cp->set || cp->restrict_lud != 0) { - if (first) { - op->o_bd = on->on_info->oi_origdb; - rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &target_entry ); - op->o_bd = be; - first = 0; - } + if (cp->restrict_lud && constraint_check_restrict(op, cp, target_entry) == 0) { + continue; + } + + if (cp->count != 0) { if (rc != 0 || target_entry == NULL) { Debug(LDAP_DEBUG_TRACE, "==> constraint_update rc = %d DN=\"%s\"%s\n", @@ -964,6 +962,7 @@ constraint_update( Operation *op, SlapReply *rs ) } } + rc = LDAP_CONSTRAINT_VIOLATION; for(;m; m = m->sml_next) { unsigned ce = 0; --------------030809010302060201080601--

1 0

Re: (ITS#7421) olcExtraAttrs documentation incorrect
by hyc＠symas.com 24 Oct '12

24 Oct '12

k3kk0n3n(a)gmail.com wrote: > Full_Name: > Version: 2.4.32 > OS: Ubuntu 10, Debian Squeeze > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (130.233.152.136) > > > The documentation in the slapd-config manpage is incorrect. The olcExtraAttrs > setting is said to be a global configuration setting when in reality it seems to > be database specific. In the slapd.conf manpage, the corresponding setting > (extra_attrs) is listed as being database-specific. I believe that is correct > although I have not checked it. > > ( Taken from my post on the openldap-technical mailing list: > http://www.openldap.org/lists/openldap-technical/201210/msg00104.html ) > > Thanks, fixed now in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7422) olcExtraAttrs doesn't work
by k3kk0n3n＠gmail.com 24 Oct '12

24 Oct '12

Full_Name: Version: 2.4.32 OS: Ubuntu 10, Debian Squeeze URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (130.233.152.136) olcExtraAttrs does not seem to work with the rwm overlay (like in ITS#6513). With the rwm overlay present, ACIs are not evaluated when requesting a specific attribute, regardless of whether olcExtraAttrs is specified or not. In order to apply the ACI, you can pass the ACI attribute name in the search. I'm providing a configuration file that can be used to reproduce the problem as well as some search examples to demonstrate the issue. ----Configuration file---- dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /usr/local/var/run/slapd.pid olcArgsFile: /usr/local/var/run/slapd.args #olcLogLevel: -1 olcToolThreads: 1 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcRequires: authc dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/etc/openldap/schema/core.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleload: back_hdb olcModuleLoad: rwm dn: olcOverlay=rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=example,dc=com olcRootPW: pass olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcExtraAttrs: OpenLDAPaci olcAccess: to attrs=userpassword by anonymous auth olcAccess: to dn.base="dc=example,dc=com" by * search olcAccess: to * by self manage by dynacl/aci=OpenLDAPaci manage ----Note---- To disable the rwm overlay, comment the following 4 lines in the config: dn: olcOverlay=rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm ----Test data---- dn: dc=example,dc=com objectClass: dcObject objectClass: top objectClass: organization dc: example o: example dn: cn=a,dc=example,dc=com objectClass: top objectClass: person cn: a sn: a userPassword: pass dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b userPassword: pass OpenLDAPaci: 1#entry#grant;r,s,c;[all]#access-id#cn=a,dc=example,dc=com ----Search examples---- Without rwm, requesting the whole object (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com # b, example.com dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b # numResponses: 2 # numEntries: 1 Without rwm, requesting an attribute (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn # b, example.com dn: cn=b,dc=example,dc=com sn: b # numResponses: 2 # numEntries: 1 With rwm, requesting the whole object (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com # b, example.com dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b # numResponses: 2 # numEntries: 1 With rwm, requesting an attribute (notice the object is not returned here): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn # numResponses: 1 With rwm, requesting an attribute and openldapaci (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn openldapaci # b, example.com dn: cn=b,dc=example,dc=com sn: b OpenLDAPaci: 1#entry#grant;r,s,c;[all]#access-id#cn=a,dc=example,dc=com # numResponses: 2 # numEntries: 1 ( Taken from my post on the openldap-technical mailing list: http://www.openldap.org/lists/openldap-technical/201210/msg00104.html )

1 0

(ITS#7421) olcExtraAttrs documentation incorrect
by k3kk0n3n＠gmail.com 24 Oct '12

24 Oct '12

Full_Name: Version: 2.4.32 OS: Ubuntu 10, Debian Squeeze URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (130.233.152.136) The documentation in the slapd-config manpage is incorrect. The olcExtraAttrs setting is said to be a global configuration setting when in reality it seems to be database specific. In the slapd.conf manpage, the corresponding setting (extra_attrs) is listed as being database-specific. I believe that is correct although I have not checked it. ( Taken from my post on the openldap-technical mailing list: http://www.openldap.org/lists/openldap-technical/201210/msg00104.html )

1 0

Re: AW: (ITS#7418) slapo-constraint are broken
by quanah＠zimbra.com 23 Oct '12

23 Oct '12

--On Tuesday, October 23, 2012 5:26 AM +0000 jsynacek(a)redhat.com wrote: > On 10/22/2012 09:19 PM, quanah(a)zimbra.com wrote: >> --On Monday, October 22, 2012 7:14 PM +0000 Sascha.Kuehndel(a)deka.de >> wrote: >> >>> --_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_ >>> Content-Type: text/plain; charset="iso-8859-1" >>> Content-Transfer-Encoding: quoted-printable >>> >>> Hello, >>> >>> i have reduced the configuration and the DIT to a minium. >>> So i can now send the slapd.conf, the initial dit and the test-change. >>> >>> I hope you can reproduce the error, with it. >> >> Hi Jan, >> >> It appears your changes to slapo-constraint broke at least one >> configuration option. Can you please review the information in this ITS >> and update your changes. Thanks. >> > > Hi, > > those changes were made by me (different Jan). > I will look into it and update the testcases. Thanks. Sorry for the mixup, I picked the first Jan that came up in my mailbox search. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7420) Way to bypass overlay unique and constranit
by hyc＠symas.com 23 Oct '12

23 Oct '12

kmenshikov(a)hostcomm.ru wrote: > Full_Name: Konstantin Menshikov > Version: 2.4.33 > OS: FreeBSD 8.2-RELEASE-p4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.116.101.94) > > > Overlay unique and constraint use list attributes for check. > If we use restriction by rdn (attribute cn for example), and don`t add attribute > cn in ldif-file, we can bypass restriction. > > Overlay unique look list attributes in op->ora_e->e_attrs, > if this list not contain attribute cn, checks isn`t running. > > IMHO: problem not in overlays, but in slapd code, that allow add object without > explicit set rdn. The slapd behavior was discussed long ago, in ITS#2243. The current slapd behavior is consistent with RFC4511 (though this differs from older releases and the now obsoleted RFC2251). It seems that because of this behavior, the fix will have to be made to each overlay accordingly. It would be nice if we had a more centralized approach though. > > Example configuration: > [root(a)rdn.problem openldap]# cat slapd.conf > # > # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. > # > include /usr/local/etc/openldap/schema/core.schema > include /usr/local/etc/openldap/schema/corba.schema > include /usr/local/etc/openldap/schema/cosine.schema > include /usr/local/etc/openldap/schema/dyngroup.schema > include /usr/local/etc/openldap/schema/inetorgperson.schema > include /usr/local/etc/openldap/schema/java.schema > include /usr/local/etc/openldap/schema/misc.schema > include /usr/local/etc/openldap/schema/nis.schema > include /usr/local/etc/openldap/schema/openldap.schema > include /usr/local/etc/openldap/schema/ppolicy.schema > include /usr/local/etc/openldap/schema/sudo.schema > include /usr/local/etc/openldap/schema/samba.schema > include /usr/local/etc/openldap/schema/spamassassin.schema > include /usr/local/etc/openldap/schema/openssh-lpk.schema > include /usr/local/etc/openldap/schema/vega-base.schema > include /usr/local/etc/openldap/schema/vega-corp.schema > include /usr/local/etc/openldap/schema/vega-net.schema > include /usr/local/etc/openldap/schema/oversun-base.schema > include /usr/local/etc/openldap/schema/oversun-corp.schema > include /usr/local/etc/openldap/schema/oversun-mail.schema > include /usr/local/etc/openldap/schema/oversun-net.schema > include /usr/local/etc/openldap/schema/asterisk.schema > > > # Define global ACLs to disable default read access. > > # Do not enable referrals until AFTER you have a working directory > # service AND an understanding of referrals. > #referral ldap://root.openldap.org > > pidfile /var/run/openldap/slapd.pid > argsfile /var/run/openldap/slapd.args > loglevel config stats sync trace > > # Load dynamic backend modules: > modulepath /usr/local/libexec/openldap > moduleload back_hdb > > database hdb > suffix "o=company" > rootdn "cn=ldapadm,o=company" > rootpw password > directory /var/db/openldap-data/o=company > > overlay unique > unique_uri ldap:///ou=groups,o=company?cn?sub > > How to repeat: > > [root(a)rdn.problem openldap]# ldapadd -D cn=ldapadm,o=company -wpassword -H > ldap://127.0.0.5:389 -f /root/add.ldif.false > adding new entry "cn=test,ou=system,ou=groups,o=company" > ldap_add: Constraint violation (19) > additional info: some attributes not unique > > [root(a)rdn.problem openldap]# cat /root/add.ldif.false > dn: cn=test,ou=system,ou=groups,o=company > changetype: add > objectClass: posixGroup > description: test > cn: test > gidNumber: 1000 > [root(a)rdn.problem openldap]# ldapadd -D cn=ldapadm,o=company -wpassword -H > ldap://127.0.0.5:389 -f /root/add.ldif.true > adding new entry "cn=test,ou=system,ou=groups,o=company" > > [root(a)rdn.problem openldap]# cat /root/add.ldif.true > dn: cn=test,ou=system,ou=groups,o=company > changetype: add > objectClass: posixGroup > description: test > gidNumber: 1000 > [root(a)rdn.problem openldap]# diff -U 3 /root/add.ldif.false /root/add.ldif.true > > --- /root/add.ldif.false 2012-10-23 06:22:16.000000000 +0000 > +++ /root/add.ldif.true 2012-10-23 06:22:25.000000000 +0000 > @@ -2,5 +2,4 @@ > changetype: add > objectClass: posixGroup > description: test > -cn: test > gidNumber: 1000 > > > Log file records: > > Oct 23 06:23:21 rdn slapd[44326]: slap_listener_activate(6): > Oct 23 06:23:21 rdn slapd[44326]: >>> slap_listener(ldap://) > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 fd=10 ACCEPT from IP=127.0.0.5:17098 > (IP=0.0.0.0:389) > Oct 23 06:23:21 rdn slapd[44326]: connection_get(10): got connid=1006 > Oct 23 06:23:21 rdn slapd[44326]: connection_read(10): checking for input on > id=1006 > Oct 23 06:23:21 rdn slapd[44326]: op tag 0x60, time 1350973401 > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 do_bind > Oct 23 06:23:21 rdn slapd[44326]: >>> dnPrettyNormal: <cn=ldapadm,o=company> > Oct 23 06:23:21 rdn slapd[44326]: <<< dnPrettyNormal: <cn=ldapadm,o=company>, > <cn=ldapadm,o=company> > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 BIND dn="cn=ldapadm,o=company" > method=128 > Oct 23 06:23:21 rdn slapd[44326]: do_bind: version=3 dn="cn=ldapadm,o=company" > method=128 > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 BIND dn="cn=ldapadm,o=company" > mech=SIMPLE ssf=0 > Oct 23 06:23:21 rdn slapd[44326]: do_bind: v3 bind: "cn=ldapadm,o=company" to > "cn=ldapadm,o=company" > Oct 23 06:23:21 rdn slapd[44326]: send_ldap_result: conn=1006 op=0 p=3 > Oct 23 06:23:21 rdn slapd[44326]: send_ldap_response: msgid=1 tag=97 err=0 > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 RESULT tag=97 err=0 text= > Oct 23 06:23:21 rdn slapd[44326]: connection_get(10): got connid=1006 > Oct 23 06:23:21 rdn slapd[44326]: connection_read(10): checking for input on > id=1006 > Oct 23 06:23:21 rdn slapd[44326]: op tag 0x68, time 1350973401 > Oct 23 06:23:21 rdn slapd[44326]: connection_input: conn=1006 deferring > operation: binding > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=1 do_add > Oct 23 06:23:21 rdn slapd[44326]: >>> dnPrettyNormal: > <cn=test,ou=system,ou=groups,o=company> > Oct 23 06:23:21 rdn slapd[44326]: <<< dnPrettyNormal: > <cn=test,ou=system,ou=groups,o=company>, > <cn=test,ou=system,ou=groups,o=company> > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=1 ADD > dn="cn=test,ou=system,ou=groups,o=company" > Oct 23 06:23:21 rdn slapd[44326]: > bdb_dn2entry("cn=test,ou=system,ou=groups,o=company") > Oct 23 06:23:21 rdn slapd[44326]: => > hdb_dn2id("cn=test,ou=system,ou=groups,o=company") > Oct 23 06:23:21 rdn slapd[44326]: <= hdb_dn2id: get failed: DB_NOTFOUND: No > matching key/data pair found (-30989) > Oct 23 06:23:21 rdn slapd[44326]: hdb_referrals: tag=104 > target="cn=test,ou=system,ou=groups,o=company" > matched="ou=system,ou=groups,o=company" > Oct 23 06:23:21 rdn slapd[44326]: ==> unique_add > <cn=test,ou=system,ou=groups,o=company> > Oct 23 06:23:21 rdn slapd[44326]: ==> unique_search (|(cn=test)) > Oct 23 06:23:21 rdn slapd[44326]: => hdb_search > Oct 23 06:23:21 rdn slapd[44326]: bdb_dn2entry("ou=groups,o=company") > Oct 23 06:23:21 rdn slapd[44326]: search_candidates: base="ou=groups,o=company" > (0x00000002) scope=2 > Oct 23 06:23:21 rdn slapd[44326]: => hdb_dn2idl("ou=groups,o=company") > Oct 23 06:23:21 rdn slapd[44326]: => bdb_equality_candidates (objectClass) > Oct 23 06:23:21 rdn slapd[44326]: <= bdb_equality_candidates: (objectClass) not > indexed > Oct 23 06:23:21 rdn slapd[44326]: => bdb_equality_candidates (cn) > Oct 23 06:23:21 rdn slapd[44326]: <= bdb_equality_candidates: (cn) not indexed > Oct 23 06:23:21 rdn slapd[44326]: bdb_search_candidates: id=-1 first=2 last=5 > Oct 23 06:23:21 rdn slapd[44326]: hdb_search: 2 does not match filter > Oct 23 06:23:21 rdn slapd[44326]: hdb_search: 3 does not match filter > Oct 23 06:23:21 rdn slapd[44326]: hdb_search: 4 does not match filter > Oct 23 06:23:21 rdn slapd[44326]: ==> count_attr_cb > <cn=test,ou=personal,ou=groups,o=company> > Oct 23 06:23:21 rdn slapd[44326]: send_ldap_result: conn=1006 op=1 p=3 > Oct 23 06:23:21 rdn slapd[44326]: => unique_search found 1 records > Oct 23 06:23:21 rdn slapd[44326]: send_ldap_result: conn=1006 op=1 p=3 > Oct 23 06:23:21 rdn slapd[44326]: send_ldap_response: msgid=2 tag=105 err=19 > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=1 RESULT tag=105 err=19 text=some > attributes not unique > Oct 23 06:23:21 rdn slapd[44326]: connection_get(10): got connid=1006 > Oct 23 06:23:21 rdn slapd[44326]: connection_read(10): checking for input on > id=1006 > Oct 23 06:23:21 rdn slapd[44326]: op tag 0x42, time 1350973401 > Oct 23 06:23:21 rdn slapd[44326]: ber_get_next on fd 10 failed errno=0 > (Undefined error: 0) > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=2 do_unbind > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=2 UNBIND > Oct 23 06:23:21 rdn slapd[44326]: connection_close: conn=1006 sd=10 > Oct 23 06:23:21 rdn slapd[44326]: conn=1006 fd=10 closed > > Oct 23 06:23:52 rdn slapd[44326]: slap_listener_activate(6): > Oct 23 06:23:52 rdn slapd[44326]: >>> slap_listener(ldap://) > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 fd=10 ACCEPT from IP=127.0.0.5:20738 > (IP=0.0.0.0:389) > Oct 23 06:23:52 rdn slapd[44326]: connection_get(10): got connid=1007 > Oct 23 06:23:52 rdn slapd[44326]: connection_read(10): checking for input on > id=1007 > Oct 23 06:23:52 rdn slapd[44326]: op tag 0x60, time 1350973432 > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 do_bind > Oct 23 06:23:52 rdn slapd[44326]: >>> dnPrettyNormal: <cn=ldapadm,o=company> > Oct 23 06:23:52 rdn slapd[44326]: <<< dnPrettyNormal: <cn=ldapadm,o=company>, > <cn=ldapadm,o=company> > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 BIND dn="cn=ldapadm,o=company" > method=128 > Oct 23 06:23:52 rdn slapd[44326]: do_bind: version=3 dn="cn=ldapadm,o=company" > method=128 > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 BIND dn="cn=ldapadm,o=company" > mech=SIMPLE ssf=0 > Oct 23 06:23:52 rdn slapd[44326]: do_bind: v3 bind: "cn=ldapadm,o=company" to > "cn=ldapadm,o=company" > Oct 23 06:23:52 rdn slapd[44326]: send_ldap_result: conn=1007 op=0 p=3 > Oct 23 06:23:52 rdn slapd[44326]: send_ldap_response: msgid=1 tag=97 err=0 > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 RESULT tag=97 err=0 text= > Oct 23 06:23:52 rdn slapd[44326]: connection_get(10): got connid=1007 > Oct 23 06:23:52 rdn slapd[44326]: connection_read(10): checking for input on > id=1007 > Oct 23 06:23:52 rdn slapd[44326]: op tag 0x68, time 1350973432 > Oct 23 06:23:52 rdn slapd[44326]: connection_input: conn=1007 deferring > operation: binding > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=1 do_add > Oct 23 06:23:52 rdn slapd[44326]: >>> dnPrettyNormal: > <cn=test,ou=system,ou=groups,o=company> > Oct 23 06:23:52 rdn slapd[44326]: <<< dnPrettyNormal: > <cn=test,ou=system,ou=groups,o=company>, > <cn=test,ou=system,ou=groups,o=company> > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=1 ADD > dn="cn=test,ou=system,ou=groups,o=company" > Oct 23 06:23:52 rdn slapd[44326]: > bdb_dn2entry("cn=test,ou=system,ou=groups,o=company") > Oct 23 06:23:52 rdn slapd[44326]: => > hdb_dn2id("cn=test,ou=system,ou=groups,o=company") > Oct 23 06:23:52 rdn slapd[44326]: <= hdb_dn2id: get failed: DB_NOTFOUND: No > matching key/data pair found (-30989) > Oct 23 06:23:52 rdn slapd[44326]: hdb_referrals: tag=104 > target="cn=test,ou=system,ou=groups,o=company" > matched="ou=system,ou=groups,o=company" > Oct 23 06:23:52 rdn slapd[44326]: ==> unique_add > <cn=test,ou=system,ou=groups,o=company> > Oct 23 06:23:52 rdn slapd[44326]: oc_check_required entry > (cn=test,ou=system,ou=groups,o=company), objectClass "posixGroup" > Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "objectClass" > Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "description" > Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "gidNumber" > Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "structuralObjectClass" > Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "cn" > Oct 23 06:23:52 rdn slapd[44326]: slap_queue_csn: queing 0x7ffffebfc160 > 20121023062352.127471Z#000000#000#000000 > Oct 23 06:23:52 rdn slapd[44326]: > bdb_dn2entry("cn=test,ou=system,ou=groups,o=company") > Oct 23 06:23:52 rdn slapd[44326]: => > hdb_dn2id("cn=test,ou=system,ou=groups,o=company") > Oct 23 06:23:52 rdn slapd[44326]: <= hdb_dn2id: get failed: DB_NOTFOUND: No > matching key/data pair found (-30989) > Oct 23 06:23:52 rdn slapd[44326]: => hdb_dn2id_add 0x6: > "cn=test,ou=system,ou=groups,o=company" > Oct 23 06:23:52 rdn slapd[44326]: <= hdb_dn2id_add 0x6: 0 > Oct 23 06:23:52 rdn slapd[44326]: => index_entry_add( 6, > "cn=test,ou=system,ou=groups,o=company" ) > Oct 23 06:23:52 rdn slapd[44326]: <= index_entry_add( 6, > "cn=test,ou=system,ou=groups,o=company" ) success > Oct 23 06:23:52 rdn slapd[44326]: => entry_encode(0x00000006): > Oct 23 06:23:52 rdn slapd[44326]: <= entry_encode(0x00000006): > Oct 23 06:23:52 rdn slapd[44326]: hdb_add: added id=00000006 > dn="cn=test,ou=system,ou=groups,o=company" > Oct 23 06:23:52 rdn slapd[44326]: send_ldap_result: conn=1007 op=1 p=3 > Oct 23 06:23:52 rdn slapd[44326]: send_ldap_response: msgid=2 tag=105 err=0 > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=1 RESULT tag=105 err=0 text= > Oct 23 06:23:52 rdn slapd[44326]: slap_graduate_commit_csn: removing 0x80197aeb0 > 20121023062352.127471Z#000000#000#000000 > Oct 23 06:23:52 rdn slapd[44326]: connection_get(10): got connid=1007 > Oct 23 06:23:52 rdn slapd[44326]: connection_read(10): checking for input on > id=1007 > Oct 23 06:23:52 rdn slapd[44326]: op tag 0x42, time 1350973432 > Oct 23 06:23:52 rdn slapd[44326]: ber_get_next on fd 10 failed errno=0 > (Undefined error: 0) > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=2 do_unbind > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=2 UNBIND > Oct 23 06:23:52 rdn slapd[44326]: connection_close: conn=1007 sd=10 > Oct 23 06:23:52 rdn slapd[44326]: conn=1007 fd=10 closed > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7420) Way to bypass overlay unique and constranit
by kmenshikov＠hostcomm.ru 22 Oct '12

22 Oct '12

Full_Name: Konstantin Menshikov Version: 2.4.33 OS: FreeBSD 8.2-RELEASE-p4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.116.101.94) Overlay unique and constraint use list attributes for check. If we use restriction by rdn (attribute cn for example), and don`t add attribute cn in ldif-file, we can bypass restriction. Overlay unique look list attributes in op->ora_e->e_attrs, if this list not contain attribute cn, checks isn`t running. IMHO: problem not in overlays, but in slapd code, that allow add object without explicit set rdn. Example configuration: [root(a)rdn.problem openldap]# cat slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/corba.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/dyngroup.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/java.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/openldap.schema include /usr/local/etc/openldap/schema/ppolicy.schema include /usr/local/etc/openldap/schema/sudo.schema include /usr/local/etc/openldap/schema/samba.schema include /usr/local/etc/openldap/schema/spamassassin.schema include /usr/local/etc/openldap/schema/openssh-lpk.schema include /usr/local/etc/openldap/schema/vega-base.schema include /usr/local/etc/openldap/schema/vega-corp.schema include /usr/local/etc/openldap/schema/vega-net.schema include /usr/local/etc/openldap/schema/oversun-base.schema include /usr/local/etc/openldap/schema/oversun-corp.schema include /usr/local/etc/openldap/schema/oversun-mail.schema include /usr/local/etc/openldap/schema/oversun-net.schema include /usr/local/etc/openldap/schema/asterisk.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel config stats sync trace # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_hdb database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw password directory /var/db/openldap-data/o=company overlay unique unique_uri ldap:///ou=groups,o=company?cn?sub How to repeat: [root(a)rdn.problem openldap]# ldapadd -D cn=ldapadm,o=company -wpassword -H ldap://127.0.0.5:389 -f /root/add.ldif.false adding new entry "cn=test,ou=system,ou=groups,o=company" ldap_add: Constraint violation (19) additional info: some attributes not unique [root(a)rdn.problem openldap]# cat /root/add.ldif.false dn: cn=test,ou=system,ou=groups,o=company changetype: add objectClass: posixGroup description: test cn: test gidNumber: 1000 [root(a)rdn.problem openldap]# ldapadd -D cn=ldapadm,o=company -wpassword -H ldap://127.0.0.5:389 -f /root/add.ldif.true adding new entry "cn=test,ou=system,ou=groups,o=company" [root(a)rdn.problem openldap]# cat /root/add.ldif.true dn: cn=test,ou=system,ou=groups,o=company changetype: add objectClass: posixGroup description: test gidNumber: 1000 [root(a)rdn.problem openldap]# diff -U 3 /root/add.ldif.false /root/add.ldif.true --- /root/add.ldif.false 2012-10-23 06:22:16.000000000 +0000 +++ /root/add.ldif.true 2012-10-23 06:22:25.000000000 +0000 @@ -2,5 +2,4 @@ changetype: add objectClass: posixGroup description: test -cn: test gidNumber: 1000 Log file records: Oct 23 06:23:21 rdn slapd[44326]: slap_listener_activate(6): Oct 23 06:23:21 rdn slapd[44326]: >>> slap_listener(ldap://) Oct 23 06:23:21 rdn slapd[44326]: conn=1006 fd=10 ACCEPT from IP=127.0.0.5:17098 (IP=0.0.0.0:389) Oct 23 06:23:21 rdn slapd[44326]: connection_get(10): got connid=1006 Oct 23 06:23:21 rdn slapd[44326]: connection_read(10): checking for input on id=1006 Oct 23 06:23:21 rdn slapd[44326]: op tag 0x60, time 1350973401 Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 do_bind Oct 23 06:23:21 rdn slapd[44326]: >>> dnPrettyNormal: <cn=ldapadm,o=company> Oct 23 06:23:21 rdn slapd[44326]: <<< dnPrettyNormal: <cn=ldapadm,o=company>, <cn=ldapadm,o=company> Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 BIND dn="cn=ldapadm,o=company" method=128 Oct 23 06:23:21 rdn slapd[44326]: do_bind: version=3 dn="cn=ldapadm,o=company" method=128 Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 BIND dn="cn=ldapadm,o=company" mech=SIMPLE ssf=0 Oct 23 06:23:21 rdn slapd[44326]: do_bind: v3 bind: "cn=ldapadm,o=company" to "cn=ldapadm,o=company" Oct 23 06:23:21 rdn slapd[44326]: send_ldap_result: conn=1006 op=0 p=3 Oct 23 06:23:21 rdn slapd[44326]: send_ldap_response: msgid=1 tag=97 err=0 Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=0 RESULT tag=97 err=0 text= Oct 23 06:23:21 rdn slapd[44326]: connection_get(10): got connid=1006 Oct 23 06:23:21 rdn slapd[44326]: connection_read(10): checking for input on id=1006 Oct 23 06:23:21 rdn slapd[44326]: op tag 0x68, time 1350973401 Oct 23 06:23:21 rdn slapd[44326]: connection_input: conn=1006 deferring operation: binding Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=1 do_add Oct 23 06:23:21 rdn slapd[44326]: >>> dnPrettyNormal: <cn=test,ou=system,ou=groups,o=company> Oct 23 06:23:21 rdn slapd[44326]: <<< dnPrettyNormal: <cn=test,ou=system,ou=groups,o=company>, <cn=test,ou=system,ou=groups,o=company> Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=1 ADD dn="cn=test,ou=system,ou=groups,o=company" Oct 23 06:23:21 rdn slapd[44326]: bdb_dn2entry("cn=test,ou=system,ou=groups,o=company") Oct 23 06:23:21 rdn slapd[44326]: => hdb_dn2id("cn=test,ou=system,ou=groups,o=company") Oct 23 06:23:21 rdn slapd[44326]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Oct 23 06:23:21 rdn slapd[44326]: hdb_referrals: tag=104 target="cn=test,ou=system,ou=groups,o=company" matched="ou=system,ou=groups,o=company" Oct 23 06:23:21 rdn slapd[44326]: ==> unique_add <cn=test,ou=system,ou=groups,o=company> Oct 23 06:23:21 rdn slapd[44326]: ==> unique_search (|(cn=test)) Oct 23 06:23:21 rdn slapd[44326]: => hdb_search Oct 23 06:23:21 rdn slapd[44326]: bdb_dn2entry("ou=groups,o=company") Oct 23 06:23:21 rdn slapd[44326]: search_candidates: base="ou=groups,o=company" (0x00000002) scope=2 Oct 23 06:23:21 rdn slapd[44326]: => hdb_dn2idl("ou=groups,o=company") Oct 23 06:23:21 rdn slapd[44326]: => bdb_equality_candidates (objectClass) Oct 23 06:23:21 rdn slapd[44326]: <= bdb_equality_candidates: (objectClass) not indexed Oct 23 06:23:21 rdn slapd[44326]: => bdb_equality_candidates (cn) Oct 23 06:23:21 rdn slapd[44326]: <= bdb_equality_candidates: (cn) not indexed Oct 23 06:23:21 rdn slapd[44326]: bdb_search_candidates: id=-1 first=2 last=5 Oct 23 06:23:21 rdn slapd[44326]: hdb_search: 2 does not match filter Oct 23 06:23:21 rdn slapd[44326]: hdb_search: 3 does not match filter Oct 23 06:23:21 rdn slapd[44326]: hdb_search: 4 does not match filter Oct 23 06:23:21 rdn slapd[44326]: ==> count_attr_cb <cn=test,ou=personal,ou=groups,o=company> Oct 23 06:23:21 rdn slapd[44326]: send_ldap_result: conn=1006 op=1 p=3 Oct 23 06:23:21 rdn slapd[44326]: => unique_search found 1 records Oct 23 06:23:21 rdn slapd[44326]: send_ldap_result: conn=1006 op=1 p=3 Oct 23 06:23:21 rdn slapd[44326]: send_ldap_response: msgid=2 tag=105 err=19 Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=1 RESULT tag=105 err=19 text=some attributes not unique Oct 23 06:23:21 rdn slapd[44326]: connection_get(10): got connid=1006 Oct 23 06:23:21 rdn slapd[44326]: connection_read(10): checking for input on id=1006 Oct 23 06:23:21 rdn slapd[44326]: op tag 0x42, time 1350973401 Oct 23 06:23:21 rdn slapd[44326]: ber_get_next on fd 10 failed errno=0 (Undefined error: 0) Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=2 do_unbind Oct 23 06:23:21 rdn slapd[44326]: conn=1006 op=2 UNBIND Oct 23 06:23:21 rdn slapd[44326]: connection_close: conn=1006 sd=10 Oct 23 06:23:21 rdn slapd[44326]: conn=1006 fd=10 closed Oct 23 06:23:52 rdn slapd[44326]: slap_listener_activate(6): Oct 23 06:23:52 rdn slapd[44326]: >>> slap_listener(ldap://) Oct 23 06:23:52 rdn slapd[44326]: conn=1007 fd=10 ACCEPT from IP=127.0.0.5:20738 (IP=0.0.0.0:389) Oct 23 06:23:52 rdn slapd[44326]: connection_get(10): got connid=1007 Oct 23 06:23:52 rdn slapd[44326]: connection_read(10): checking for input on id=1007 Oct 23 06:23:52 rdn slapd[44326]: op tag 0x60, time 1350973432 Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 do_bind Oct 23 06:23:52 rdn slapd[44326]: >>> dnPrettyNormal: <cn=ldapadm,o=company> Oct 23 06:23:52 rdn slapd[44326]: <<< dnPrettyNormal: <cn=ldapadm,o=company>, <cn=ldapadm,o=company> Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 BIND dn="cn=ldapadm,o=company" method=128 Oct 23 06:23:52 rdn slapd[44326]: do_bind: version=3 dn="cn=ldapadm,o=company" method=128 Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 BIND dn="cn=ldapadm,o=company" mech=SIMPLE ssf=0 Oct 23 06:23:52 rdn slapd[44326]: do_bind: v3 bind: "cn=ldapadm,o=company" to "cn=ldapadm,o=company" Oct 23 06:23:52 rdn slapd[44326]: send_ldap_result: conn=1007 op=0 p=3 Oct 23 06:23:52 rdn slapd[44326]: send_ldap_response: msgid=1 tag=97 err=0 Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=0 RESULT tag=97 err=0 text= Oct 23 06:23:52 rdn slapd[44326]: connection_get(10): got connid=1007 Oct 23 06:23:52 rdn slapd[44326]: connection_read(10): checking for input on id=1007 Oct 23 06:23:52 rdn slapd[44326]: op tag 0x68, time 1350973432 Oct 23 06:23:52 rdn slapd[44326]: connection_input: conn=1007 deferring operation: binding Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=1 do_add Oct 23 06:23:52 rdn slapd[44326]: >>> dnPrettyNormal: <cn=test,ou=system,ou=groups,o=company> Oct 23 06:23:52 rdn slapd[44326]: <<< dnPrettyNormal: <cn=test,ou=system,ou=groups,o=company>, <cn=test,ou=system,ou=groups,o=company> Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=1 ADD dn="cn=test,ou=system,ou=groups,o=company" Oct 23 06:23:52 rdn slapd[44326]: bdb_dn2entry("cn=test,ou=system,ou=groups,o=company") Oct 23 06:23:52 rdn slapd[44326]: => hdb_dn2id("cn=test,ou=system,ou=groups,o=company") Oct 23 06:23:52 rdn slapd[44326]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Oct 23 06:23:52 rdn slapd[44326]: hdb_referrals: tag=104 target="cn=test,ou=system,ou=groups,o=company" matched="ou=system,ou=groups,o=company" Oct 23 06:23:52 rdn slapd[44326]: ==> unique_add <cn=test,ou=system,ou=groups,o=company> Oct 23 06:23:52 rdn slapd[44326]: oc_check_required entry (cn=test,ou=system,ou=groups,o=company), objectClass "posixGroup" Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "objectClass" Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "description" Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "gidNumber" Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "structuralObjectClass" Oct 23 06:23:52 rdn slapd[44326]: oc_check_allowed type "cn" Oct 23 06:23:52 rdn slapd[44326]: slap_queue_csn: queing 0x7ffffebfc160 20121023062352.127471Z#000000#000#000000 Oct 23 06:23:52 rdn slapd[44326]: bdb_dn2entry("cn=test,ou=system,ou=groups,o=company") Oct 23 06:23:52 rdn slapd[44326]: => hdb_dn2id("cn=test,ou=system,ou=groups,o=company") Oct 23 06:23:52 rdn slapd[44326]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Oct 23 06:23:52 rdn slapd[44326]: => hdb_dn2id_add 0x6: "cn=test,ou=system,ou=groups,o=company" Oct 23 06:23:52 rdn slapd[44326]: <= hdb_dn2id_add 0x6: 0 Oct 23 06:23:52 rdn slapd[44326]: => index_entry_add( 6, "cn=test,ou=system,ou=groups,o=company" ) Oct 23 06:23:52 rdn slapd[44326]: <= index_entry_add( 6, "cn=test,ou=system,ou=groups,o=company" ) success Oct 23 06:23:52 rdn slapd[44326]: => entry_encode(0x00000006): Oct 23 06:23:52 rdn slapd[44326]: <= entry_encode(0x00000006): Oct 23 06:23:52 rdn slapd[44326]: hdb_add: added id=00000006 dn="cn=test,ou=system,ou=groups,o=company" Oct 23 06:23:52 rdn slapd[44326]: send_ldap_result: conn=1007 op=1 p=3 Oct 23 06:23:52 rdn slapd[44326]: send_ldap_response: msgid=2 tag=105 err=0 Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=1 RESULT tag=105 err=0 text= Oct 23 06:23:52 rdn slapd[44326]: slap_graduate_commit_csn: removing 0x80197aeb0 20121023062352.127471Z#000000#000#000000 Oct 23 06:23:52 rdn slapd[44326]: connection_get(10): got connid=1007 Oct 23 06:23:52 rdn slapd[44326]: connection_read(10): checking for input on id=1007 Oct 23 06:23:52 rdn slapd[44326]: op tag 0x42, time 1350973432 Oct 23 06:23:52 rdn slapd[44326]: ber_get_next on fd 10 failed errno=0 (Undefined error: 0) Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=2 do_unbind Oct 23 06:23:52 rdn slapd[44326]: conn=1007 op=2 UNBIND Oct 23 06:23:52 rdn slapd[44326]: connection_close: conn=1007 sd=10 Oct 23 06:23:52 rdn slapd[44326]: conn=1007 fd=10 closed

1 0

Re: AW: (ITS#7418) slapo-constraint are broken
by jsynacek＠redhat.com 22 Oct '12

22 Oct '12

On 10/22/2012 09:19 PM, quanah(a)zimbra.com wrote: > --On Monday, October 22, 2012 7:14 PM +0000 Sascha.Kuehndel(a)deka.de wrote: > >> --_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_ >> Content-Type: text/plain; charset="iso-8859-1" >> Content-Transfer-Encoding: quoted-printable >> >> Hello, >> >> i have reduced the configuration and the DIT to a minium. >> So i can now send the slapd.conf, the initial dit and the test-change. >> >> I hope you can reproduce the error, with it. > > Hi Jan, > > It appears your changes to slapo-constraint broke at least one > configuration option. Can you please review the information in this ITS > and update your changes. Thanks. > Hi, those changes were made by me (different Jan). I will look into it and update the testcases. -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat

1 0

Re: AW: (ITS#7418) slapo-constraint are broken
by quanah＠zimbra.com 22 Oct '12

22 Oct '12

--On Monday, October 22, 2012 7:14 PM +0000 Sascha.Kuehndel(a)deka.de wrote: > --_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_ > Content-Type: text/plain; charset="iso-8859-1" > Content-Transfer-Encoding: quoted-printable > > Hello, > > i have reduced the configuration and the DIT to a minium. > So i can now send the slapd.conf, the initial dit and the test-change. > > I hope you can reproduce the error, with it. Hi Jan, It appears your changes to slapo-constraint broke at least one configuration option. Can you please review the information in this ITS and update your changes. Thanks. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

AW: (ITS#7418) slapo-constraint are broken
by Sascha.Kuehndel＠deka.de 22 Oct '12

22 Oct '12

--_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, i have reduced the configuration and the DIT to a minium. So i can now send the slapd.conf, the initial dit and the test-change. I hope you can reproduce the error, with it. The uses software: OpenLDAP: 2.4.33 BDB: 5.3.21 OpenSSL: 1.0.1c Thanks, Sascha Kuehndel --_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_ Content-Type: application/octet-stream; name="initial.ldif" Content-Description: initial.ldif Content-Disposition: attachment; filename="initial.ldif"; size=1490; creation-date="Mon, 22 Oct 2012 19:06:34 GMT"; modification-date="Mon, 22 Oct 2012 18:41:40 GMT" Content-Transfer-Encoding: base64 ZG46IG91PWRla2EsZGM9ZXhhbXBsZSxkYz1jb20Kb3U6IGRla2FuZXQKb2JqZWN0Q2xhc3M6IG9y Z2FuaXphdGlvbmFsVW5pdApzdHJ1Y3R1cmFsT2JqZWN0Q2xhc3M6IG9yZ2FuaXphdGlvbmFsVW5p dAplbnRyeVVVSUQ6IDdiOWRkOWQyLWIwYmMtMTAzMS05ZjI1LTA1OWJlYjBiYjUzYwplbnRyeUNT TjogMjAxMjEwMjIxNzQ4NTAuODEwNDY3WiMwMDAwMDAjMDAwIzAwMDAwMAoKZG46IG91PWdyb3Vw LG91PWRla2EsZGM9ZXhhbXBsZSxkYz1jb20Kb3U6IFppZWxncnVwcGVuCmRlc2NyaXB0aW9uOiBD b250YWluZXIgZnVlciBaaWVsZ3J1cHBlbmVpbnRyYWVnZQpvYmplY3RDbGFzczogb3JnYW5pemF0 aW9uYWxVbml0CnN0cnVjdHVyYWxPYmplY3RDbGFzczogb3JnYW5pemF0aW9uYWxVbml0CmVudHJ5 VVVJRDogODQwNTExMTItYjBiYy0xMDMxLTlmMjYtMDU5YmViMGJiNTNjCmVudHJ5Q1NOOiAyMDEy MTAyMjE3NDkwNC45MDg2NjBaIzAwMDAwMCMwMDAjMDAwMDAwCgpkbjogdWlkPTE0LG91PWdyb3Vw LG91PWRla2EsZGM9ZXhhbXBsZSxkYz1jb20KdWlkOiAxNApvYmplY3RDbGFzczogYWNjb3VudApv YmplY3RDbGFzczogdG9wCnN0cnVjdHVyYWxPYmplY3RDbGFzczogYWNjb3VudAplbnRyeVVVSUQ6 IDg0N2VhYzVjLWIwYmMtMTAzMS05ZjM2LTA1OWJlYjBiYjUzYwplbnRyeUNTTjogMjAxMjEwMjIx NzUxMjcuNzIyNzQ3WiMwMDAwMDAjMDAwIzAwMDAwMAoKZG46IG91PXVzZXIsb3U9ZGVrYSxkYz1l eGFtcGxlLGRjPWNvbQpvdTogQmVudXR6ZXIKb2JqZWN0Q2xhc3M6IG9yZ2FuaXphdGlvbmFsVW5p dApzdHJ1Y3R1cmFsT2JqZWN0Q2xhc3M6IG9yZ2FuaXphdGlvbmFsVW5pdAplbnRyeVVVSUQ6IDhh ZDhjYTEwLWIwYmMtMTAzMS05ZjNhLTA1OWJlYjBiYjUzYwplbnRyeUNTTjogMjAxMjEwMjIxNzQ5 MTYuMzYyNTU1WiMwMDAwMDAjMDAwIzAwMDAwMAoKZG46IGRjPTEsb3U9dXNlcixvdT1kZWthLGRj PWV4YW1wbGUsZGM9Y29tCmRjOiAxCm9iamVjdENsYXNzOiBkb21haW4Kb2JqZWN0Q2xhc3M6IHRv cAphc3NvY2lhdGVkTmFtZTogdWlkPTE0LG91PWdyb3VwLG91PWRla2EsZGM9ZXhhbXBsZSxkYz1j b20Kc3RydWN0dXJhbE9iamVjdENsYXNzOiBkb21haW4KZW50cnlVVUlEOiA3ODgwZDBlNi1iMGMy LTEwMzEtODk1Yi1hMWEzZjJmYmFjYjcKZW50cnlDU046IDIwMTIxMDIyMTgzMTQyLjU2NzI3OVoj MDAwMDAwIzAwMCMwMDAwMDAKCmRuOiBkYz0yLG91PXVzZXIsb3U9ZGVrYSxkYz1leGFtcGxlLGRj PWNvbQpkYzogMgpvYmplY3RDbGFzczogZG9tYWluCm9iamVjdENsYXNzOiB0b3AKYXNzb2NpYXRl ZE5hbWU6IHVpZD0xNCxvdT1ncm91cCxvdT1kZWthLGRjPWV4YW1wbGUsZGM9Y29tCnN0cnVjdHVy YWxPYmplY3RDbGFzczogZG9tYWluCmVudHJ5VVVJRDogODA0MTUyNTYtYjBjMi0xMDMxLTg5NWMt YTFhM2YyZmJhY2I3CmVudHJ5Q1NOOiAyMDEyMTAyMjE4MzE1NS41NzMwNThaIzAwMDAwMCMwMDAj MDAwMDAwCgo= --_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_ Content-Type: application/octet-stream; name="slapd.conf" Content-Description: slapd.conf Content-Disposition: attachment; filename="slapd.conf"; size=818; creation-date="Mon, 22 Oct 2012 19:06:27 GMT"; modification-date="Mon, 22 Oct 2012 19:05:29 GMT" Content-Transfer-Encoding: base64 IyBTY2hlbWF0YSBhdXMgZGVyIE9wZW5MREFQLURpc3RyaWJ1dGlvbgppbmNsdWRlCSAgICAgICAg ICAgICAgICAgc2xhcGQvZXRjL29wZW5sZGFwL3NjaGVtYS9jb3JlLnNjaGVtYQppbmNsdWRlCSAg ICAgICAgICAgICAgICAgc2xhcGQvZXRjL29wZW5sZGFwL3NjaGVtYS9jb3NpbmUuc2NoZW1hCgoj IExvYWQgbW9kdWxlcwptb2R1bGVwYXRoICAgICAgICAgICAgICAgc2xhcGQvbGliZXhlYy9vcGVu bGRhcAptb2R1bGVsb2FkICAgICAgICAgICAgICAgYmFja19oZGIubGEKbW9kdWxlbG9hZCAgICAg ICAgICAgICAgIGNvbnN0cmFpbnQubGEKCiMgQmFzZSBrb25maWd1cmF0aW9uCnBpZGZpbGUgICAg ICAgICAgICAgICAgICBzbGFwZC5waWQKYXJnc2ZpbGUgICAgICAgICAgICAgICAgIHNsYXBkLmFy Z3MKCiMgRGF0YWJhc2UKZGF0YWJhc2UgICAgICAgICAgICAgICAgIGhkYgoKc3VmZml4ICAgICAg ICAgICAgICAgICAgICJvdT1kZWthLGRjPWV4YW1wbGUsZGM9Y29tIgpkaXJlY3RvcnkgICAgICAg ICAgICAgICAgZXhhbXBsZQpyb290ZG4gICAgICAgICAgICAgICAgICAgImNuPXJvb3Qsb3U9ZGVr YSxkYz1leGFtcGxlLGRjPWNvbSIKcm9vdHB3ICAgICAgICAgICAgICAgICAgIHJvb3QKCm92ZXJs YXkgY29uc3RyYWludApjb25zdHJhaW50X2F0dHJpYnV0ZSBhc3NvY2lhdGVkTmFtZSB1cmkKICBs ZGFwOi8vL291PWdyb3VwLG91PWRla2EsZGM9ZXhhbXBsZSxkYz1jb20/ZW50cnlETj9vbmU/KG9i amVjdENsYXNzPWFjY291bnQpCiAgcmVzdHJpY3Q9bGRhcDovLy9vdT11c2VyLG91PWRla2EsZGM9 ZXhhbXBsZSxkYz1jb20/P29uZQo= --_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_ Content-Type: application/octet-stream; name="test.ldif" Content-Description: test.ldif Content-Disposition: attachment; filename="test.ldif"; size=96; creation-date="Mon, 22 Oct 2012 19:07:18 GMT"; modification-date="Mon, 22 Oct 2012 19:07:00 GMT" Content-Transfer-Encoding: base64 ZG46IGRjPTIsb3U9dXNlcixvdT1kZWthLGRjPWV4YW1wbGUsZGM9Y29tCmNoYW5nZXR5cGU6IG1v ZGlmeQphZGQ6IGRlc2NyaXB0aW9uCmRlc2NyaXB0aW9uOiBhCi0K --_004_F12A906A1F17554CB9CDFC8F4779F3C469A046FAB9EXCCREX9dekag_--

1 0

Re: (ITS#7367) [PATCH] MozNSS: update list of supported cipher suites
by quanah＠zimbra.com 19 Oct '12

19 Oct '12

--On Monday, October 08, 2012 9:49 AM +0200 Jan Včelák <jvcelak(a)redhat.com> wrote: > I would like to see newer OpenLDAP in RHEL because it would be easier for > me to maintain it. But I'm not sure if the advantages will outweight the > disadvantages and if our customers will benefit from it rather than be > forced to deal with new problems. The lack of a current version of OpenLDAP exposes your customers to numerous significant issues, whether or not you choose acknowledge that. >> Ok. One thing I do with Debian is help triage issues that are reported >> there with the upstream ITS system if the issues do not appear to be due >> to the usage of an old version. If there is a simple way to do that >> with Red Hat, I could help there as well. > > When there is a new bug report, I usualy try to reproduce with the > package from RHEL or Fedora. And then with the newest OpenLDAP from git > master. If I'm able to reproduce, I always create a report in your ITS. I was curious more in a list like pkg-openldap-devel w/ Debian, which also gets cc'd on all ldap related tickets. But it sounds like you are already doing what I was thinking of. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7418) slapo-constraint are broken
by michael＠stroeder.com 18 Oct '12

18 Oct '12

This is a cryptographically signed message in MIME format. --------------ms060905030203070305090206 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable I suspect this is related to changes because of fix for ITS#7168 similar or same like ITS#7340. Ciao, Michael. --------------ms060905030203070305090206 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDE4MTkyNjAyWjAjBgkq hkiG9w0BCQQxFgQU7QCgPPclKaMhoNwC33a+he0n9jAwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAYODTh49NYBcdsAkvO9kTYc/VjSVJrTgQbiau0T8JPupHvjrFuHTFfrKRUSrw3gVYR9Fq DhLx/lw0yM6Ced86B7v/GVMjAo4hEE/UV41hCvSd4WXn5DsDRTNQFX3YCSNpTb8fQALJDcRw SL1IRMbGnZdVDHIQGtZ+WR9+0yKLn1m/Bitgh25pZJhdbW+QaRNCEKFuUuqM039BzvVIy+3I yihMjC64xY4dIJplhoedtCJ8JzJaHJgOoetrgcJBkDPmNb0yEA7mjZCEyu+BBizstu5886j/ AygwwHn6NB+Av7Dz2SIl2sOmN0BsPIA2Yu2htDOZqDQjtGfh0LRDenyyBAAAAAAAAA== --------------ms060905030203070305090206--

1 0

(ITS#7418) slapo-constraint are broken
by sascha.kuehndel＠deka.de 18 Oct '12

18 Oct '12

Full_Name: Sascha Kuehndel Version: 2.4.33 OS: HP-UX 11.31 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (192.166.104.102) After upgrade slapd from 2.4.32 to 2.4.33, same contraints fails always. Any change on an entry in restricted tree is not possible. 1. Comment out the contraints helps. 2. I have downgraded the constraint.c, only. After rebuild, the slapds works fine again. Constraint: constraint_attribute dekanetZielgruppenDN uri ldap:///ou=Zielgruppen,ou=dekanet,dc=dekager,dc=dekabank,dc=extern?entryDN?one?(objectClass=dekanetZielgruppe) restrict=ldap:///ou=Benutzer,ou=dekanet,dc=dekager,dc=dekabank,dc=extern??one Change: #!RESULT ERROR #!CONNECTION ldap://dk-ketos:6418 #!DATE 2012-10-18T18:29:02.840 #!ERROR [LDAP: error code 19 - modify breaks constraint on dekanetEmailAdr] dn: dekanetObjLID=74386878,ou=Benutzer,ou=dekanet,dc=dekager,dc=dekabank,dc=ex tern changetype: modify replace: dekanetEmailAdr dekanetEmailAdr: test1234(a)deka.de - Greatings, Sascha

1 0

Re: (ITS#7417) Why is there no schema add utility?
by jerrac＠gmail.com 16 Oct '12

16 Oct '12

--f46d04447dffae07bd04cc34c745 Content-Type: text/plain; charset=ISO-8859-1 Really? How? Also, the method described by Zytrax is pretty much what all the search results said. Including https://help.ubuntu.com/12.04/serverguide/openldap-server.html And I couldn't find anything different in the Openldap.org documentation. Again, maybe because I didn't search for the right things... With slapadd and ldapadd, can you add a .schema file? Or does it have to be in LDIF syntax? *goes to check the man page* --David Reagan On Tue, Oct 16, 2012 at 1:31 PM, Howard Chu <hyc(a)symas.com> wrote: > jerrac(a)gmail.com wrote: > >> Full_Name: David Reagan >> Version: 2.4 >> OS: Ubuntu 12.04 >> URL: ftp://ftp.openldap.org/**incoming/<ftp://ftp.openldap.org/incoming/> >> Submission from: (NULL) (163.41.112.5) >> >> >> Why is there no simple way to add new schema's to cn=Config? As in, >> something >> like "slapadd --schema newschema.schema". >> > > Eh? New schemas can be added directly using slapadd, or using ldapadd. > > The best explanation I found on how to add a new schema is >> http://www.zytrax.com/books/**ldap/ch6/slapd-config.html#**use-schemas<http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-schemas>. >> You have to >> create a conf file, a new directory, run a command, edit a file, and then >> run >> another command. That's a lot of places where user error could break >> things. >> > > Your first mistake is in trusting anything that Zytrax says. Most of their > information is out of date or flat wrong. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/**project/<http://www.openldap.org/project/> > --f46d04447dffae07bd04cc34c745 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Really? How? Also, the method described by Zytrax is pretty much wh= at all the search results said. Including <a href=3D"https://help.ubuntu.co= m/12.04/serverguide/openldap-server.html">https://help.ubuntu.com/12.04/ser= verguide/openldap-server.html</a> And I couldn't find anything different in the Openldap.org document= ation. Again, maybe because I didn't search for the right things... = With slapadd and ldapadd, can you add a .schema file? Or does it have t= o be in LDIF syntax? *goes to check the man page* --David Reagan <div class=3D"gmail_quote">On Tue, Oct 16, 2012 at 1:31 PM, Howard = Chu <<a href=3D"mailto:hyc@symas.com" target=3D"_blank= ">hyc(a)symas.com</a>> wrote: <blockquote class=3D"gmail_quote" = style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <a href=3D"mailto:jerrac@gmail.com" target=3D"_blank">jerrac(a)gmail.com</a> = wrote: <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> Full_Name: David Reagan Version: 2.4 OS: Ubuntu 12.04 URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_blank">ftp://f= tp.openldap.org/incoming/</a> Submission from: (NULL) (163.41.112.5) Why is there no simple way to add new schema's to cn=3DConfig? As in, s= omething like "slapadd --schema newschema.schema". </blockquote> Eh? New schemas can be added directly using slapadd, or using ldapadd. <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> The best explanation I found on how to add a new schema is <a href=3D"http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-schem= as" target=3D"_blank">http://www.zytrax.com/books/ldap/ch6/slapd-con= fig.html#use-schemas</a>. You have to create a conf file, a new directory, run a command, edit a file, and then r= un another command. That's a lot of places where user error could break th= ings. </blockquote> Your first mistake is in trusting anything that Zytrax says. Most of their = information is out of date or flat wrong. -- =A0 -- Howard Chu =A0 CTO, Symas Corp. =A0 =A0 =A0 =A0 =A0 <a href=3D"http://www.symas.com" t= arget=3D"_blank">http://www.symas.com</a> =A0 Director, Highland Sun =A0 =A0 <a href=3D"http://highlandsun.com/hyc/" = target=3D"_blank">http://highlandsun.com/hyc/</a> =A0 Chief Architect, OpenLDAP =A0<a href=3D"http://www.openldap.org/project= /" target=3D"_blank">http://www.openldap.org/project/</a> </blockquote></div> --f46d04447dffae07bd04cc34c745--

1 0

Re: (ITS#7417) Why is there no schema add utility?
by hyc＠symas.com 16 Oct '12

16 Oct '12

jerrac(a)gmail.com wrote: > Full_Name: David Reagan > Version: 2.4 > OS: Ubuntu 12.04 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (163.41.112.5) > > > Why is there no simple way to add new schema's to cn=Config? As in, something > like "slapadd --schema newschema.schema". Eh? New schemas can be added directly using slapadd, or using ldapadd. > The best explanation I found on how to add a new schema is > http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-schemas. You have to > create a conf file, a new directory, run a command, edit a file, and then run > another command. That's a lot of places where user error could break things. Your first mistake is in trusting anything that Zytrax says. Most of their information is out of date or flat wrong. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7417) Why is there no schema add utility?
by jerrac＠gmail.com 16 Oct '12

16 Oct '12

Full_Name: David Reagan Version: 2.4 OS: Ubuntu 12.04 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (163.41.112.5) Why is there no simple way to add new schema's to cn=Config? As in, something like "slapadd --schema newschema.schema". The best explanation I found on how to add a new schema is http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-schemas. You have to create a conf file, a new directory, run a command, edit a file, and then run another command. That's a lot of places where user error could break things. So, is there a utility in the works, or are there other reasons this would be a bad idea? I'm curious. I did search Google, the tickets, and the mailing lists. But either there isn't anything there, or my search terms were bad. If this has already be discussed, I apologize for bringing it up again, and would appreciate a link to the discussion.

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by hyc＠symas.com 12 Oct '12

12 Oct '12

Kurt(a)OpenLDAP.org wrote: > You miss the fact that we encourage deployers of OpenLDAP Software, who we recommend build OpenLDAP Software from source, run 'make test' before they 'make install'. We don't want these deployers to have false positives, such as would be likely caused if we added such environmental variables. > > For those doing automated checks, such as those who do construct packages, they can have local patches to their hearts content. Likewise for developers. > > So, if it was up to me, I would reject your patch as, IMO, it's in appropriate for our source distributions. I suspect Howard will chime in sooner or later. I think you've already covered the points. I have plenty of checks like this in my local source tree, but I see no reason to embed OS and platform-specific stuff into the distributed source. I believe it would lend a false sense of security, particularly when you're on a platform that ignores these variables, but you aren't aware of the fact. It is always the developers' responsibility to know how their own development environment works, and to tweak it to suit their development efforts. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by gitter.spiros＠gmail.com 12 Oct '12

12 Oct '12

2012/10/12 Kurt Zeilenga <Kurt(a)openldap.org>: > > On Oct 12, 2012, at 8:38 AM, Elia Pinto <gitter.spiros(a)gmail.com> wrote: > >> 2012/10/12 Kurt Zeilenga <Kurt(a)openldap.org>: >>> You miss the fact that we encourage deployers of OpenLDAP Software, who we recommend build OpenLDAP Software from source, run 'make test' before they 'make install'. We don't want these deployers to have false positives, such as would be likely caused if we added such environmental variables. >> >> It is your own opinion, right? Have experiences in this regard? > > Yes and Yes. I use to run with such environmental variables set in my .login. Not anymore, too many odd crashes. So sometimes I do something like: > env MallocScribble=yes MallocErrorAbort=yes make test > > but I've that crash above and below the run script, but not in OpenLDAP Software itself. So now, because I tend to run stuff I'm working on in a debugger, I now mostly rely on my debugger to turn malloc debugging on. And I tend to use other tools for leak detection (like leaks(1) on MacOS/X). HeHe, i suspect was ONLY a MacOS/X crap. Good to know. > > -- Kurt > > >> I do >> not. I personally run make test on openldap with Ubuntu 4.12, Fedora >> 17 and RHEL6 and my patch without any problem (good for openldap :=) >> ). And many other projects, for example, git hat has a very extensive >> test suite, use MALLOC_CHECK as in my patch, integrated in a test >> suite. >> >> However, I will not insist further on a trivial patch. Also because >> this discussion gave me the opportunity to investigate better the >> issue, and I'll just patch for FreeBSD my software. So, thank you >> anyway for the useful observations. >> >> Regards >>> >>> For those doing automated checks, such as those who do construct packages, they can have local patches to their hearts content. Likewise for developers. >>> >>> So, if it was up to me, I would reject your patch as, IMO, it's in appropriate for our source distributions. I suspect Howard will chime in sooner or later. >>> >>> -- Kurt >>> >

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by Kurt＠OpenLDAP.org 12 Oct '12

12 Oct '12

On Oct 12, 2012, at 8:38 AM, Elia Pinto <gitter.spiros(a)gmail.com> wrote: > 2012/10/12 Kurt Zeilenga <Kurt(a)openldap.org>: >> You miss the fact that we encourage deployers of OpenLDAP Software, who we recommend build OpenLDAP Software from source, run 'make test' before they 'make install'. We don't want these deployers to have false positives, such as would be likely caused if we added such environmental variables. > > It is your own opinion, right? Have experiences in this regard? Yes and Yes. I use to run with such environmental variables set in my .login. Not anymore, too many odd crashes. So sometimes I do something like: env MallocScribble=yes MallocErrorAbort=yes make test but I've that crash above and below the run script, but not in OpenLDAP Software itself. So now, because I tend to run stuff I'm working on in a debugger, I now mostly rely on my debugger to turn malloc debugging on. And I tend to use other tools for leak detection (like leaks(1) on MacOS/X). -- Kurt > I do > not. I personally run make test on openldap with Ubuntu 4.12, Fedora > 17 and RHEL6 and my patch without any problem (good for openldap :=) > ). And many other projects, for example, git hat has a very extensive > test suite, use MALLOC_CHECK as in my patch, integrated in a test > suite. > > However, I will not insist further on a trivial patch. Also because > this discussion gave me the opportunity to investigate better the > issue, and I'll just patch for FreeBSD my software. So, thank you > anyway for the useful observations. > > Regards >> >> For those doing automated checks, such as those who do construct packages, they can have local patches to their hearts content. Likewise for developers. >> >> So, if it was up to me, I would reject your patch as, IMO, it's in appropriate for our source distributions. I suspect Howard will chime in sooner or later. >> >> -- Kurt >>

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by gitter.spiros＠gmail.com 12 Oct '12

12 Oct '12

2012/10/12 Kurt Zeilenga <Kurt(a)openldap.org>: > You miss the fact that we encourage deployers of OpenLDAP Software, who we recommend build OpenLDAP Software from source, run 'make test' before they 'make install'. We don't want these deployers to have false positives, such as would be likely caused if we added such environmental variables. It is your own opinion, right? Have experiences in this regard? I do not. I personally run make test on openldap with Ubuntu 4.12, Fedora 17 and RHEL6 and my patch without any problem (good for openldap :=) ). And many other projects, for example, git hat has a very extensive test suite, use MALLOC_CHECK as in my patch, integrated in a test suite. However, I will not insist further on a trivial patch. Also because this discussion gave me the opportunity to investigate better the issue, and I'll just patch for FreeBSD my software. So, thank you anyway for the useful observations. Regards > > For those doing automated checks, such as those who do construct packages, they can have local patches to their hearts content. Likewise for developers. > > So, if it was up to me, I would reject your patch as, IMO, it's in appropriate for our source distributions. I suspect Howard will chime in sooner or later. > > -- Kurt >

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by Kurt＠OpenLDAP.org 12 Oct '12

12 Oct '12

You miss the fact that we encourage deployers of OpenLDAP Software, who we recommend build OpenLDAP Software from source, run 'make test' before they 'make install'. We don't want these deployers to have false positives, such as would be likely caused if we added such environmental variables. For those doing automated checks, such as those who do construct packages, they can have local patches to their hearts content. Likewise for developers. So, if it was up to me, I would reject your patch as, IMO, it's in appropriate for our source distributions. I suspect Howard will chime in sooner or later. -- Kurt

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by gitter.spiros＠gmail.com 12 Oct '12

12 Oct '12

2012/10/11 Kurt Zeilenga <Kurt(a)openldap.org>: > I note that these environment variables are specific to Linux, and then only certain Linux systems. If we add these, then we should also add similar environment variables for FreeBSD malloc(3), MacOS/X malloc(3), and various alternative malloc(3) libraries. And then we might get into cases where variables for one set of environmental variables conflict with another. As these can be set by the developer as desired in their development environment, there's little reason to get into setting all the malloc(3) environmental variables that might be useful... and we shouldn't play favors and only set variables for Linux. Sorry for the delay, problems to the my $DAYWORK Ok. First of all, elibc (debian/ubuntu recently) and glibc cover probably 95% of the Linux distributions, and they are compatible, in particular for the MALLOC_CHECK http://lwn.net/Articles/333755/ - i have also checked the source. A considerable part of the remaining operating systems are like BSD - FreeBSD for example - and MacOSX, FreeBSD based. In fact, these latter two have different malloc library and it may be necessary to activate different controls for different systems (see the first reference) http://permalink.gmane.org/gmane.network.openvswitch.devel/14838 http://www.unix.com/man-page/freebsd/5/malloc.conf/ But the benefits of automating these tests is to do a better AUTOQA for the buildsystem. It is also not true, as experience shows, that all developers know everything. Beeing expert in LDAP and C programming, for example, does not mean necessarily be an expert in everything: this can certainly be true for the OPENLDAP developers but it is not always the case. Here some examples: http://lists.fedoraproject.org/pipermail/devel/2010-May/135683.html (this check had found many bug that the upstream developer haven't catched) or this, from my mantainer, http://lists.gnupg.org/pipermail/gcrypt-devel/2010-June/001605.html I saw that you have closed the case(WANTFIX i think), however, I have to tell you better my opinion. If, as can happen, you decide that my reasons make sense, i can reroll my patch for Linux, macos and freebsd. Let me know. Thanks anyway for your reply > > -- Kurt >

1 0

Re: (ITS#7414) rwm: ldapmodify, slapd segmentation fault
by jvcelak＠redhat.com 11 Oct '12

11 Oct '12

> > The slapd daemon will crash, here is the full backtrace: > > Thanks for the detailed report. Fixed now in master. > Thank you for the very fast resolution. Jan

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by kurt＠OpenLDAP.org 11 Oct '12

11 Oct '12

On Oct 11, 2012, at 1:44 PM, h.b.furuseth(a)usit.uio.no wrote: > We can describe these and other variables in tests/README. There's lots of malloc variables one could describe. Better off to simply say that one might want to read the documentation for whatever malloc they are using, and use, if they want, any environmental variables they might want to use. This avoids duplicating detail better left to the malloc documentation. > > Yeah I know, people don't read documentation. The testing > announcements could mention the file though. Wrong audience, me thinks, especially if those announcements are posted to openldap-techncial. We don't need openldap users reporting malloc use issues in non-OpenLDAP programs. Use of such variables should be limited to developers. -- Kurt > >

1 0

(ITS#7416) entryCSN index errors when changing olcDbEnvFlags with back-mdb
by quanah＠OpenLDAP.org 11 Oct '12

11 Oct '12

Full_Name: Quanah Gibson-Mount Version: 2.4.33 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) I found that if I modify the olcDbEnvFlags on a back-mdb database to have: olcDbEnvFlags: writemap olcDbEnvFlags: nometasync Then modifications in the primary database will throw the following error until slapd is restarted: Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 fd=11 ACCEPT from PATH=/opt/zimbra/openldap-2.4.33.2z/var/run/ldapi (PATH=/opt/zimbra/openldap-2.4.33.2z/var/run/ldapi) Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=0 BIND dn="cn=config" method=128 Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=0 RESULT tag=97 err=0 text= Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=1 SRCH base="cn=accesslog" scope=0 deref=2 filter="(objectClass=*)" Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=1 SRCH attr=1.1 Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=2 SRCH base="olcDatabase={2}mdb,cn=config" scope=0 deref=2 filter="(objectClass=*)" Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=2 SRCH attr=olcDbEnvFlags Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=3 MOD dn="olcDatabase={2}mdb,cn=config" Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=3 MOD attr=olcDbEnvFlags Oct 11 14:38:01 zre-ldap002 slapd[22940]: slap_queue_csn: queing 0x7f88c17fc3f0 20121011213801.832254Z#000000#000#000000 Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=3 RESULT tag=103 err=0 text= Oct 11 14:38:01 zre-ldap002 slapd[22940]: slap_graduate_commit_csn: removing 0x41d4690 20121011213801.832254Z#000000#000#000000 Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=4 MOD dn="uid=zmpostfix,cn=appaccts,cn=zimbra" Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=4 MOD attr=zimbraId Oct 11 14:38:01 zre-ldap002 slapd[22940]: slap_queue_csn: queing 0x7f88c17fd1a0 20121011213801.864697Z#000000#000#000000 Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=4: attribute "entryCSN" index delete failure Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 op=4 RESULT tag=103 err=80 text= Oct 11 14:38:01 zre-ldap002 slapd[22940]: slap_graduate_commit_csn: removing 0x41d4690 20121011213801.864697Z#000000#000#000000 Oct 11 14:38:01 zre-ldap002 slapd[22940]: conn=1001 fd=11 closed (connection lost) Oct 11 14:38:06 zre-ldap002 slapd[22940]: conn=1004 fd=14 closed (connection lost) Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 fd=11 ACCEPT from IP=10.137.242.52:47811 (IP=10.137.242.52:389) Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=0 STARTTLS Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=0 RESULT oid= err=0 text= Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 fd=11 TLS established tls_ssf=256 ssf=256 Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=1 BIND dn="uid=zimbra,cn=admins,cn=zimbra" method=128 Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=1 BIND dn="uid=zimbra,cn=admins,cn=zimbra" mech=SIMPLE ssf=0 Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=1 RESULT tag=97 err=0 text= Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=2 SRCH base="cn=zre-ldap002.eng.vmware.com,cn=servers,cn=zimbra" scope=0 deref=0 filter="(objectClass=*)" Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=3 SRCH base="cn=config,cn=zimbra" scope=0 deref=0 filter="(objectClass=*)" Oct 11 14:38:09 zre-ldap002 slapd[22940]: conn=1005 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 11 14:38:10 zre-ldap002 slapd[22940]: conn=1005 op=4 MOD dn="cn=zre-ldap002.eng.vmware.com,cn=servers,cn=zimbra" Oct 11 14:38:10 zre-ldap002 slapd[22940]: conn=1005 op=4 MOD attr=zimbraMtaSmtpdMilters Oct 11 14:38:10 zre-ldap002 slapd[22940]: slap_queue_csn: queing 0x7f88c17fd1a0 20121011213810.017749Z#000000#000#000000 Oct 11 14:38:10 zre-ldap002 slapd[22940]: conn=1005 op=4: attribute "entryCSN" index delete failure Oct 11 14:38:10 zre-ldap002 slapd[22940]: conn=1005 op=4 RESULT tag=103 err=80 text= Oct 11 14:38:10 zre-ldap002 slapd[22940]: slap_graduate_commit_csn: removing 0x41d5110 20121011213810.017749Z#000000#000#000000 Oct 11 14:38:10 zre-ldap002 slapd[22940]: conn=1005 fd=11 closed (connection lost)

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by h.b.furuseth＠usit.uio.no 11 Oct '12

11 Oct '12

We can describe these and other variables in tests/README. Yeah I know, people don't read documentation. The testing announcements could mention the file though.

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by masarati＠aero.polimi.it 11 Oct '12

11 Oct '12

> It is true in general, but it is also a matter of a personal taste. If > the openldap project use a buildboot that set in the environment these > variables , that patch is useless. This is also partially true if the > openldap developer use to set these variables in their personal > environment, because other contributor could not do the same. Other > project use a similar patch , for example popt 1.17 devel and git 1.8 > in master, i am the author so i know . what is more openldap now are > not using automake and the little test environment that automake could > use, so i have some difficulty to understeand what is this alternative > "test environment" . Perhaps i have missed something ? I meant the environment of the shell tests are run from. IMHO, I'd consider setting those macros a developer's conscious choice rather than a normal user's act. Moreover, they're specific to glibc, while users might want to use different malloc implementations, or build on platforms where glibc is not available, so the fact they're not honored might not be obvious. My 2c, of course. p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by Kurt＠OpenLDAP.org 11 Oct '12

11 Oct '12

And, I should add, setting them up generally (not just for OpenLDAP command line tools), means they catch non-OpenLDAP bugs... and that leads to non-OpenLDAP issues being reported to the OpenLDAP Project. We should avoid this for when 'make test' is simply used by deployers as a quick sanity tools. Developers, on the other hand, hopefully know what they are doing when they set such environmental variables... and they know how to manage this locally. Best to avoid adding such to the public test system. -- Kurt

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by Kurt＠OpenLDAP.org 11 Oct '12

11 Oct '12

I note that these environment variables are specific to Linux, and then only certain Linux systems. If we add these, then we should also add similar environment variables for FreeBSD malloc(3), MacOS/X malloc(3), and various alternative malloc(3) libraries. And then we might get into cases where variables for one set of environmental variables conflict with another. As these can be set by the developer as desired in their development environment, there's little reason to get into setting all the malloc(3) environmental variables that might be useful... and we shouldn't play favors and only set variables for Linux. -- Kurt

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by gitter.spiros＠gmail.com 11 Oct '12

11 Oct '12

It is true in general, but it is also a matter of a personal taste. If the openldap project use a buildboot that set in the environment these variables , that patch is useless. This is also partially true if the openldap developer use to set these variables in their personal environment, because other contributor could not do the same. Other project use a similar patch , for example popt 1.17 devel and git 1.8 in master, i am the author so i know . what is more openldap now are not using automake and the little test environment that automake could use, so i have some difficulty to understeand what is this alternative "test environment" . Perhaps i have missed something ? 2012/10/11, Pierangelo Masarati <masarati(a)aero.polimi.it>: > These vars can be set directly from the test environment, no need to > modify the test scripts. > > p. > >> Full_Name: Elia Pinto >> Version: 2.4 master >> OS: Linux FC12 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (2605:4400:1:781:216:3eff:fe31:f4d4) >> >> >>>From a8ff21429c29f1d2b6ef8f58ec84b7a9036cea73 Mon Sep 17 00:00:00 2001 >> From: Elia Pinto <gitter.spiros(a)gmail.com> >> Date: Thu, 11 Oct 2012 17:49:06 +0200 >> Subject: [PATCH] Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the >> test >> suite for detecting heap corruption >> >> Recent versions of Linux libc (later than 5.4.23) and glibc (2.x) >> include a malloc() implementation which is tunable via environment >> variables. When MALLOC_CHECK_ is set, a special (less efficient) >> implementation is used which is designed to be tolerant against >> simple errors, such as double calls of free() with the same argument, >> or overruns of a single byte (off-by-one bugs). When MALLOC_CHECK_ >> is set to 3, a diagnostic message is printed on stderr >> and the program is aborted. >> >> Setting the MALLOC_PERTURB_ environment variable causes the malloc >> functions in libc to return memory which has been wiped and clear >> memory when it is returned. >> Of course this does not affect calloc which always does clear the memory. >> >> The reason for this exercise is, of course, to find code which uses >> memory returned by malloc without initializing it and code which uses >> code after it is freed. valgrind can do this but it's costly to run. >> The MALLOC_PERTURB_ exchanges the ability to detect problems in 100% >> of the cases with speed. >> >> The byte value used to initialize values returned by malloc is the byte >> value of the environment value. The value used to clear memory is the >> bitwise inverse. Setting MALLOC_PERTURB_ to zero disables the feature. >> >> This technique can find hard to detect bugs. >> It is therefore suggested to always use this flag (at least temporarily) >> when testing out code or a new distribution. >> >> Signed-off-by: Elia Pinto <gitter.spiros(a)gmail.com> >> --- >> tests/run.in | 5 +++++ >> 1 file changed, 5 insertions(+) >> >> diff --git a/tests/run.in b/tests/run.in >> index 5e6178b..fe25d0c 100644 >> --- a/tests/run.in >> +++ b/tests/run.in >> @@ -241,6 +241,11 @@ fi >> >> # disable LDAP initialization >> LDAPNOINIT=true; export LDAPNOINIT >> +# Add libc malloc_check and MALLOC_PERTURB test >> +MALLOC_CHECK_=3 >> +export MALLOC_CHECK_ >> +MALLOC_PERTURB_="$( expr $ $$ % 255 $ + 1)" >> +export MALLOC_PERTURB_ >> >> echo "Running ${SCRIPT} for ${BACKEND}..." >> while [ $COUNTER -le $LOOP ]; do >> -- >> 1.7.11.rc1 >> >> >> >> >> >> > > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > -- Inviato dal mio dispositivo mobile

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by masarati＠aero.polimi.it 11 Oct '12

11 Oct '12

These vars can be set directly from the test environment, no need to modify the test scripts. p. > Full_Name: Elia Pinto > Version: 2.4 master > OS: Linux FC12 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (2605:4400:1:781:216:3eff:fe31:f4d4) > > >>From a8ff21429c29f1d2b6ef8f58ec84b7a9036cea73 Mon Sep 17 00:00:00 2001 > From: Elia Pinto <gitter.spiros(a)gmail.com> > Date: Thu, 11 Oct 2012 17:49:06 +0200 > Subject: [PATCH] Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the > test > suite for detecting heap corruption > > Recent versions of Linux libc (later than 5.4.23) and glibc (2.x) > include a malloc() implementation which is tunable via environment > variables. When MALLOC_CHECK_ is set, a special (less efficient) > implementation is used which is designed to be tolerant against > simple errors, such as double calls of free() with the same argument, > or overruns of a single byte (off-by-one bugs). When MALLOC_CHECK_ > is set to 3, a diagnostic message is printed on stderr > and the program is aborted. > > Setting the MALLOC_PERTURB_ environment variable causes the malloc > functions in libc to return memory which has been wiped and clear > memory when it is returned. > Of course this does not affect calloc which always does clear the memory. > > The reason for this exercise is, of course, to find code which uses > memory returned by malloc without initializing it and code which uses > code after it is freed. valgrind can do this but it's costly to run. > The MALLOC_PERTURB_ exchanges the ability to detect problems in 100% > of the cases with speed. > > The byte value used to initialize values returned by malloc is the byte > value of the environment value. The value used to clear memory is the > bitwise inverse. Setting MALLOC_PERTURB_ to zero disables the feature. > > This technique can find hard to detect bugs. > It is therefore suggested to always use this flag (at least temporarily) > when testing out code or a new distribution. > > Signed-off-by: Elia Pinto <gitter.spiros(a)gmail.com> > --- > tests/run.in | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/tests/run.in b/tests/run.in > index 5e6178b..fe25d0c 100644 > --- a/tests/run.in > +++ b/tests/run.in > @@ -241,6 +241,11 @@ fi > > # disable LDAP initialization > LDAPNOINIT=true; export LDAPNOINIT > +# Add libc malloc_check and MALLOC_PERTURB test > +MALLOC_CHECK_=3 > +export MALLOC_CHECK_ > +MALLOC_PERTURB_="$( expr $ $$ % 255 $ + 1)" > +export MALLOC_PERTURB_ > > echo "Running ${SCRIPT} for ${BACKEND}..." > while [ $COUNTER -le $LOOP ]; do > -- > 1.7.11.rc1 > > > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by gitter.spiros＠gmail.com 11 Oct '12

11 Oct '12

You can also pull from git://github.com/devzero2000/openldap.git 2012/10/11 <openldap-its(a)openldap.org>: > > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** > > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7415. > > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. > > If you need to provide additional information in regards to your > issue report, you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7415) > in the subject will automatically be attached to the issue report. > > mailto:openldap-its@openldap.org?subject=(ITS#7415) > > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=7415 > > Please remember to retain your issue tracking number (ITS#7415) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. > > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. > > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ > > -------------- > Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved. >

1 0

(ITS#7415) Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption
by gitter.spiros＠gmail.com 11 Oct '12

11 Oct '12

Full_Name: Elia Pinto Version: 2.4 master OS: Linux FC12 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2605:4400:1:781:216:3eff:fe31:f4d4) >From a8ff21429c29f1d2b6ef8f58ec84b7a9036cea73 Mon Sep 17 00:00:00 2001 From: Elia Pinto <gitter.spiros(a)gmail.com> Date: Thu, 11 Oct 2012 17:49:06 +0200 Subject: [PATCH] Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption Recent versions of Linux libc (later than 5.4.23) and glibc (2.x) include a malloc() implementation which is tunable via environment variables. When MALLOC_CHECK_ is set, a special (less efficient) implementation is used which is designed to be tolerant against simple errors, such as double calls of free() with the same argument, or overruns of a single byte (off-by-one bugs). When MALLOC_CHECK_ is set to 3, a diagnostic message is printed on stderr and the program is aborted. Setting the MALLOC_PERTURB_ environment variable causes the malloc functions in libc to return memory which has been wiped and clear memory when it is returned. Of course this does not affect calloc which always does clear the memory. The reason for this exercise is, of course, to find code which uses memory returned by malloc without initializing it and code which uses code after it is freed. valgrind can do this but it's costly to run. The MALLOC_PERTURB_ exchanges the ability to detect problems in 100% of the cases with speed. The byte value used to initialize values returned by malloc is the byte value of the environment value. The value used to clear memory is the bitwise inverse. Setting MALLOC_PERTURB_ to zero disables the feature. This technique can find hard to detect bugs. It is therefore suggested to always use this flag (at least temporarily) when testing out code or a new distribution. Signed-off-by: Elia Pinto <gitter.spiros(a)gmail.com> --- tests/run.in | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/run.in b/tests/run.in index 5e6178b..fe25d0c 100644 --- a/tests/run.in +++ b/tests/run.in @@ -241,6 +241,11 @@ fi # disable LDAP initialization LDAPNOINIT=true; export LDAPNOINIT +# Add libc malloc_check and MALLOC_PERTURB test +MALLOC_CHECK_=3 +export MALLOC_CHECK_ +MALLOC_PERTURB_="$( expr $ $$ % 255 $ + 1)" +export MALLOC_PERTURB_ echo "Running ${SCRIPT} for ${BACKEND}..." while [ $COUNTER -le $LOOP ]; do -- 1.7.11.rc1

1 0

Re: (ITS#7414) rwm: ldapmodify, slapd segmentation fault
by hyc＠symas.com 11 Oct '12

11 Oct '12

jvcelak(a)redhat.com wrote: > Full_Name: Jan Vcelak > Version: 2.4.33 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (209.132.186.34) > > > Hello, > > it is possible to crash slapd in certain configuration with rwm overlay enabled, > using specific ldapmodify. This problem seems to be present for a very long > time. > > Configuration used (slapd.ldif): > > dn: cn=config > objectClass: olcGlobal > cn: config > olcArgsFile: /var/run/openldap/slapd.args > olcPidFile: /var/run/openldap/slapd.pid > > dn: cn=module,cn=config > objectClass: olcModuleList > cn: module > olcModulepath: /usr/lib64/openldap > olcModuleload: rwm.la > > dn: cn=schema,cn=config > objectClass: olcSchemaConfig > cn: schema > > include: file:///etc/openldap/schema/core.ldif > include: file:///etc/openldap/schema/cosine.ldif > include: file:///etc/openldap/schema/inetorgperson.ldif > > dn: olcDatabase=frontend,cn=config > objectClass: olcDatabaseConfig > olcDatabase: frontend > > dn: olcDatabase=hdb,cn=config > objectClass: olcDatabaseConfig > objectClass: olcHdbConfig > olcDatabase: hdb > olcSuffix: dc=my-domain,dc=com > olcRootDN: cn=Manager,dc=my-domain,dc=com > olcRootPW: secret > olcDbDirectory: /var/lib/ldap > olcDbIndex: objectClass eq,pres > olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub > > dn: olcOverlay=rwm,olcDatabase={1}hdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcRwmConfig > olcOverlay: rwm > olcRwmRewrite: {0}rwm-rewriteEngine "on" > olcRwmRewrite: {1}rwm-rewriteContext "bindDN" > olcRwmRewrite: {2}rwm-rewriteRule "cn=([a-z]+),ou=People,dc=my-domain,dc=com" > "uid=$1,ou=People,dc=my-domain,dc=com" > > > Set up and start the server. Add the initial data: > > dn: dc=my-domain,dc=com > objectClass: dcObject > objectClass: organizationalUnit > description: Root LDAP entry > dc: my-domain > ou: rootobject > > dn: cn=Manager,dc=my-domain,dc=com > objectClass: organizationalRole > cn: Manager > > dn: ou=People,dc=my-domain,dc=com > objectClass: top > objectClass: organizationalunit > ou: People > > dn: cn=test1,ou=People,dc=my-domain,dc=com > objectClass: inetOrgPerson > cn: test1 > sn: test > > > Perform following modify operation: > > dn: cn=test1,ou=People,dc=my-domain,dc=com > changetype: modrdn > newrdn: cn=test2 > deleteoldrdn: 1 > newsuperior: ou=People,dc=my-domain,dc=com > > > The slapd daemon will crash, here is the full backtrace: Thanks for the detailed report. Fixed now in master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7413) Some UTF-8 characters are wrongly recognized as identical in multi-valued attributes
by michail.bachmann＠cms.hu-berlin.de 11 Oct '12

11 Oct '12

--nextPart1483759.4qzvGhZdbd Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable On Thursday 11 October 2012, Howard Chu wrote: > m.bachmann(a)cms.hu-berlin.de wrote: > > Full_Name: Michail Bachmann > > Version: 2.4.31 > > OS: Linux > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (141.20.3.158) > > > > > > > > The UTF-8 character 'FEMININE ORDINAL INDICATOR' (U+00AA) is wrongly tr= eated as > > 'LATIN SMALL LETTER A' (U+0061), so adding a multi-valued attribute whe= re U+00AA > > is replaced with U+0061 (or the other way around) fails: >=20 > This works as designed. See the Unicode specification, rules for decompos= ition. Ah, ok. Thank you for your time and sorry for the noise. > > > > $ ldapadd -f create.ldif -h localhost -D 'cn=3Dadmin,dc=3Dexample,dc=3D= com' > > > > ### create.ldif ### > > dn: cn=3Dtest,dc=3Dexample,dc=3Dcom > > objectClass: organizationalRole > > objectClass: top > > cn: test > > street: a street > > ### /create.ldif ### > > > > $ ldapmodify -f modify.ldif -h localhost -D 'cn=3Dadmin,dc=3Dexample,dc= =3Dcom' > > > > ### modify.ldif ### > > dn: cn=3Dtest,dc=3Dexample,dc=3Dcom > > changetype: modify > > add: street > > street: =C2=AA street > > - > > > > ### /modify.ldif ### > > > > will result in > > > > ldap_modify: Type or value exists (20) > > additional info: modify/add: street: value #0 already exists > > > > It seems like U+00AA is decomposed into '<super>+U+0061' and then the '= <super>' > > part is discarded. > > > > Tested with 2.4.31 (Debian) and 2.4.21 (Ubuntu) > > > > > > >=20 >=20 >=20 --nextPart1483759.4qzvGhZdbd Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOYTCCBCEw ggMJoAMCAQICAgDHMA0GCSqGSIb3DQEBBQUAMHExCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNEZXV0 c2NoZSBUZWxla29tIEFHMR8wHQYDVQQLExZULVRlbGVTZWMgVHJ1c3QgQ2VudGVyMSMwIQYDVQQD ExpEZXV0c2NoZSBUZWxla29tIFJvb3QgQ0EgMjAeFw0wNjEyMTkxMDI5MDBaFw0xOTA2MzAyMzU5 MDBaMFoxCzAJBgNVBAYTAkRFMRMwEQYDVQQKEwpERk4tVmVyZWluMRAwDgYDVQQLEwdERk4tUEtJ MSQwIgYDVQQDExtERk4tVmVyZWluIFBDQSBHbG9iYWwgLSBHMDEwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDpm8NnhfkNrvWNVMOWUDU9YuluTO2U1wBblSJ01CDrNI/W7MAxBAuZgeKm FNJSoCgjhIt0iQReW+DieMF4yxbLKDU5ey2QRdDtoAB6fL9KDhsAw4bpXCsxEXsM84IkQ4wcOItq aACa7txPeKvSxhObdq3u3ibo7wGvdA/BCaL2a869080UME/15eOkyGKbghoDJzANAmVgTe3RCSMq ljVYJ9N2xnG2kB3E7f81hn1vM7PbD8URwoqDoZRdQWvY0hD1TP3KUazZve+Sg7va64sWVlZDz+HV Ez2mHycwzUlU28kTNJpxdcVs6qcLmPkhnSevPqM5OUhqjK3JmfvDEvK9AgMBAAGjgdkwgdYwcAYD VR0fBGkwZzBloGOgYYZfaHR0cDovL3BraS50ZWxlc2VjLmRlL2NnaS1iaW4vc2VydmljZS9hZl9E b3dubG9hZEFSTC5jcmw/LWNybF9mb3JtYXQ9WF81MDkmLWlzc3Vlcj1EVF9ST09UX0NBXzIwHQYD VR0OBBYEFEm3xs/oPR9/6kR7Eyn38QpwPt5kMB8GA1UdIwQYMBaAFDHDeRu69VPXF+CJei0XbAqz K50zMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgECMA0GCSqGSIb3DQEBBQUAA4IB AQA74Vp3wEgX3KkY7IGvWonwvSiSpspZGBJw7Cjy565/lizn8l0ZMfYTK3S9vYCyufdnyTmieTvh ERHua3iRM347XyYndVNljjNj7s9zw7CSI0khUHUjoR8Y4pSFPT8z6XcgjaK95qGFKUD2P3MyWA0J a6bahWzAP7uNZmRWJE6uDT8yNQFb6YyC2XJZT7GGhfF0hVblw/hc843uR7NTBXDn5U2KaYMo4RMJ hp5eyOpYHgwf+aTUWgRo/Sg+iwK2WLX2oSw3VwBnqyNojWOl75lrXP1LVvarQIc01BGSbOyHxQoL BzNytG8MHVQs2FHHzL8w00Ny8TK/jM5JY6gA9/IcMIIE9DCCA9ygAwIBAgIEC2I0jzANBgkqhkiG 9w0BAQUFADBaMQswCQYDVQQGEwJERTETMBEGA1UEChMKREZOLVZlcmVpbjEQMA4GA1UECxMHREZO LVBLSTEkMCIGA1UEAxMbREZOLVZlcmVpbiBQQ0EgR2xvYmFsIC0gRzAxMB4XDTA3MTEyMDEwMjky MVoXDTE5MDYzMDAwMDAwMFowaDELMAkGA1UEBhMCREUxKDAmBgNVBAoTH0h1bWJvbGR0LVVuaXZl cnNpdGFldCB6dSBCZXJsaW4xDjAMBgNVBAMTBUhVLUNBMR8wHQYJKoZIhvcNAQkBFhBwa2lAaHUt YmVybGluLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6wxB17AojABvR7rEkR8v 3wfquJ1RAGBx9Bhv0pQis98kCJaaYYO1cspc0znfEAOcBk9lBhb/sWfV13KFKDcib7WlY1sFBHCJ AbGkpcNTfqp/enTtDZOzXFUzXOj5+lcaHwn6qt2HQ7oafm8wfPp9efd3ykRzCWhbZ7K3o/kCCMHw 5Dxe9na4OdQCXqwp6Hhpmx9CGHq2SPWxrRZqdZJzmfhmDV3yVYghIuyHN/jDTorshki3pWF3OFHp ok1w09LKPDUZRdHZzUt7ZIZYEwdvjVAKJAsHyKjzrASRfHJgXvJQLENcBJwPGXfJGMSXj3AcS9Cj wQdtMlyDsU4D5RV4BQIDAQABo4IBsjCCAa4wEgYDVR0TAQH/BAgwBgEB/wIBATALBgNVHQ8EBAMC AQYwHQYDVR0OBBYEFB/1LD73QKsukKBq0+J5XvJ2zYN0MB8GA1UdIwQYMBaAFEm3xs/oPR9/6kR7 Eyn38QpwPt5kMBsGA1UdEQQUMBKBEHBraUBodS1iZXJsaW4uZGUwgYgGA1UdHwSBgDB+MD2gO6A5 hjdodHRwOi8vY2RwMS5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jcmwvY2FjcmwuY3Js MD2gO6A5hjdodHRwOi8vY2RwMi5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jcmwvY2Fj cmwuY3JsMIGiBggrBgEFBQcBAQSBlTCBkjBHBggrBgEFBQcwAoY7aHR0cDovL2NkcDEucGNhLmRm bi5kZS9nbG9iYWwtcm9vdC1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQwRwYIKwYBBQUHMAKGO2h0 dHA6Ly9jZHAyLnBjYS5kZm4uZGUvZ2xvYmFsLXJvb3QtY2EvcHViL2NhY2VydC9jYWNlcnQuY3J0 MA0GCSqGSIb3DQEBBQUAA4IBAQBO3AOzYN+zVEPJLJHP12+Oa7wzhC2aji1SGLkPHqYnl27d2+Fx XgOo24p+rC7vS53tLGjE41EfkwEgO+cy4J9mUptTlDqa3gvzkR8C95Yl43fmYd5HJrZ+WqQTVddw hxnOBCY0f+oW+RmeybR6TYDAQ+ByK6ru6DFPBRQpIejuny75jjm0EZzcPwZZJ+gxObQ67RtMxiFk 6Io6jWRdpy40mDJ39NF1tJqAFxo+3hSKVRTVs1l/ML12lLmTq+tgri9bLBEQLwNoaCjGhn2aOMYJ B0Rd5a31pbiXEZLV4IBylWd5/y3Nfb9q3x+i1lXI05u+oJ3q9ox4PbuuKU3VWIngMIIFQDCCBCig AwIBAgIHE9HfrnKfDDANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJERTEoMCYGA1UEChMfSHVt Ym9sZHQtVW5pdmVyc2l0YWV0IHp1IEJlcmxpbjEOMAwGA1UEAxMFSFUtQ0ExHzAdBgkqhkiG9w0B CQEWEHBraUBodS1iZXJsaW4uZGUwHhcNMTIwNTE1MTQwMzEwWhcNMTUwNTE1MTQwMzEwWjBnMQsw CQYDVQQGEwJERTEoMCYGA1UEChMfSHVtYm9sZHQtVW5pdmVyc2l0YWV0IHp1IEJlcmxpbjETMBEG A1UECxMKQ01TL0FidC4gMTEZMBcGA1UEAxMQTWljaGFpbCBCYWNobWFubjCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBANiS1EZ9eoDkVZnlHdoqGKJD6WNnV16udnQKT7j5yHTRo5XnF7LB 3nagMKWopr84yVnqRnRay3O2IhmHsscAisJ4uENXeVed5g9QVBGAKUmUAy3jgcKXJ84PJNYXMy93 YN3tzi2VKwwbpM4pBDfC4FT2V4jsb1jynwH5ayoKpbt8d7oggwL3xr/l90h8gJoNW5LFcIgBKDll tWaHSHqytquHn859eNNxTDntFbgTgh9RGLaI6Kp+P9XBqrqLFX1ebWe24/MSHw6B2Pw2ny/Vy54A e3W/7FSxpLDCKllQiSbgqG5eyUWEsTOAG41D4Z56AHKcx8byks8j+A6E1xpCWfMCAwEAAaOCAe4w ggHqMBwGA1UdIAQVMBMwEQYPKwYBBAGBrSGCLAEBBAICMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXg MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQUALsSnuznKfPHjGGxfAJr jZmz544wHwYDVR0jBBgwFoAUH/UsPvdAqy6QoGrT4nle8nbNg3QwLAYDVR0RBCUwI4EhbWljaGFp bC5iYWNobWFubkBjbXMuaHUtYmVybGluLmRlMIGDBgNVHR8EfDB6MDugOaA3hjVodHRwOi8vY2Rw MS5wY2EuZGZuLmRlL2h1LWJlcmxpbi1jYS9wdWIvY3JsL2NhY3JsLmNybDA7oDmgN4Y1aHR0cDov L2NkcDIucGNhLmRmbi5kZS9odS1iZXJsaW4tY2EvcHViL2NybC9jYWNybC5jcmwwgZ4GCCsGAQUF BwEBBIGRMIGOMEUGCCsGAQUFBzAChjlodHRwOi8vY2RwMS5wY2EuZGZuLmRlL2h1LWJlcmxpbi1j YS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQwRQYIKwYBBQUHMAKGOWh0dHA6Ly9jZHAyLnBjYS5kZm4u ZGUvaHUtYmVybGluLWNhL3B1Yi9jYWNlcnQvY2FjZXJ0LmNydDANBgkqhkiG9w0BAQUFAAOCAQEA GrSDIsaKf9b6gt658mbHwV4bMO+YvsqpX8x/vQxRnAp7DvpLiHbAawWlDcOPKqkccmk6egUUeoMQ GICvA3FjCAJlWdNc3/A9ec1yWD2XEH56/uXWkf3Nny7SqnvMJRxPkwjidc/WP5xmuvsQScDm7Je2 jasRmvS5TFBVjNb/yEI56xBGCr1J+s3WeR8ILHsMXvP8ll9rRXI3GQHqx7jhw0FOFjuXKNdzBgLI 1DMcrAqQZeA8tyQxO0zCe53hHTCoJp3fYxYD5EDT8pM7X0woSdOKUmKl4ezUBNizYW55vx10IbFF j2VTQnTs3fCgRMyMH4dAm0DBeejarZDbKobPxTGCAiQwggIgAgEBMHMwaDELMAkGA1UEBhMCREUx KDAmBgNVBAoTH0h1bWJvbGR0LVVuaXZlcnNpdGFldCB6dSBCZXJsaW4xDjAMBgNVBAMTBUhVLUNB MR8wHQYJKoZIhvcNAQkBFhBwa2lAaHUtYmVybGluLmRlAgcT0d+ucp8MMAkGBSsOAwIaBQCggYcw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMDExMTQyMzQzWjAj BgkqhkiG9w0BCQQxFgQUvEheLrh+IXZtXeaWZ0lHReCaO/MwKAYJKoZIhvcNAQkPMRswGTALBglg hkgBZQMEAQIwCgYIKoZIhvcNAwcwDQYJKoZIhvcNAQEBBQAEggEAGUem6qtixM8FdGDrjHhOypJh sbIYybMQMw5UKtWqVkne4VuLIVru8PWqh88D1uW/zpB3I0gZwhlDfiM/2tykwvNUDRAU1BAi19M3 XI8xVt0zi62uAbpD7QeEdbFwGry/7Tz5kgYp1DCjSfSni9FNT2NZVRPe749HhR89SHmUi1SwjDli LTGTur8KWnnWvJIIK7g5GCzPNpV1zeB6PiBTY5nr9w05Ro/mUgrrPlz4StsOY9eiPhRuEeAbXrnb 4zVnksaDExLf4QyKD3ikK4tadvfVO5Lph4XJySeHE/MiMRRI4gAekLvWZgdLMqeo6xM2nf52+vX6 UefhhpBc5gvH/QAAAAAAAA== --nextPart1483759.4qzvGhZdbd--

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs