- openldap-bugs - openldap.org

(ITS#6963) test050: test failed - server 1 and server 2 configs differ
by michael＠stroeder.com 04 Jun '11

04 Jun '11

Full_Name: Version: OS: URL: Submission from: (NULL) (84.163.63.172) test050 occasionally fails... $ ./run -l 100 -b bdb test050 [..] Cleaning up test run directory from this run. Running 19 of 100 iterations running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... Waiting 15 seconds for syncrepl to receive changes... Using ldapsearch to read config from server 1... Using ldapsearch to read config from server 2... Using ldapsearch to read config from server 3... Using ldapsearch to read config from server 4... Comparing retrieved configs from server 1 and server 2... test failed - server 1 and server 2 configs differ

1 0

Re: (ITS#6947) ldapadd crashes with LDIFs with invalid line termination
by jvcelak＠redhat.com 04 Jun '11

04 Jun '11

> > adding entries to LDAP database from file using ldapadd tool causes > > memory > > corruption error, when the last line of the input file is not > > terminated by '\n' > > character. > > Don't do that. I agree. But the tool should not crash on invalid output anyway. > > I am attaching proposed patch, which fixes this issue. > > The patch uses a GNU-specific function. Since GLIBC is not supported > on all of > the platforms OpenLDAP supports, the patch is not acceptable as-is. Sorry, I missed that. I will fix it and resend the patch. Jan

1 0

Re: (ITS#6946) ldapexop: ber_free_buf: Assertion failed
by hyc＠symas.com 03 Jun '11

03 Jun '11

jvcelak(a)redhat.com wrote: > Full_Name: Jan Vcelak > Version: 2.4.25 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/jvcelak-110519-ldapexop-double-free.patch > Submission from: (NULL) (209.132.186.34) > > > Hello. > > A problem with crashing ldapexop was reported to our bugzilla. All versions > since 2.4.24 are affected. It seems that the bug was introduced by following > change in ldapexop.c. > > http://www.openldap.org/devel/cvsweb.cgi/clients/tools/ldapexop.c.diff?r1=1… > > Easy to reproduce. With clean configuration run: > $ ldapexop -H ldap:// -x whoami > anonymous > ldapexop: ../../../libraries/liblber/io.c:186: ber_free_buf: Assertion > `((ber)->ber_opts.lbo_valid==0x2)' failed. > Aborted > > Complete steps to reproduce in Fedora are specified in the original bugreport: > https://bugzilla.redhat.com/show_bug.cgi?id=699683 > > I think it is cause by double freeing the result. I am attaching a proposed > patch. Please, review my change. > > Thank you. Thanks for the report, patch applied to git. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6947) ldapadd crashes with LDIFs with invalid line termination
by hyc＠symas.com 03 Jun '11

03 Jun '11

jvcelak(a)redhat.com wrote: > Full_Name: Jan Vcelak > Version: 2.4.25 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/jvcelak-20110519-ldif-countlines.patch > Submission from: (NULL) (209.132.186.34) > > > Hello, > > adding entries to LDAP database from file using ldapadd tool causes memory > corruption error, when the last line of the input file is not terminated by '\n' > character. Don't do that. The LDIF specification says that all LDIF elements are terminated by SEP (CR LF or LF). Anything not conforming to this is not valid LDIF. As usual, garbage-in-garbage-out. The entries are added correctly. > > All version since 2.4.23 are affected. > > $ cat>/tmp/input.ldif<< EOF >> dn: cn=A,dc=my-domain,dc=com >> objectClass: inetOrgPerson >> objectClass: organizationalPerson >> objectClass: person >> objectClass: top >> cn: A >> sn: A >> uid: A >> mail: A(a)example.com >> EOF > $ wc -c /tmp/input.ldif > 166 /tmp/input.ldif > $ truncate -s 165 /tmp/input.ldif > $ hexdump -c /tmp/input.ldif > 0000000 d n : c n = A , d c = m y - d > 0000010 o m a i n , d c = c o m \n o b j > 0000020 e c t C l a s s : i n e t O r > 0000030 g P e r s o n \n o b j e c t C l > 0000040 a s s : o r g a n i z a t i o > 0000050 n a l P e r s o n \n o b j e c t > 0000060 C l a s s : p e r s o n \n o b > 0000070 j e c t C l a s s : t o p \n c > 0000080 n : A \n s n : A \n u i d : > 0000090 A \n m a i l : A @ e x a m p l > 00000a0 e . c o m > 00000a5 > $ ldapadd -H ldap:// -D cn=Manager,dc=my-domain,dc=com -x -w password -f > /tmp/input.ldif > adding new entry "cn=A,dc=my-domain,dc=com" > > *** glibc detected *** ldapadd: free(): invalid pointer: 0x0000000001c435c8 *** > ======= Backtrace: ========= > /lib64/libc.so.6[0x3626e76d63] > ldapadd[0x404505] > /lib64/libc.so.6(__libc_start_main+0xfd)[0x3626e1ee5d] > ldapadd[0x4037e9] > ======= Memory map: ======== > ... > > I am attaching proposed patch, which fixes this issue. The patch uses a GNU-specific function. Since GLIBC is not supported on all of the platforms OpenLDAP supports, the patch is not acceptable as-is. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6831) Proxycache database corruption
by hyc＠symas.com 03 Jun '11

03 Jun '11

ryans(a)aweber.com wrote: > Some more information: once I changed the search base from ou=Users,dc=example,dc=com to dc=example,dc=com to "fix" the > problem for that particular user (after which the original query with the ou=Users,dc=example,dc=com search base began > working again), the following entries popped up in the log: > ftp://ftp.openldap.org/incoming/ryan-steele-110221.proxycache-log-fixing-br… > > It gets stranger, though. If I start out by using the root entry as the search base (dc=example,dc=com) with a user who > is not yet in the cache, not only will it say it is ANSWERABLE (which it clearly isn't) and then return nothing without > even trying to reach out to the upstream host, but if I then change the search base to ou=Users,dc=example,dc=com, I get > the following error on the CLI (and this is with a successful bind as the directory admin): > > > ldapsearch -x -D cn=admin,dc=example,dc=com -y /etc/ldap.secret -H ldaps://localhost -LLL -b cn=admin,dc=example,dc=com > '(&(|(objectClass=examplecomUtilityUser)(objectClass=examplecomEmployee))(uid=jdoe4))' uid > No such object (32) > Matched DN: dc=example,dc=com > > Debugging logs generated by that query can be found here: > ftp://ftp.openldap.org/incoming/ryan-steele-110221.proxycache-log-attempt-t… I'm not sure I reproduced all the behaviors you were seeing, but I've reproduced at least one of them and fixed it in git. Please pull the latest pcache.c and test, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6959) ldap_dnfree not mentioned anywhere
by hyc＠symas.com 03 Jun '11

03 Jun '11

frank.muzzulini(a)comsoft.aero wrote: > Full_Name: Frank Muzzulini > Version: 2.4.25 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (91.221.120.78) > > > Hi, > > Reading the documentation of ldap_str2dn I was wondering how to free the > allocated DN. After browsing for a while I loaded the latest tarball to see some > example code and found ldap_dnfree. > > I re-checked and indeed the function is not mentioned anywhere in the docs > ("find doc -type f | xargs grep ldap_dnfree" found nothing). Added to git, thanks for the report. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6958) slapd segmentation fault with TLSCRLCheck all
by Howard Chu 03 Jun '11

03 Jun '11

Can't reproduce this on Linux. Someone with a FreeBSD installation will have to investigate this.

1 0

Re: (ITS#6960) Out of memory erro occurs when running LDAP
by hyc＠symas.com 03 Jun '11

03 Jun '11

ArunPrasathSevugan(a)oracle.com wrote: > Full_Name: Arun Prasath > Version: 3 > OS: Window Xp > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (220.225.129.57) > > > Hi, > > We have a tool integrated with LDAP to load all the users in Cognos reporting. > There are about 5000+ users and while running LDAPCONFIG we have been getting > out of memory exception issue. > > In the task manage I could see the LDAP is using memory of around 3 GB and > finally errors out. > > Please help us to load the 5000+ users. It doesn't sound like you're using OpenLDAP. We have no LDAPCONFIG to run and we have no "Version 3" of our software. Please try contacting the actual vendor of your LDAP software. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6864) delta-sync - contextCSN not updating on provider
by hyc＠symas.com 03 Jun '11

03 Jun '11

yuribank(a)gmail.com wrote: > Full_Name: Yuri Bank > Version: 2.4.23-24 > OS: Linux Ubuntu 10.10 > URL: http://yuri.easytospell.net/consumer.provider.txt > Submission from: (NULL) (67.180.182.165) > > > This issue exists in both versions 2.4.23 and 2.4.24 > > I've found an interesting problem with delta-sync replication in which the > ContextCSN on my consumers is higher than the contextCSN on my provider. This is > because the Provider does not properly update its contextCSN for its base suffix > (dc=test,dc=com) when changes are made to group membership. Of couse, if it so > happens that the last change in my database was not a group membership change, > then the contextCSNs will be consistent between my consumers and provider. Sounds like this bug was introduced by patches for ITS#6766 or #6329. Both of those patches have been reverted for ITS#6915. This bug should be fixed in the current git HEAD. > > > I use the following command to check the ContextCSN on each consumer: > > Consumer: 1 > root@neteng1.oak:/etc/ldap# ldapsearch -Y EXTERNAL -H ldapi:/// -s base -b > "dc=test,dc=com" contextCSN dn: dc=test,dc=com > dn: dc=test,dc=com > contextCSN: 20110313041653.752098Z#000000#000#000000 > > Consumer: 2 > ybank@neteng1.iad:~$ ldapsearch -Y EXTERNAL -H ldapi:/// -s base -b > "dc=test,dc=com" contextCSN dn: dc=test,dc=com > dn: dc=test,dc=com > contextCSN: 20110313041653.752098Z#000000#000#000000 > > So we can see that the two consumers have matching contextCSNs: > ContextCSN. 20110313041653.752098Z#000000#000#000000 > > Lets check the Provider now. > > Provider: > root@neteng0.iad:~# ldapsearch -Y EXTERNAL -H ldapi:/// -s base -b > "dc=test,dc=com" ContextCSN dn: dc=test,dc=com > dn: dc=test,dc=com > contextCSN: 20110313041653.709140Z#000000#000#000000 > > The providers CSN is smaller!? > > Lets take a closer look and search cn=accesslog > > These are the last two entries: ( first the user was added, and then the user > was added to a group) > > # 20110313041653.000003Z, accesslog > dn: reqStart=20110313041653.000003Z,cn=accesslog > objectClass: auditAdd > reqStart: 20110313041653.000003Z > reqEnd: 20110313041653.000004Z > reqType: add > reqSession: 34633 > reqAuthzID: cn=admin,dc=test,dc=com > reqDN: cn=Bank\2C Yuri(banky),o=UserAccounts,dc=test,dc=com > reqResult: 0 > reqMod: sn:+ Bank > reqMod: userPassword:+ {SASL}banky > reqMod: uid:+ banky > reqMod: objectClass:+ top > reqMod: objectClass:+ person > reqMod: objectClass:+ shadowAccount > reqMod: structuralObjectClass:+ person > reqMod: cn:+ Bank, Yuri(banky) > reqMod: entryUUID:+ 78a75ef6-e174-102f-9571-ffecbfef68e5 > reqMod: creatorsName:+ cn=admin,dc=test,dc=com > reqMod: createTimestamp:+ 20110313041653Z > reqMod: entryCSN:+ 20110313041653.709140Z#000000#000#000000 > reqMod: modifiersName:+ cn=admin,dc=test,dc=com > reqMod: modifyTimestamp:+ 20110313041653Z > > # 20110313041653.000006Z, accesslog > dn: reqStart=20110313041653.000006Z,cn=accesslog > objectClass: auditModify > reqStart: 20110313041653.000006Z > reqEnd: 20110313041653.000007Z > reqType: modify > reqSession: 34633 > reqAuthzID: cn=admin,dc=test,dc=com > reqDN: cn=SSLVPN,o=Groups,dc=test,dc=com > reqResult: 0 > reqMod: member:+ cn=Bank\2C Yuri(banky),o=UserAccounts,dc=test,dc=com > reqMod: entryCSN:= 20110313041653.752098Z#000000#000#000000 > reqMod: modifiersName:= cn=admin,dc=test,dc=com > reqMod: modifyTimestamp:= 20110313041653Z > > You can see that the consumers have the latest entryCSN (20110313041653.752098Z) > as their contextCSN, but the provider has the entryCSN (20110313041653.709140Z) > before that as its contextCSN: > > If I search the contextCSN on -s base -b cn=accesslog it yields correctly, the > same result as the consumers: > 20110313041653.752098Z#000000#000#000000 > > > As you can see, the provider is not using the latest entryCSN as its ContextCSN, > where as the consumer nodes are. Also notice that the last modification was to > group membership. This problem only seems to exist when Adding/Removing users > from a group. > > A side effect of this issue causes brand new consumers to get stuck in an > infinite loop while syncing for the first time. > > A work around is to make a random change to a User/Person, such as injecting a > random number into their description field AFTER making a change to a group > membership. Such a change will: A. cause the Provider to correctly update its > contextCSN, B. provider and all consumer[s] will have the same contextCSN C. > brand new consumers can be added without getting stuck in an infinite loop when > syncing the database. ( they seem to get stuck on the last entry which makes > sense if the last entry has a higher entryCSN than that of the Providers > contextCSN? ) > > Confgiuration: ( See URL ) > http://yuri.easytospell.net/consumer.provider.txt > > Overlays: > syncprov > accesslog > memberof > > > Please feel free to email me about reproducing this problem. I have a lab with > various configurations and would be happy to give access to anyone interested. > > - Yuri Bank > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6962) Download down?
by h.b.furuseth＠usit.uio.no 03 Jun '11

03 Jun '11

demian.djrn(a)gmail.com writes: > all mirrors are down, i can't download the program. The mirror list needs to be updated. These are down or obsolete: Costa Rica: No /openldap directory. Italy: Unknown host it.openldap.org. Korea: No route to host ftp.holywar.net; TTL exceeded. Portugal: Last update was in 2008. The others work for me. -- Hallvard

1 0

Re: (ITS#6883) Improved Makefiles for contrib modules
by bgmilne＠staff.telkomsa.net 03 Jun '11

03 Jun '11

--Boundary-00=_50J6N9eQwpy3uQe Content-Type: Text/Plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit On Tuesday, 29 March 2011 21:20:53 quanah(a)zimbra.com wrote: > --On Tuesday, March 29, 2011 3:25 PM +0000 bgmilne(a)staff.telkomsa.net wrote: > > Full_Name: Buchan Milne > > Version: 2.4.25 > > OS: Linux > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (196.25.124.16) > > > > > > While the code in contrib is not supported, some overlays provide make > > files, some don't, and there were variations in a lot of the make files > > (e.g. use of DESTDIR or not). > > > > In order to add make files for overlays that don't have them, improve the > > consistency of the make files between overlays that had them, and to > > provide some basic sanity testing in a 'test' target, I have created the > > patch at: > > http://svn.mandriva.com/cgi-bin/viewvc.cgi/packages/cooker/openldap/curre > > nt/SOURCES/openldap-2.4.25-contrib-makefiles-with-tests.patch?revision=64 > > 8744&view=markup > > > > The patch is against 2.4.25, but should apply to master (except that > > there two additional overlays are present in master). Where feasible I > > have retained the majority of an existing make file, in other cases, > > where modifications would exceed the original content, I have replaced > > existing make files wholesale. > > > > The attached patch file is derived from OpenLDAP Software. All of the > > modifications to OpenLDAP Software represented in the following patch(es) > > were developed by Buchan Milne (bgmilne(a)staff.telkomsa.net). I have not > > assigned rights and/or interest in this work to any party. > > Hi Buchan, > > Can you make the patch available via git-format-patch? Please find it attached. Regards, Buchan --Boundary-00=_50J6N9eQwpy3uQe Content-Type: text/x-patch; charset="UTF-8"; name="0001-Fix-contrib-Makefiles-to-use-libtool-and-be-consiste.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0001-Fix-contrib-Makefiles-to-use-libtool-and-be-consiste.patch" =46rom 168ed0544cfd529c8bdff1e5366c1bc60477b1cb Mon Sep 17 00:00:00 2001 =46rom: Buchan Milne <bgmilne(a)staff.telkomsa.net> Date: Fri, 3 Jun 2011 10:18:39 +0200 Subject: [PATCH] Fix contrib Makefiles to use libtool and be consistent (IT= S#6883) This makes existing Makefiles provided with contrib modules more consistent, using libtool for compiling and linking. A trivial test target has also been added, which tests that the module can be loaded. Existing Makefiles were consulted, but were mainly copied from the first working/tested Makefile. As such, any pre-existing copyright notices have been replaced. Makefiles are also provided for all the contrib modules that did not have Makefiles. =2D-- contrib/slapd-modules/acl/Makefile | 48 +++++++++++++++ contrib/slapd-modules/addpartial/Makefile | 50 ++++++++++++++--- contrib/slapd-modules/allop/Makefile | 47 +++++++++++++++ contrib/slapd-modules/allowed/Makefile | 58 ++++++++++--------- contrib/slapd-modules/autogroup/Makefile | 36 +++++++++--- contrib/slapd-modules/cloak/Makefile | 43 ++++++++++++-- contrib/slapd-modules/denyop/Makefile | 48 +++++++++++++++ contrib/slapd-modules/dsaschema/Makefile | 47 +++++++++++++++ contrib/slapd-modules/dupent/Makefile | 58 +++++++++---------- contrib/slapd-modules/kinit/Makefile | 47 +++++++++++++++ contrib/slapd-modules/lastbind/Makefile | 32 +++++++--- contrib/slapd-modules/lastmod/Makefile | 48 +++++++++++++++ contrib/slapd-modules/noopsrch/Makefile | 58 +++++++++---------- contrib/slapd-modules/nops/Makefile | 47 ++++++++++++---- contrib/slapd-modules/nssov/Makefile | 13 ++++- contrib/slapd-modules/passwd/Makefile | 86 +++++++++++++++---------= =2D--- contrib/slapd-modules/passwd/sha2/Makefile | 48 +++++++++++++--- contrib/slapd-modules/trace/Makefile | 48 +++++++++++++++ 18 files changed, 680 insertions(+), 182 deletions(-) create mode 100644 contrib/slapd-modules/acl/Makefile create mode 100644 contrib/slapd-modules/allop/Makefile create mode 100644 contrib/slapd-modules/denyop/Makefile create mode 100644 contrib/slapd-modules/dsaschema/Makefile create mode 100644 contrib/slapd-modules/kinit/Makefile create mode 100644 contrib/slapd-modules/lastmod/Makefile create mode 100644 contrib/slapd-modules/trace/Makefile diff --git a/contrib/slapd-modules/acl/Makefile b/contrib/slapd-modules/acl= /Makefile new file mode 100644 index 0000000..9f48c0d =2D-- /dev/null +++ b/contrib/slapd-modules/acl/Makefile @@ -0,0 +1,48 @@ +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +CPPFLAGS+=3D-DSLAPD_OVER_ACL=3DSLAPD_MOD_DYNAMIC +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: posixgroup.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< + +clean: + rm -rf *.lo *.la *.o .libs/ + +install: posixgroup.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: posixgroup.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/addpartial/Makefile b/contrib/slapd-modu= les/addpartial/Makefile index 3b68815..2f1fd31 100644 =2D-- a/contrib/slapd-modules/addpartial/Makefile +++ b/contrib/slapd-modules/addpartial/Makefile @@ -1,13 +1,47 @@ # $OpenLDAP$ =2DOPENLDAP_SRC=3D../../.. =2DOPENLDAP_BLD=3D../../.. =2DCPPFLAGS+=3D-I${OPENLDAP_SRC}/include -I${OPENLDAP_SRC}/servers/slapd -I= ${OPENLDAP_BLD}/include =2DCC=3Dgcc +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. =20 =2Dall: addpartial-overlay.so +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +LIBTOOL=3D../../../libtool =20 =2Daddpartial-overlay.so: addpartial-overlay.c =2D $(CC) -shared $(CPPFLAGS) $(LDFLAGS) -Wall -o $@ $? +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: addpartial.la + +%.lo: addpartial-overlay.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< -o addpartial.lo + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm addpartial-overlay.so + rm -rf *.lo *.la *.o .libs/ + +install: addpartial.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: addpartial.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/allop/Makefile b/contrib/slapd-modules/a= llop/Makefile new file mode 100644 index 0000000..a995e61 =2D-- /dev/null +++ b/contrib/slapd-modules/allop/Makefile @@ -0,0 +1,47 @@ +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: allop.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< + +clean: + rm -rf *.lo *.la *.o .libs/ + +install: allop.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: allop.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/allowed/Makefile b/contrib/slapd-modules= /allowed/Makefile index 8f5be91..75e63c1 100644 =2D-- a/contrib/slapd-modules/allowed/Makefile +++ b/contrib/slapd-modules/allowed/Makefile @@ -1,8 +1,6 @@ =2D# $OpenLDAP$ =2D# This work is part of OpenLDAP Software <http://www.openldap.org/>. =2D# =2D# Copyright 1998-2011 The OpenLDAP Foundation. =2D# Copyright 2004 Howard Chu, Symas Corp. All Rights Reserved. +# $$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted only as authorized by the OpenLDAP @@ -12,35 +10,39 @@ # top-level directory of the distribution or, alternatively, at # <http://www.OpenLDAP.org/license.html>. =20 =2DPREFIX=3D/opt/openldap-HEAD =2D +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +CPPFLAGS+=3D-DSLAPD_OVER_ALLOWED=3DSLAPD_MOD_DYNAMIC LIBTOOL=3D../../../libtool =2DOPT=3D-g -O2 =2DCC=3Dgcc =2D =2DDEFS=3D-DSLAPD_OVER_ALLOWED=3DSLAPD_MOD_DYNAMIC =2D =2DLDAP_INC=3D-I../../../include -I../../../servers/slapd =2DINCS=3D$(LDAP_INC) =2D =2DLDAP_LIB=3D-lldap_r -llber -L../../../lib =2DLDAP_LIB=3D =2DLIBS=3D$(LDAP_LIB) =20 =2Dall: allowed.la +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd =20 +all: allowed.la =20 =2Dallowed.lo: allowed.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(OPT) $(DEFS) $(INCS) -c $? +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< =20 =2Dallowed.la: allowed.lo =2D $(LIBTOOL) --mode=3Dlink $(CC) $(OPT) -version-info 0:0:0 \ =2D -rpath $(PREFIX)/lib -module -o $@ $? $(LIBS) +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm -f allowed.o allowed.lo allowed.la + rm -rf *.lo *.la *.o .libs/ =20 install: allowed.la =2D mkdir -p $(PREFIX)/libexec/openldap =2D $(LIBTOOL) --mode=3Dinstall cp allowed.la $(PREFIX)/libexec/openldap =2D $(LIBTOOL) --finish $(PREFIX)/libexec/openldap + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: allowed.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/autogroup/Makefile b/contrib/slapd-modul= es/autogroup/Makefile index 70146ac..4438cbf 100644 =2D-- a/contrib/slapd-modules/autogroup/Makefile +++ b/contrib/slapd-modules/autogroup/Makefile @@ -1,6 +1,17 @@ =2DLIBTOOL=3D../../../libtool +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. =20 =2DCPPFLAGS+=3D-I../../../include -I../../../servers/slapd +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +LIBTOOL=3D../../../libtool =20 ldap_subdir =3D openldap prefix=3D/usr/local @@ -8,20 +19,29 @@ exec_prefix =3D $(prefix) libdir =3D $(exec_prefix)/lib libexecdir =3D $(exec_prefix)/libexec moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd =20 all: autogroup.la =20 =2Dautogroup.lo: autogroup.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $? +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< =20 =2Dautogroup.la: autogroup.lo +%.la: %.lo $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(libdir) -module -o $@ $?=20 + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm -f autogroup.lo autogroup.la + rm -rf *.lo *.la *.o .libs/ =20 install: autogroup.la mkdir -p $(DESTDIR)$(moduledir) =2D $(LIBTOOL) --mode=3Dinstall cp autogroup.la $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: autogroup.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/cloak/Makefile b/contrib/slapd-modules/c= loak/Makefile index 4562fcb..d92ff8b 100644 =2D-- a/contrib/slapd-modules/cloak/Makefile +++ b/contrib/slapd-modules/cloak/Makefile @@ -1,17 +1,48 @@ # $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 CPPFLAGS+=3D-DSLAPD_OVER_CLOAK=3DSLAPD_MOD_DYNAMIC =2DLIBS=3D-lldap_r -llber -lcrypto LIBTOOL=3D../../../libtool =20 +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + all: cloak.la =20 =2Dcloak.lo: cloak.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -c $? +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< =20 =2Dcloak.la: cloak.lo +%.la: %.lo $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(PREFIX)/lib -module -o $@ $? $(LIBS) + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm cloak.lo cloak.la + rm -rf *.lo *.la *.o .libs/ + +install: cloak.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: cloak.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/denyop/Makefile b/contrib/slapd-modules/= denyop/Makefile new file mode 100644 index 0000000..711eee7 =2D-- /dev/null +++ b/contrib/slapd-modules/denyop/Makefile @@ -0,0 +1,48 @@ +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +CPPFLAGS+=3D-DSLAPD_OVER_DENYOP=3DSLAPD_MOD_DYNAMIC +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: denyop.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< + +clean: + rm -rf *.lo *.la *.o .libs/ + +install: denyop.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: denyop.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/dsaschema/Makefile b/contrib/slapd-modul= es/dsaschema/Makefile new file mode 100644 index 0000000..90f711e =2D-- /dev/null +++ b/contrib/slapd-modules/dsaschema/Makefile @@ -0,0 +1,47 @@ +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: dsaschema.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< + +clean: + rm -rf *.lo *.la *.o .libs/ + +install: dsaschema.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: dsaschema.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/dupent/Makefile b/contrib/slapd-modules/= dupent/Makefile index 54a69ce..c1e8997 100644 =2D-- a/contrib/slapd-modules/dupent/Makefile +++ b/contrib/slapd-modules/dupent/Makefile @@ -1,8 +1,6 @@ # $OpenLDAP$ =2D# This work is part of OpenLDAP Software <http://www.openldap.org/>. =2D# =2D# Copyright 1998-2011 The OpenLDAP Foundation. =2D# Copyright 2004 Howard Chu, Symas Corp. All Rights Reserved. +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted only as authorized by the OpenLDAP @@ -12,41 +10,39 @@ # top-level directory of the distribution or, alternatively, at # <http://www.OpenLDAP.org/license.html>. =20 +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +CPPFLAGS+=3D-DSLAPD_OVER_DUPENT=3DSLAPD_MOD_DYNAMIC -g -O2 LIBTOOL=3D../../../libtool =2DOPT=3D-DSLAPD_OVER_DUPENT=3D2 -g -O2 =2D#LIBTOOL=3D../../../../ldap-devel/libtool =2D#OPT=3D-DSLAPD_OVER_DUPENT=3D2 -g -O0 =2DCC=3Dgcc =2D =2DLDAP_INC=3D-I../../../include -I../../../servers/slapd =2D#LDAP_INC=3D-I../../../include -I../../../servers/slapd -I../../../../ld= ap-devel/include =2DINCS=3D$(LDAP_INC) =2D =2DLDAP_LIB=3D-lldap_r -llber =2DLIBS=3D$(LDAP_LIB) =20 +ldap_subdir =3D openldap prefix=3D/usr/local =2Dexec_prefix=3D$(prefix) =2Dldap_subdir=3D/openldap +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd =20 =2Dlibdir=3D$(exec_prefix)/lib =2Dlibexecdir=3D$(exec_prefix)/libexec =2Dmoduledir =3D $(libexecdir)$(ldap_subdir) +all: dupent.la =20 =2Dall: dupent.la +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< =20 =2D =2Ddupent.lo: dupent.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(OPT) $(DEFS) $(INCS) -c $? =2D =2Ddupent.la: dupent.lo =2D $(LIBTOOL) --mode=3Dlink $(CC) $(OPT) -version-info 0:0:0 \ =2D -rpath $(moduledir) -module -o $@ $? $(LIBS) +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm -f dupent.lo dupent.la + rm -rf *.lo *.la *.o .libs/ =20 install: dupent.la mkdir -p $(DESTDIR)$(moduledir) =2D $(LIBTOOL) --mode=3Dinstall cp dupent.la $(DESTDIR)$(moduledir) =2D + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: dupent.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/kinit/Makefile b/contrib/slapd-modules/k= init/Makefile new file mode 100644 index 0000000..750c7b9 =2D-- /dev/null +++ b/contrib/slapd-modules/kinit/Makefile @@ -0,0 +1,47 @@ +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: kinit.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< -lkrb5 + +clean: + rm -rf *.lo *.la *.o .libs/ + +install: kinit.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: kinit.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/lastbind/Makefile b/contrib/slapd-module= s/lastbind/Makefile index ecc9ed1..643b0c1 100644 =2D-- a/contrib/slapd-modules/lastbind/Makefile +++ b/contrib/slapd-modules/lastbind/Makefile @@ -1,5 +1,5 @@ # $OpenLDAP$ =2D# Copyright 2009 Jonathan Clarke <jonathan(a)phillipoux.net>. +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> # All rights reserved. # # Redistribution and use in source and binary forms, with or without @@ -12,23 +12,37 @@ =20 CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 CPPFLAGS+=3D-DSLAPD_OVER_LASTBIND=3DSLAPD_MOD_DYNAMIC =2D#LIBTOOL=3Dlibtool LIBTOOL=3D../../../libtool =20 +ldap_subdir =3D openldap prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd =20 all: lastbind.la =20 =2Dlastbind.lo: lastbind.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $? +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< =20 =2Dlastbind.la: lastbind.lo +%.la: %.lo $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(prefix)/lib -module -o $@ $? + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm -rf lastbind.lo lastbind.la lastbind.o .libs/ + rm -rf *.lo *.la *.o .libs/ =20 install: lastbind.la =2D mkdir -p $(prefix)/libexec/openldap =2D $(LIBTOOL) --mode=3Dinstall cp lastbind.la $(prefix)/libexec/openldap + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: lastbind.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/lastmod/Makefile b/contrib/slapd-modules= /lastmod/Makefile new file mode 100644 index 0000000..e9f0408 =2D-- /dev/null +++ b/contrib/slapd-modules/lastmod/Makefile @@ -0,0 +1,48 @@ +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +CPPFLAGS+=3D-DSLAPD_OVER_LASTMOD=3DSLAPD_MOD_DYNAMIC +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: lastmod.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< + +clean: + rm -rf *.lo *.la *.o .libs/ + +install: lastmod.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: lastmod.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/noopsrch/Makefile b/contrib/slapd-module= s/noopsrch/Makefile index d90bc59..7227582 100644 =2D-- a/contrib/slapd-modules/noopsrch/Makefile +++ b/contrib/slapd-modules/noopsrch/Makefile @@ -1,8 +1,6 @@ # $OpenLDAP$ =2D# This work is part of OpenLDAP Software <http://www.openldap.org/>. =2D# =2D# Copyright 1998-2011 The OpenLDAP Foundation. =2D# Copyright 2004 Howard Chu, Symas Corp. All Rights Reserved. +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted only as authorized by the OpenLDAP @@ -12,41 +10,39 @@ # top-level directory of the distribution or, alternatively, at # <http://www.OpenLDAP.org/license.html>. =20 +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +CPPFLAGS+=3D-DSLAPD_OVER_NOOPSRCH=3DSLAPD_MOD_DYNAMIC -g -O2 LIBTOOL=3D../../../libtool =2DOPT=3D-DSLAPD_OVER_NOOPSRCH=3D2 -g -O2 =2D#LIBTOOL=3D../../../../ldap-devel/libtool =2D#OPT=3D-DSLAPD_OVER_NOOPSRCH=3D2 -g -O0 =2DCC=3Dgcc =2D =2DLDAP_INC=3D-I../../../include -I../../../servers/slapd =2D#LDAP_INC=3D-I../../../include -I../../../servers/slapd -I../../../../ld= ap-devel/include =2DINCS=3D$(LDAP_INC) =2D =2DLDAP_LIB=3D-lldap_r -llber =2DLIBS=3D$(LDAP_LIB) =20 +ldap_subdir =3D openldap prefix=3D/usr/local =2Dexec_prefix=3D$(prefix) =2Dldap_subdir=3D/openldap +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd =20 =2Dlibdir=3D$(exec_prefix)/lib =2Dlibexecdir=3D$(exec_prefix)/libexec =2Dmoduledir =3D $(libexecdir)$(ldap_subdir) +all: noopsrch.la =20 =2Dall: noopsrch.la +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< =20 =2D =2Dnoopsrch.lo: noopsrch.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(OPT) $(DEFS) $(INCS) -c $? =2D =2Dnoopsrch.la: noopsrch.lo =2D $(LIBTOOL) --mode=3Dlink $(CC) $(OPT) -version-info 0:0:0 \ =2D -rpath $(moduledir) -module -o $@ $? $(LIBS) +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm -f noopsrch.lo noopsrch.la + rm -rf *.lo *.la *.o .libs/ =20 install: noopsrch.la mkdir -p $(DESTDIR)$(moduledir) =2D $(LIBTOOL) --mode=3Dinstall cp noopsrch.la $(DESTDIR)$(moduledir) =2D + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: noopsrch.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/nops/Makefile b/contrib/slapd-modules/no= ps/Makefile index fce44e0..6da5cd0 100644 =2D-- a/contrib/slapd-modules/nops/Makefile +++ b/contrib/slapd-modules/nops/Makefile @@ -1,23 +1,48 @@ # $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 CPPFLAGS+=3D-DSLAPD_OVER_NOPS=3DSLAPD_MOD_DYNAMIC =2DLIBS=3D-L$(PREFIX)/lib -lldap_r -llber -lcrypto +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd =20 all: nops.la =20 =2Dnops.lo: nops.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -c $? +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< =20 =2Dnops.la: nops.lo +%.la: %.lo $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(PREFIX)/lib -module -o $@ $? $(LIBS) + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm -f nops.lo nops.la + rm -rf *.lo *.la *.o .libs/ =20 install: nops.la =2D mkdir -p $(PREFIX)/lib/openldap=20 =2D mkdir -p $(PREFIX)/man/man5 =2D $(LIBTOOL) --mode=3Dinstall cp nops.la $(PREFIX)/lib/openldap =2D $(LIBTOOL) --finish $(PREFIX)/lib =2D cp nops.5 $(PREFIX)/man/man5 + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: nops.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/nssov/Makefile b/contrib/slapd-modules/n= ssov/Makefile index 322fcdd..f1ec793 100644 =2D-- a/contrib/slapd-modules/nssov/Makefile +++ b/contrib/slapd-modules/nssov/Makefile @@ -28,7 +28,7 @@ NLDAPD_INC=3D-Inss-pam-ldapd INCS=3D$(LDAP_INC) $(NLDAPD_INC) =20 LDAP_LIB=3D-lldap_r -llber =2DLIBS=3D$(LDAP_LIB) +LIBS=3D-L../../../libraries/liblber -L../../../libraries/libldap_r $(LDAP_= LIB) =20 prefix=3D/usr/local exec_prefix=3D$(prefix) @@ -39,6 +39,7 @@ libexecdir=3D$(exec_prefix)/libexec moduledir =3D $(libexecdir)$(ldap_subdir) sysconfdir =3D $(prefix)/etc$(ldap_subdir) schemadir =3D $(sysconfdir)/schema +slapd=3D../../../servers/slapd/slapd =20 all: nssov.la =20 @@ -59,7 +60,7 @@ $(OBJS): nssov.h =20 nssov.la: $(OBJS) $(XOBJS) $(LIBTOOL) --mode=3Dlink $(CC) $(OPT) -version-info 0:0:0 \ =2D -rpath $(libdir) -module -o $@ $(OBJS) $(XOBJS) $(LIBS) + -rpath $(moduledir) -module -o $@ $(OBJS) $(XOBJS) $(LIBS) =20 install: nssov.la mkdir -p $(DESTDIR)$(moduledir) @@ -69,3 +70,11 @@ install: nssov.la clean: rm -f *.*o *.la .libs/* rm -rf .libs + +test: nssov.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/passwd/Makefile b/contrib/slapd-modules/= passwd/Makefile index 1e49e6a..748b4ce 100644 =2D-- a/contrib/slapd-modules/passwd/Makefile +++ b/contrib/slapd-modules/passwd/Makefile @@ -1,46 +1,52 @@ # $OpenLDAP$ =2DCPPFLAGS+=3D-I../../../include -I../../../servers/slapd =2D =2Dall: kerberos.la netscape.la radius.la apr1.la =2D =2Dkerberos.lo: kerberos.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -DHAVE_KRB5 -Wall -c $? =2D =2Dkerberos.la: kerberos.lo =2D $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(PREFIX)/lib -module -o $@ $? -lkrb5 =2D =2Dnetscape.lo: netscape.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $? =2D =2Dnetscape.la: netscape.lo +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +LIBTOOL=3D../../../libtool +SUBDIRS =3D sha2 + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: kerberos.la netscape.la radius.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +kerberos.la: kerberos.lo $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(PREFIX)/lib -module -o $@ $?=20 =2D =2Dradius.lo: radius.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $? =2D =2Dradius.la: radius.lo =2D $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(PREFIX)/lib -module -o $@ $? -lradius =2D =2Dapr1.lo: apr1.c =2D $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $? + -rpath $(moduledir) -module -o $@ $< -lkrb5 =20 =2Dapr1.la: apr1.lo +%.la: %.lo $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ =2D -rpath $(PREFIX)/lib -module -o $@ $?=20 + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D rm -f kerberos.lo kerberos.la =2D rm -f netscape.lo netscape.la =2D rm -f radius.lo radius.la =2D rm -f apr1.lo apr1.la =2D =2Dinstall: kerberos.la netscape.la radius.la apr1.la =2D mkdir -p $(PREFIX)/lib/openldap =2D $(LIBTOOL) --mode=3Dinstall cp kerberos.la $(PREFIX)/lib/openldap =2D $(LIBTOOL) --mode=3Dinstall cp netscape.la $(PREFIX)/lib/openldap =2D $(LIBTOOL) --mode=3Dinstall cp radius.la $(PREFIX)/lib/openldap =2D $(LIBTOOL) --mode=3Dinstall cp apr1.la $(PREFIX)/lib/openldap =2D $(LIBTOOL) --finish $(PREFIX)/lib + rm -rf *.lo *.la *.o .libs/ + +install: kerberos.la netscape.la radius.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: kerberos.la netscape.la radius.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/passwd/sha2/Makefile b/contrib/slapd-mod= ules/passwd/sha2/Makefile index 5dcb1db..d03297d 100644 =2D-- a/contrib/slapd-modules/passwd/sha2/Makefile +++ b/contrib/slapd-modules/passwd/sha2/Makefile @@ -1,15 +1,47 @@ # $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. =20 =2DOPENLDAP :=3D ../../../.. +CPPFLAGS+=3D-I../../../../include -I../../../../servers/slapd=20 +LIBTOOL=3D../../../../libtool =20 =2D#CCFLAGS =3D -Wall -g -DSLAPD_SHA2_DEBUG =2DCCFLAGS =3D -Wall -g +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../../servers/slapd/slapd =20 =2Dslapd-sha2.so: slapd-sha2.o sha2.o =2D $(CC) -I$(OPENLDAP)/include -shared -Wall -g $^ -o $@ +all: sha2.la =20 =2D%.o: %.c =2D $(CC) -I$(OPENLDAP)/include $(CCFLAGS) -c $< +%.lo: slapd-sha2.c sha2.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: slapd-sha2.lo sha2.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< =20 clean: =2D @rm -f slapd-sha2.so *.o + rm -rf *.lo *.la *.o .libs/ + +install: sha2.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: sha2.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done diff --git a/contrib/slapd-modules/trace/Makefile b/contrib/slapd-modules/t= race/Makefile new file mode 100644 index 0000000..948ffef =2D-- /dev/null +++ b/contrib/slapd-modules/trace/Makefile @@ -0,0 +1,48 @@ +# $OpenLDAP$ +# Copyright 2011 Buchan Milne <bgmilne(a)staff.telkomsa.net> +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted only as authorized by the OpenLDAP +# Public License. +# +# A copy of this license is available in the file LICENSE in the +# top-level directory of the distribution or, alternatively, at +# <http://www.OpenLDAP.org/license.html>. + +CPPFLAGS+=3D-I../../../include -I../../../servers/slapd=20 +CPPFLAGS+=3D-DSLAPD_OVER_TRACE=3DSLAPD_MOD_DYNAMIC +LIBTOOL=3D../../../libtool + +ldap_subdir =3D openldap +prefix=3D/usr/local +exec_prefix =3D $(prefix) +libdir =3D $(exec_prefix)/lib +libexecdir =3D $(exec_prefix)/libexec +moduledir =3D $(exec_prefix)/libexec/$(ldap_subdir) +slapd=3D../../../servers/slapd/slapd + +all: trace.la + +%.lo: %.c + $(LIBTOOL) --mode=3Dcompile $(CC) $(CPPFLAGS) -Wall -c $< + +%.la: %.lo + $(LIBTOOL) --mode=3Dlink $(CC) -version-info 0:0:0 \ + -rpath $(moduledir) -module -o $@ $< + +clean: + rm -rf *.lo *.la *.o .libs/ + +install: trace.la + mkdir -p $(DESTDIR)$(moduledir) + $(LIBTOOL) --mode=3Dinstall cp $? $(DESTDIR)$(moduledir) + $(LIBTOOL) --finish $(DESTDIR)$(moduledir) + +test: trace.la + @for i in $?;do \ + echo "Testing loading module $$i"; \ + echo "modulepath ." > test-slapd.conf; \ + echo "moduleload $$i" >> test-slapd.conf; \ + $(slapd) -T test -f test-slapd.conf && rm -f test-slapd.conf; \ + done =2D-=20 1.7.1 --Boundary-00=_50J6N9eQwpy3uQe--

1 0

(ITS#6962) Download down?
by demian.djrn＠gmail.com 02 Jun '11

02 Jun '11

Full_Name: Demian J Ramirez Version: ----- OS: windows 7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (189.178.46.195) all mirrors are down, i can't download the program.

1 0

Re: (ITS#6915) memberof+accesslog duplicate reqStart
by subbarao＠computer.org 01 Jun '11

01 Jun '11

On 06/01/2011 07:36 PM, Yuri Bank wrote: > Do you think this could be related to: > http://www.openldap.org/its/index.cgi?findid=6864 > > I've been having similar issues with MemberOf and Accesslog overlays > used together. I've occasionally experienced similar things that you describe but haven't captured the detailed data to be able to correlate that with this issue. > In your fix, is the memberof overlay enabled on your consumer nodes? No, it is disabled everywhere. -Kartik

1 0

Re: (ITS#6915) memberof+accesslog duplicate reqStart
by yuribank＠gmail.com 01 Jun '11

01 Jun '11

--bcaec520e733d305e204a4aefc06 Content-Type: text/plain; charset=ISO-8859-1 Do you think this could be related to: http://www.openldap.org/its/index.cgi?findid=6864 I've been having similar issues with MemberOf and Accesslog overlays used together. In your fix, is the memberof overlay enabled on your consumer nodes? -Yuri On Wed, Jun 1, 2011 at 1:00 PM, <subbarao(a)computer.org> wrote: > This is a multi-part message in MIME format. > --------------050703040907090602090901 > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > Content-Transfer-Encoding: 7bit > > I figured I would share a workaround that I'm currently using for this > issue which may be of help to others. I've disabled the memberOf overlay > in slapd, and use an external script to populate memberOf on the master > server, which then replicates to the consumer servers. I currently run > this every 5 minutes from cron as follows: > > memberof.pl --ldap > > Regards, > > -Kartik > > --------------050703040907090602090901 > Content-Type: application/x-perl; > name="memberof.pl" > Content-Transfer-Encoding: 7bit > Content-Disposition: attachment; > filename="memberof.pl" > > #! /usr/bin/perl > > # Implements memberOf reverse mapping attributes -- workaround for when > # memberOf overlay isn't available > > use Net::LDAP; > use Net::LDAP::LDIF; > use Authen::SASL; > use Fcntl qw(LOCK_EX LOCK_NB); > use Getopt::Long; > > use strict; > > my $basedn = "dc=example,dc=com"; > > my @attrs = qw(member manager); > # Note -- this filter properly excludes dynamic groupOfURLs groups > my $attrfilter = '(|' . join("", map { "($_=*)" } @attrs) . ')'; > my %revattrs = (member => 'memberOf', manager => 'directReports'); > my %fwattrs = reverse %revattrs; > my $revattrfilter = '(|' . join("", map { "($_=*)" } values %revattrs) . > ')'; > my (%entries, %reventries); > > # Prevent multiple instances from running at the same time > open(LOCKFH, $0); flock(LOCKFH, LOCK_EX|LOCK_NB) or exit 1; > > my ($generate_ldif, $update_ldap); > GetOptions('ldif' => \$generate_ldif, 'ldap' => \$update_ldap); > > my $ldifout = Net::LDAP::LDIF->new('-', 'w'); > $ldifout->{change} = 1; > my $ldap = Net::LDAP->new('ldapi://') or die "ldapi: $@\n"; > my $sasl = Authen::SASL->new(mechanism => 'EXTERNAL'); > my $sasl_client = $sasl->client_new('ldap', 'localhost'); > $ldap->bind(undef, sasl => $sasl_client); > > # Build %entries and %reventries maps > my $mesg = $ldap->search(base => $basedn, > filter => $attrfilter, > attrs => \@attrs); > $mesg->code && die($mesg->error . "\n"); > foreach my $entry ($mesg->all_entries) {$entries{lc $entry->dn} = $entry } > > $mesg = $ldap->search(base => $basedn, > filter => $revattrfilter, > attrs => [values > %revattrs]); > $mesg->code && die($mesg->error . "\n"); > foreach my $entry ($mesg->all_entries) { $reventries{lc $entry->dn} = > $entry } > > # Go through and generate updates for the reverse mapping attributes > my ($dn, $entry); > while (($dn, $entry) = each %entries) { > foreach my $attr (@attrs) { > my $revattr = $revattrs{$attr}; > foreach my $val ($entry->get_value($attr)) { > $val = lc $val; > if (!$reventries{$val}) { > $reventries{$val} = Net::LDAP::Entry->new; > $reventries{$val}->dn($val); > $reventries{$val}->changetype('modify'); > } > $reventries{$val}->add($revattr => $entry->dn) > unless grep({ lc $_ eq $dn } > > $reventries{$val}->get_value($revattr)); > } > } > } > while (($dn, $entry) = each %reventries) { > foreach my $revattr (values %revattrs) { > foreach my $val ($entry->get_value($revattr)) { > $val = lc $val; > $reventries{$dn}->delete($revattr => $val) > if !exists($entries{$val}) > || !grep({ lc $_ eq $dn } > > $entries{$val}->get_value($fwattrs{$revattr})); > > } > } > if ($entry->changes) { > $ldifout->write_entry($entry) if $generate_ldif; > if ($update_ldap) { > my $modmesg = $entry->update($ldap); > $modmesg->code && die("LDAP: " .$modmesg->error . > "\n"); > } > } > } > > --------------050703040907090602090901-- > > > --bcaec520e733d305e204a4aefc06 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Do you think this could be related to: <a href=3D"http://www.openldap.org/i= ts/index.cgi?findid=3D6864">http://www.openldap.org/its/index.cgi?findid=3D= 6864</a>=A0 I've been having similar issues with MemberOf and A= ccesslog overlays used together. In your fix, is the memberof overlay enabled on your consumer nodes= ? -Yuri <div class=3D"gmail_quote">On Wed, Jun 1, 2011 at 1:0= 0 PM, <<a href=3D"mailto:subbarao@computer.org">subba= rao(a)computer.org</a>> wrote: <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex;">This is a multi-part message in MIME format= . --------------050703040907090602090901 Content-Type: text/plain; charset=3DISO-8859-1; format=3Dflowed Content-Transfer-Encoding: 7bit I figured I would share a workaround that I'm currently using for this<= br> issue which may be of help to others. I've disabled the memberOf overla= y in slapd, and use an external script to populate memberOf on the master server, which then replicates to the consumer servers. I currently run this every 5 minutes from cron as follows: <a href=3D"http://memberof.pl" target=3D"_blank">memberof.pl</a> --ldap Regards, =A0 =A0 =A0 =A0-Kartik --------------050703040907090602090901 Content-Type: application/x-perl; =A0name=3D"<a href=3D"http://memberof.pl" target=3D"_blank">memberof.p= l</a>" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; =A0filename=3D"<a href=3D"http://memberof.pl" target=3D"_blank">member= of.pl</a>" #! /usr/bin/perl # Implements memberOf reverse mapping attributes -- workaround for when # memberOf overlay isn't available use Net::LDAP; use Net::LDAP::LDIF; use Authen::SASL; use Fcntl qw(LOCK_EX LOCK_NB); use Getopt::Long; use strict; my $basedn =3D "dc=3Dexample,dc=3Dcom"; my @attrs =3D qw(member manager); # Note -- this filter properly excludes dynamic groupOfURLs groups my $attrfilter =3D '(|' . join("", map { "($_=3D*)&q= uot; } @attrs) . ')'; my %revattrs =3D (member =3D> 'memberOf', manager =3D> 'd= irectReports'); my %fwattrs =3D reverse %revattrs; my $revattrfilter =3D '(|' . join("", map { "($_=3D*= )" } values %revattrs) . ')'; my (%entries, %reventries); # Prevent multiple instances from running at the same time open(LOCKFH, $0); flock(LOCKFH, LOCK_EX|LOCK_NB) or exit 1; my ($generate_ldif, $update_ldap); GetOptions('ldif' =3D> \$generate_ldif, 'ldap' =3D> \= $update_ldap); my $ldifout =3D Net::LDAP::LDIF->new('-', 'w'); $ldifout->{change} =3D 1; my $ldap =3D Net::LDAP->new('ldapi://') or die "ldapi: $@\n= "; my $sasl =3D Authen::SASL->new(mechanism =3D> 'EXTERNAL');<br= > my $sasl_client =3D $sasl->client_new('ldap', 'localhost&#39= ;); $ldap->bind(undef, sasl =3D> $sasl_client); # Build %entries and %reventries maps my $mesg =3D $ldap->search(base =3D> $basedn, =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0 =A0 =A0 =A0 filter =3D> $attrfilter, =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0 =A0 =A0 =A0 attrs =3D> \@attrs); $mesg->code && die($mesg->error . "\n"); foreach my $entry ($mesg->all_entries) {$entries{lc $entry->dn} =3D $= entry } $mesg =3D $ldap->search(base =3D> $basedn, =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0 =A0 =A0 =A0 filter =3D> $revattrfilter, =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0 =A0 =A0 =A0 attrs =3D> [values %revattrs]); $mesg->code && die($mesg->error . "\n"); foreach my $entry ($mesg->all_entries) { $reventries{lc $entry->dn} = =3D $entry } # Go through and generate updates for the reverse mapping attributes my ($dn, $entry); while (($dn, $entry) =3D each %entries) { =A0 =A0 =A0 =A0foreach my $attr (@attrs) { =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0my $revattr =3D $revattrs{$attr}; =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0foreach my $val ($entry->get_value($attr= )) { =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$val =3D lc $val; =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0if (!$reventries{$val}) {<b= r> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$reventries= {$val} =3D Net::LDAP::Entry->new; =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$reventries= {$val}->dn($val); =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$reventries= {$val}->changetype('modify'); =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0} =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$reventries{$val}->add($= revattr =3D> $entry->dn) =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0unless grep= ({ lc $_ eq $dn } =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$reventries{$val}->get_value($rev= attr)); =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0} =A0 =A0 =A0 =A0} } while (($dn, $entry) =3D each %reventries) { =A0 =A0 =A0 =A0foreach my $revattr (values %revattrs) { =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0foreach my $val ($entry->get_value($reva= ttr)) { =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$val =3D lc $val; =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$reventries{$dn}->delete= ($revattr =3D> $val) =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0if !exists(= $entries{$val}) =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|| !grep({ = lc $_ eq $dn } =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0 =A0 =A0 =A0 $entries{$val}->get_value($fwattrs{$revattr}));<= br> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0} =A0 =A0 =A0 =A0} =A0 =A0 =A0 =A0if ($entry->changes) { =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$ldifout->write_entry($entry) if $genera= te_ldif; =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0if ($update_ldap) { =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0my $modmesg =3D $entry->= update($ldap); =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0$modmesg->code &&amp= ; die("LDAP: " .$modmesg->error . =A0"\n"); =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0} =A0 =A0 =A0 =A0} } --------------050703040907090602090901-- </blockquote></div> --bcaec520e733d305e204a4aefc06--

1 0

Re: (ITS#6915) memberof+accesslog duplicate reqStart
by subbarao＠computer.org 01 Jun '11

01 Jun '11

This is a multi-part message in MIME format. --------------050703040907090602090901 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit I figured I would share a workaround that I'm currently using for this issue which may be of help to others. I've disabled the memberOf overlay in slapd, and use an external script to populate memberOf on the master server, which then replicates to the consumer servers. I currently run this every 5 minutes from cron as follows: memberof.pl --ldap Regards, -Kartik --------------050703040907090602090901 Content-Type: application/x-perl; name="memberof.pl" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="memberof.pl" #! /usr/bin/perl # Implements memberOf reverse mapping attributes -- workaround for when # memberOf overlay isn't available use Net::LDAP; use Net::LDAP::LDIF; use Authen::SASL; use Fcntl qw(LOCK_EX LOCK_NB); use Getopt::Long; use strict; my $basedn = "dc=example,dc=com"; my @attrs = qw(member manager); # Note -- this filter properly excludes dynamic groupOfURLs groups my $attrfilter = '(|' . join("", map { "($_=*)" } @attrs) . ')'; my %revattrs = (member => 'memberOf', manager => 'directReports'); my %fwattrs = reverse %revattrs; my $revattrfilter = '(|' . join("", map { "($_=*)" } values %revattrs) . ')'; my (%entries, %reventries); # Prevent multiple instances from running at the same time open(LOCKFH, $0); flock(LOCKFH, LOCK_EX|LOCK_NB) or exit 1; my ($generate_ldif, $update_ldap); GetOptions('ldif' => \$generate_ldif, 'ldap' => \$update_ldap); my $ldifout = Net::LDAP::LDIF->new('-', 'w'); $ldifout->{change} = 1; my $ldap = Net::LDAP->new('ldapi://') or die "ldapi: $@\n"; my $sasl = Authen::SASL->new(mechanism => 'EXTERNAL'); my $sasl_client = $sasl->client_new('ldap', 'localhost'); $ldap->bind(undef, sasl => $sasl_client); # Build %entries and %reventries maps my $mesg = $ldap->search(base => $basedn, filter => $attrfilter, attrs => \@attrs); $mesg->code && die($mesg->error . "\n"); foreach my $entry ($mesg->all_entries) {$entries{lc $entry->dn} = $entry } $mesg = $ldap->search(base => $basedn, filter => $revattrfilter, attrs => [values %revattrs]); $mesg->code && die($mesg->error . "\n"); foreach my $entry ($mesg->all_entries) { $reventries{lc $entry->dn} = $entry } # Go through and generate updates for the reverse mapping attributes my ($dn, $entry); while (($dn, $entry) = each %entries) { foreach my $attr (@attrs) { my $revattr = $revattrs{$attr}; foreach my $val ($entry->get_value($attr)) { $val = lc $val; if (!$reventries{$val}) { $reventries{$val} = Net::LDAP::Entry->new; $reventries{$val}->dn($val); $reventries{$val}->changetype('modify'); } $reventries{$val}->add($revattr => $entry->dn) unless grep({ lc $_ eq $dn } $reventries{$val}->get_value($revattr)); } } } while (($dn, $entry) = each %reventries) { foreach my $revattr (values %revattrs) { foreach my $val ($entry->get_value($revattr)) { $val = lc $val; $reventries{$dn}->delete($revattr => $val) if !exists($entries{$val}) || !grep({ lc $_ eq $dn } $entries{$val}->get_value($fwattrs{$revattr})); } } if ($entry->changes) { $ldifout->write_entry($entry) if $generate_ldif; if ($update_ldap) { my $modmesg = $entry->update($ldap); $modmesg->code && die("LDAP: " .$modmesg->error . "\n"); } } } --------------050703040907090602090901--

1 0

RE: Re: (ITS#6952)
by quanah＠zimbra.com 01 Jun '11

01 Jun '11

--On Friday, May 27, 2011 4:47 AM +0000 Srinivas.Kondamadugu(a)mphasis.com wrote: > Any help here? The ITS system is for reporting bugs, not for asking for help. If you need help, use the openldap-technical(a)openldap.org mailing list. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#6961) back-bdb/hdb search performance issue
by hyc＠OpenLDAP.org 01 Jun '11

01 Jun '11

Full_Name: Howard Chu Version: HEAD/RE24 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.94.188.8) Submitted by: hyc See this thread for background http://www.openldap.org/lists/openldap-technical/201011/msg00146.html Currently when returning the entries in an IDL range, back-bdb search.c just iterates through all the values in the range. If a lot of entries have been deleted within this range a lot of time is wasted calling into BDB to fetch entryIDs that don't exist. Strictly speaking this performance loss can be avoided by simply using a cursor on the id2entry DB, and using DB_NEXT to fetch the next entry that exists. However, while that approach provides uniform search performance, it's also always about 2x slower than the best-case where we just iterate through the IDL. Also if we keep a cursor like this open for the entire search operation, it will leave all of those entries read-locked until the search completes. (Note that an MVCC approach, like for back-mdb, would not have this latter problem.) The current patch continues to use the IDL iterator, but if the next iterated ID comes up as nonexistent, then we check for the next ID in the DB. We use the same approach as the online indexer to avoid taking any long-term locks: create a cursor, use DB_SET_RANGE to get the next ID, and then close the cursor, thus freeing its locks. This way the ideal case (all consecutive entries exist) remains fast, and the performance hit of asking BDB is only incurred when necessary. Testing shows that search performance remains uniform and within 1% of the ideal case.

1 0

(ITS#6960) Out of memory erro occurs when running LDAP
by ArunPrasathSevugan＠oracle.com 31 May '11

31 May '11

Full_Name: Arun Prasath Version: 3 OS: Window Xp URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (220.225.129.57) Hi, We have a tool integrated with LDAP to load all the users in Cognos reporting. There are about 5000+ users and while running LDAPCONFIG we have been getting out of memory exception issue. In the task manage I could see the LDAP is using memory of around 3 GB and finally errors out. Please help us to load the 5000+ users. Thanks, Arun

1 0

(ITS#6959) ldap_dnfree not mentioned anywhere
by frank.muzzulini＠comsoft.aero 31 May '11

31 May '11

Full_Name: Frank Muzzulini Version: 2.4.25 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (91.221.120.78) Hi, Reading the documentation of ldap_str2dn I was wondering how to free the allocated DN. After browsing for a while I loaded the latest tarball to see some example code and found ldap_dnfree. I re-checked and indeed the function is not mentioned anywhere in the docs ("find doc -type f | xargs grep ldap_dnfree" found nothing). Regards, Frank

1 0

(ITS#6958) slapd segmentation fault with TLSCRLCheck all
by alex.deiter＠gmail.com 26 May '11

26 May '11

Full_Name: Alex Deiter Version: 2.4.25 OS: FreeBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (217.66.145.56) FreeBSD x86 and amd64, OpenLDAP 2.4.25 configure option: $ ./configure --with-threads=posix --with-tls=openssl --disable-dependency-tracking --enable-dynamic --with-cyrus-sasl --enable-modules --localstatedir=/var/db --enable-crypt --enable-lmpasswd --enable-ldap=mod --enable-meta=mod --enable-rewrite --enable-null=mod --enable-monitor=mod --enable-accesslog --enable-auditlog --enable-collect --enable-constraint --enable-dds --enable-deref --enable-dyngroup --enable-dynlist --enable-memberof --enable-ppolicy --enable-proxycache --enable-refint --enable-retcode --enable-rwm --enable-seqmod --enable-sssvlv --enable-syncprov --enable-translucent --enable-unique --enable-valsort --enable-bdb=mod --enable-hdb=mod --enable-spasswd --enable-slapi --enable-wrappers --prefix=/usr/local --mandir=/usr/local/man --infodir=/usr/local/info/ --build=i386-portbld-freebsd9.0 slapindex segmentation fault when option TLSCRLCheck all is used in slapd.conf: TLSCACertificatePath /etc/ssl TLSCACertificateFile /etc/ssl/ca.crt TLSCertificateKeyFile /etc/ssl/server.key TLSCertificateFile /etc/ssl/server.crt TLSVerifyClient allow TLSCRLCheck all # slapindex -v Segmentation fault (core dumped) # gdb /usr/local/libexec/slapd /var/tmp/slapd-49225.core ... (gdb) bt #0 ldap_free_urllist (ludlist=0x2) at url.c:1515 #1 0x28c9b0b4 in ldap_int_destroy_global_options () at init.c:485 #2 0x28c7efc0 in __do_global_dtors_aux () from /usr/local/lib/libldap-2.4.so.8 #3 0x28cabf1c in _fini () from /usr/local/lib/libldap-2.4.so.8 #4 0x281d4538 in ?? () from /libexec/ld-elf.so.1 #5 0x281d4538 in ?? () from /libexec/ld-elf.so.1 #6 0xbfbfea38 in ?? () #7 0x281a9100 in dlinfo () from /libexec/ld-elf.so.1 #8 0x281a9260 in dlclose () from /libexec/ld-elf.so.1 #9 0x283a81b1 in _sasl_done_with_plugins () from /usr/local/lib/libsasl2.so.2 #10 0x283a18f0 in sasl_done () from /usr/local/lib/libsasl2.so.2 #11 0x080c7a3b in slap_sasl_destroy () #12 0x080a4d3d in slap_destroy () #13 0x080e4553 in slap_tool_destroy () #14 0x080e6147 in slapindex () #15 0x0805b665 in main () (gdb) f 0 #0 ldap_free_urllist (ludlist=0x2) at url.c:1515 1515 next = ludp->lud_next; also slapd segmentation fault when slapd service stopped: (gdb) bt #0 ldap_free_urllist (ludlist=0x2) at url.c:1515 #1 0x28c9b0b4 in ldap_int_destroy_global_options () at init.c:485 #2 0x28c7efc0 in __do_global_dtors_aux () from /usr/local/lib/libldap-2.4.so.8 #3 0x28cabf1c in _fini () from /usr/local/lib/libldap-2.4.so.8 #4 0x281d4538 in ?? () from /libexec/ld-elf.so.1 #5 0x281d4538 in ?? () from /libexec/ld-elf.so.1 #6 0xbfbfe9f8 in ?? () #7 0x281a9100 in dlinfo () from /libexec/ld-elf.so.1 #8 0x281a9260 in dlclose () from /libexec/ld-elf.so.1 #9 0x283a81b1 in _sasl_done_with_plugins () from /usr/local/lib/libsasl2.so.2 #10 0x283a18f0 in sasl_done () from /usr/local/lib/libsasl2.so.2 #11 0x080c7a3b in slap_sasl_destroy () #12 0x080a4d3d in slap_destroy () #13 0x0805bc92 in main () (gdb) f 0 #0 ldap_free_urllist (ludlist=0x2) at url.c:1515 1515 next = ludp->lud_next; without TLSCRLCheck all option in slapd.conf/ldap.conf slapd work fine, but without the CRL we can't authenticate clients on their certificates ;-( ldap.conf: TLS_CACERT /etc/ssl/ca.crt TLS_CACERTDIR /etc/ssl TLS_REQCERT demand TLS_CRLCHECK all URI ldaps://server.domain.ru BASE dc=domain,dc=ru RESTART yes VERSION 3 SIZELIMIT 0 TIMELIMIT 0 TIMEOUT 30 NETWORK_TIMEOUT 30 slapd.conf: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/samba.schema include /usr/local/etc/openldap/schema/dhcp.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/sendmail.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCACertificatePath /etc/ssl TLSCACertificateFile /etc/ssl/ca.crt TLSCertificateKeyFile /etc/ssl/server.key TLSCertificateFile /etc/ssl/server.crt TLSVerifyClient allow TLSCRLCheck all allow bind_v2 sizelimit -1 timelimit -1 modulepath /usr/local/libexec/openldap moduleload back_hdb database hdb cachesize 1024 directory /var/db/openldap-data dbconfig set_cachesize 0 67108864 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 suffix "dc=domain,dc=ru" rootdn "cn=manager,dc=domain,dc=ru" rootpw "passwd" index objectClass eq access to * by * read sasl-authz-policy to sasl-regexp gidNumber=(.*)\\+uidNumber=0,cn=peercred,cn=external,cn=auth "cn=manager,dc=domain,dc=ru" sasl-regexp gidNumber=60\\+uidNumber=60,cn=peercred,cn=external,cn=auth "cn=manager,dc=domain,dc=ru" sasl-regexp gidNumber=(.*)\\+uidNumber=(.*),cn=peercred,cn=external,cn=auth ldap:///dc=domain,dc=ru??sub?(&(gidNumber=$1)(uidNumber=$2)) sasl-regexp uid=(.*),cn=(.*),cn=auth ldap:///dc=domain,dc=ru??sub?(uid=$1)

1 0

RE: Re: (ITS#6952)
by Srinivas.Kondamadugu＠mphasis.com 26 May '11

26 May '11

This is a multi-part message in MIME format. ------_=_NextPart_001_01CC1C29.1B3F5374 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Any help here? Regards,=20 Srinivas Kondamadugu MphasiS an HP company |Ext. 51-41119|Mob: +91 9764401128 | email - srinivas.kondamadugu(a)mphasis.com |=20 > _____________________________________________=20 > From: Srinivas Kondamadugu =20 > Sent: Wednesday, May 25, 2011 2:15 PM > To: 'openldap-its(a)openldap.org' > Subject: Re: (ITS#6952) >=20 >=20 > Hi, Please find the configuration files > Regards,=20 > Srinivas Kondamadugu > MphasiS an HP company |Ext. 51-41119|Mob: +91 9764401128 | email - > srinivas.kondamadugu(a)mphasis.com |=20 >=20 > << File: (ITS#6952).zip >>=20 Information transmitted by this e-mail is proprietary to MphasiS, its assoc= iated companies and/ or its customers and is intended=20 for use only by the individual or entity to which it is addressed, and may = contain information that is privileged, confidential or=20 exempt from disclosure under applicable law. If you are not the intended re= cipient or it appears that this mail has been forwarded=20 to you without proper authority, you are notified that any use or dissemina= tion of this information in any manner is strictly=20 prohibited. In such cases, please notify us immediately at mailmaster@mphas= is.com and delete this mail from your records. ------_=_NextPart_001_01CC1C29.1B3F5374 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version 6.5.7653.29"> <TITLE>RE: Re: (ITS#6952)</TITLE> </HEAD> <BODY>  Any help here? Regards, Srinivas Kondamadugu</FON= T> MphasiS an HP company&nbs= p; |Ext. 51-41119|Mob: +91 9764401128 | email - srinivas.kondamadugu@mphasi= s.com |=20 <UL> _________________________________________= ____ From:   Srinivas Kondamadugu  Sent:   Wednesday, May 25, 2011 2:15 PM To:    </B= > 'openldap-its(a)openldap.org' Subject:    &nbsp= ;   Re: (ITS#6952)</FON= T> Hi, Please find the configuration files<= /FONT> Regards, Srinivas Kondamadugu</FON= T> MphasiS an HP company&nbs= p; |Ext. 51-41119|Mob: +91 9764401128 | email - srinivas.kondamadugu@mphasi= s.com |=20  << File: (ITS#6952).zip >= > </UL> Information transmitted by this e-mail is proprietary to MphasiS, its assoc= iated companies and/ or its customers and is intended for use only by the individual or entity to which it is addressed, and may = contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended re= cipient or it appears that this mail has been forwarded to you without proper authority, you are notified that any use or dissemina= tion of this information in any manner is strictly prohibited. In such cases, please notify us immediately at mailmaster@mphas= is.com and delete this mail from your records.</BODY> </HTML> ------_=_NextPart_001_01CC1C29.1B3F5374--

1 0

(ITS#6955) smbk5pwd: Update shadowLastChange
by fumiyas＠osstech.co.jp 26 May '11

26 May '11

Full_Name: SATOH Fumiyasu Version: HEAD OS: URL: ftp://ftp.openldap.org/incoming/smbk5pwd-shadowLastChange.patch Submission from: (NULL) (113.197.240.138) This patch is for smbk5pwd overlay to support updating shadowLastChange attribute in shadowAccount. The attached patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by SATOH Fumiyasu <fumiyas(a)osstech.co.jp>. I have not assigned rights and/or interest in this work to any party. I, SATOH Fumiyasu, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#6954) pcache crashes when bind-caching is enable
by ralf＠OpenLDAP.org 26 May '11

26 May '11

Full_Name: Ralf Haferkamp Version: 2.4.25/HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.211.118) Submitted by: ralf The pcache overlay can crash slapd when bind-caching ("pcacheBind" in slapd.conf) is enabled. It turned out to be a race condition with the consistency checker background task. The task might free and (expired) cached query while it is still being referenced by a bind operation currently in progress. Fix is coming.

1 0

(ITS#6953) pcache deadlocks when refreshing cached queries
by ralf＠OpenLDAP.org 25 May '11

25 May '11

Full_Name: Ralf Haferkamp Version: 2.4.25/HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.172.234) Submitted by: ralf Under certain circumstances slapo-pcache causes a deadlock in slapd when refreshing a cached query. The reason seems to be that, slapo-pcache considers the refresh search, issued from the consitency checker task, to be answerable from the local cache database (this only seems to happen when the pcacheAttrset contains the "objectclass" Attribute). slapo-pcache will search the cache db with the response callback pointing to be_modify() (indirectly through refresh_merge()) of the same database. When using bdb/hdb as the cache database this cause the task request a write lock on the cached entry with in one bdb transaction while already holding a read lock (from the internal search) through another TXN. slapd is deadlocked after that. See below for a gdb backtrace taken from that situation. The fix seems to be fairly easy. Just do not lookup the cache db when refreshing a cached query. It doesn't make sense anyway. I'll commit something for that shortly. #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162 #1 0x00007f2b88eaf519 in __db_pthread_mutex_lock (env=0xa5ebb0, mutex=<value optimized out>) at ../mutex/mut_pthread.c:318 #2 0x00007f2b88f4252e in __lock_get_internal (lt=0xa5efc0, sh_locker=<value optimized out>, flags=0, obj=0x14060, lock_mode=<value optimized out>, timeout=2169475480, lock=0x7f2b814f93a8) at ../lock/lock.c:953 #3 0x00007f2b88f4350c in __lock_vec (env=0xa5ebb0, sh_locker=0x7f2b858acf38, flags=0, list=0x7f2b814f9360, nlist=2, elistp=0x0) at ../lock/lock.c:136 #4 0x00007f2b88f43c48 in __lock_vec_api (dbenv=<value optimized out>, lid=2147483672, flags=0, list=0x7f2b814f9360, nlist=2, elistp=0x0) at ../lock/lock.c:84 #5 __lock_vec_pp (dbenv=<value optimized out>, lid=2147483672, flags=0, list=0x7f2b814f9360, nlist=2, elistp=0x0) at ../lock/lock.c:66 #6 0x000000000052a5d3 in bdb_cache_entry_db_relock (bdb=0x9c7a20, txn=0xa66670, ei=0xd71720, rw=1, tryOnly=0, lock=0x7f2b814f94d0) at ../../../../servers/slapd/back-bdb/cache.c:198 #7 0x000000000052c1e7 in bdb_cache_modify (bdb=0x9c7a20, e=0x7f2b85445068, newAttrs=0x7f2b8267e258, txn=0xa66670, lock=0x7f2b814f94d0) at ../../../../servers/slapd/back-bdb/cache.c:1231 #8 0x00000000004f3f2d in bdb_modify (op=0x7f2b8167a430, rs=0x7f2b814f9820) at ../../../../servers/slapd/back-bdb/modify.c:711 #9 0x000000000059e458 in refresh_merge (op=0x7f2b8167a430, rs=0x7f2b8167a370) at ../../../../servers/slapd/overlays/pcache.c:3275 #10 0x000000000045c207 in slap_response_play (op=0x7f2b8167a430, rs=0x7f2b8167a370) at ../../../servers/slapd/result.c:505 #11 0x000000000045dd28 in slap_send_search_entry (op=0x7f2b8167a430, rs=0x7f2b8167a370) at ../../../servers/slapd/result.c:997 #12 0x00000000004fbfd0 in bdb_search (op=0x7f2b8167a430, rs=0x7f2b8167a370) ---Type <return> to continue, or q <return> to quit--- at ../../../../servers/slapd/back-bdb/search.c:962 #13 0x000000000059d86e in pcache_op_search (op=0x7f2b8167a430, rs=0x7f2b8167a370) at ../../../../servers/slapd/overlays/pcache.c:3037 #14 0x00000000004d9ba5 in overlay_op_walk (op=0x7f2b8167a430, rs=0x7f2b8167a370, which=op_search, oi=0x9c7430, on=0x9c7610) at ../../../servers/slapd/backover.c:661 #15 0x00000000004d9e52 in over_op_func (op=0x7f2b8167a430, rs=0x7f2b8167a370, which=op_search) at ../../../servers/slapd/backover.c:723 #16 0x00000000004d9f3a in over_op_search (op=0x7f2b8167a430, rs=0x7f2b8167a370) at ../../../servers/slapd/backover.c:750 #17 0x000000000059e9bb in refresh_query (op=0x7f2b8167a430, query=0xa66580, on=0x9c7610) at ../../../../servers/slapd/overlays/pcache.c:3371 #18 0x000000000059f03d in consistency_check (ctx=0x7f2b8167ab60, arg=0xa61910) at ../../../../servers/slapd/overlays/pcache.c:3492

1 0

Re: (ITS#6952)
by Srinivas.Kondamadugu＠mphasis.com 25 May '11

25 May '11

This is a multi-part message in MIME format. ------_=_NextPart_001_01CC1AB8.7233BFF9 Content-Type: multipart/alternative; boundary="----_=_NextPart_002_01CC1AB8.7233BFF9" ------_=_NextPart_002_01CC1AB8.7233BFF9 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, Please find the configuration files Regards,=20 Srinivas Kondamadugu MphasiS an HP company |Ext. 51-41119|Mob: +91 9764401128 | email - srinivas.kondamadugu(a)mphasis.com |=20 <<(ITS#6952).zip>>=20 Information transmitted by this e-mail is proprietary to MphasiS, its assoc= iated companies and/ or its customers and is intended=20 for use only by the individual or entity to which it is addressed, and may = contain information that is privileged, confidential or=20 exempt from disclosure under applicable law. If you are not the intended re= cipient or it appears that this mail has been forwarded=20 to you without proper authority, you are notified that any use or dissemina= tion of this information in any manner is strictly=20 prohibited. In such cases, please notify us immediately at mailmaster@mphas= is.com and delete this mail from your records. ------_=_NextPart_002_01CC1AB8.7233BFF9 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version 6.5.7653.29"> <TITLE>Re: (ITS#6952)</TITLE> </HEAD> <BODY>  Hi, Please find the configuration files<= /FONT> Regards, Srinivas Kondamadugu</FON= T> MphasiS an HP company&nbs= p; |Ext. 51-41119|Mob: +91 9764401128 | email - srinivas.kondamadugu@mphasi= s.com |=20 <<(ITS#6952).zip&= gt;> Information transmitted by this e-mail is proprietary to MphasiS, its assoc= iated companies and/ or its customers and is intended for use only by the individual or entity to which it is addressed, and may = contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended re= cipient or it appears that this mail has been forwarded to you without proper authority, you are notified that any use or dissemina= tion of this information in any manner is strictly prohibited. In such cases, please notify us immediately at mailmaster@mphas= is.com and delete this mail from your records.</BODY> </HTML> ------_=_NextPart_002_01CC1AB8.7233BFF9-- ------_=_NextPart_001_01CC1AB8.7233BFF9 Content-Type: application/x-zip-compressed; name="(ITS#6952).zip" Content-Transfer-Encoding: base64 Content-Description: (ITS#6952).zip Content-Disposition: attachment; filename="(ITS#6952).zip" UEsDBBQAAgAIAPmyjTwmALxUVhYAAOlMAAAOAAAAcHBvbGljeS5zY2hlbWHVXHtTG0mS//v4FLXg CGBCCCTA2J7ZiZCFsHUrJFYS4/FsbGwU3SXU51a3ph889mK/++Wjqrq61YDk2SPuiN2xHlVZWfn8 VVa2dsSb0VJFg/PO1Qex/HZ7GPpyeZiq5E4l6WEayqV/mHpztZCHy2UcBt5jk9827kSredZsN09F +6h1dHh0ctg6hpcf2scfTt6Lb3mSid7DUrzZ2tkR03mQivs4+Sbg36WEr+KZMOuKSTzL7mWixE/z LFt+ODy8v79vxvAt8tKMk9vDn5tABQl14+VjEtzOM1jp6OQAVwbiqqB1EeeRL7MgjnCK6IShoPGp SBTtyjekxsoP0iwJbnIcLWTkizxVIohEGueJp+iTmyCSyaOYxckibYj7IJuLOKF/4zxDKovYD2aB Rys2BG5iqZJFkGXKF3EUPgqZCpnD8CT4J3x08ygyh12kcJXfgFjFIPBUlCrDXUd4sFUUU4ayC/lb FJ+8k0Eob0JiFYnNAng96Hd7w0lPf4YUsnh5EKo7FQo/SJSXxYkmp0Rp43ECfIeZSiLYBAx/hLe0 NVcbhmHShmamOc8WIWqGdhEnSC11NLTX3Sfd9CMkrjLQsxeo7FHsoe72ST9XoZKwrVTBNnLQlWdn p5nM1EJFmbhRYXzf3NraEedqFkQBrzNL4oU4T+QMB8xVIg/QWg6WMk3B0PwDNtaDozOxJ7XpRWKZ xLdgB+n+1s5/XOmRwDqORB0LMqFzLa5ApbDmF9S5eshgx8W6n9V9qLLs4Ep632TifwByy3u/O1fe t8vYz0EfKvOI5W4Mu4/A/IwmSVtoJ2l+81+wDuhJeHMZ3SqxF0RemPtBdCt8BfRhPWDUWJuI4gwE T/IWwzgDg/biBUjIB7tC5mFzfu6RTsGQ/wSjrkG095r/BIQpPEk6/xNwNlQZSeUL/AdX/JTE+VKs 8/efTTEBG4f4MFfBYmvH6PeAtbHZ3zAGkwsbYCTe1g7EC5B9+kF0lkkQivZJA938dF1agyboMsji HLb+nX+TPBKXgZfE6WMK5pd+P6URmNCNSswmTlBtddTWNMPKn4+iPnjW8N81s4cM15yAJ+WFAV6q RaxZobDsx15OfoaxJRIVbWIQhC8cY5XgpmBqdwH5A9EB0qliyzvGN+OLrjh++/asKcTHR5yLARGN jBgor9AQSnpzIsNxEux6ibEanSabS2QBouhyCbuiqLeU6FAYhmOIZYnoX42FF8pggVskOvfzwJsL iDwwBmyUNkb5ZS7vFEQLFXEQh43cUDD0wjhVfoM2i6s9QecGHU5pWjXTIcBIzwMdyMhjxyMyWhrv mlrq5f2nFAzutRcaZaQmVNvg2Ytug0ipBEax7mT6DbIdJqq9fm96sQ/rMzGZ8k7wraF7i96dNtHf MkViZcWRBPlLsZAg5zCNi/RQx5dM6zbx3N7IVh0KdzIMOGJJWPMhWOQLsqDgAbJplM15AdwBcgQi zpeQ0VHAYBmh9PAVav8mjSFIclLljThcktkQoSxYKNh4nwwc0vkSjBfCi0Q5xJTyV5hGsDBTiQI1 EokFDIYZIS6L4TogGaqFXhbEGeGk7WqaaW5bR1OQwlOCPV6eJGjA1VU9IAKbBQuCmbArrSInCUPy nFECxheHrcA/kDegKemB/MHXmzWLVbx5Mpd+fO+Glk2WTWk2pf2mG0Eqi5BnKArlAIEqsZwmFhhh SDlNE9sEOmztdPTe9WQbRzn+oT58lXpgx7ApQkXVWAcxi2SUQL5OC5/wwAaTOEzFHCRloipbck4C wiDhLwCIQIZImPgAub5X+F+icW4RV4fkKq6SOIu9OBR7GNv3xY1EUn6hB7RQDEs+2lNMRIIFhlmy NAyveRJkhOAoOzhTtat8g0AHbhbMAI7mYYYORmTMFoQH0iJnJvOUEC/Blm8gXqDNZrFLEmMJyggk GCQYddmTYqGiGYWcivBAzXaZPJW36HCgP/At/h6Ft5C+oq0hrb9BgAHs4v8d357C6AkdKljCGBoq adExbT5+CABI7Oo+gkKYBZ4IIBKzE+0G0I24VRHkR0CV4L+3RsydslS0ucSc3yCRgLaCgirnALQJ GUSF0XCI0laQEHBeISkzHUV1PLYyg6NNQgcGGTIdO5DjpV6akt88Dn27j+oKhJHZVlAvCyJK4sOc isJMmizgNuzbrCKmj0tYikStjxAAXjX8GJEcuigGLfOLOAT8jXaDzOFoy6/ICkr6ZFNQciVquGi2 BI6wrLhRBHeaEo1IQpbV+c9ZK9bKoGUqkgh00kCYAEc85BqE8CAXy1A1amfo3KJnIHU6NwERFJs1 P7s+oHn7Grct9uD8e9x822w1T/D/bdhd+6z5Dl63tjS27Vz2xK673139Te+v151Bf/pVC6nvgyXD MVIllzIDMKSx6NfhtPNraZXWyVt42Tptttrwpnn8TuxvsWDbJNjLIOrclqRayM+Rb75AZMqoLY58 jbMWOeQMBSf+FKEOhDMVcfZzjripFpQVJ8YtDSyLpeANHFaEhnENcUR0zGI4NE0hDvsbyLRdlSlv dUWg4PvqdlM5ts/M0P7w06B38EtncN2zoj1m0cqH7xItZET4gC1XalkqvxyDnIxpgdSLQgUDD9hH AFDl9P1RSTVEx48Vz9PkiTK+P2o4c0n14A2AWhDqMKJBD/o91zFKq52Ha9+0WthAj8creiS5voYe T0iP/egzhGxIzfWqTJfKQw2xOg08LdRKsa5ABUhJa7MIpXoBN3b8EaU2aNGSxXCiwJnMwHOLU+7J 5nmqQx4RShTS3EBvJ1W9WTm+hupOSXVUX/krWCQAIS3R/56OzkcfsMqSBgidqJLCJ03Q5SNk7Qc0 3VH/HCy/h0kRXrK/EUSWROV3pklgReyFAUApyOwiVFFD7JAzo1UgkJhLhJwqgZSuMm/fwByWKUEd jaeNHfkizjPgDYa7ALT5r/IG7LFMqDuFuozz2zkbC/xvoWREZ29MWMAEiEGjA0hfSh/C/TwhcGeC SrkyCXjOnu+QCuZ0TntMQ0+35/BhU7tGQPl9loeEK9Igy3UiuCfAVUqtMBbOTMnjMtP2CmMiG/Ma AuwM0I0ewF+SP2FVgdb8V71TBpGPG1GMyUtLGtWZ4/gdHNRsgIWoG2IuQ7kYLtDFpO+r9TKXxtBV n9w92m3YpUkfuATxgNOBDw2UcZUOzzOVkt3WrrMhUiMjfCy5Mw2jYWXW0Af6mcUoejQqJ6KqCFUR cRYoes/P6QMJuk3nTryyRRMdA2QKitzHKUZ8eAxE5RRsE8vtOpZdRl5mu5Zl0hYf04OsYRlJVJYn WJIXKkmoIjTLU+PVFnmsH7xOq8HLjSSvEb/eGnQ2UNEtloVoy1/QAVasiJwIBeQ3qtZZ4Aw8eEBi IjJFcirCk4PobpSF+rIGtpVPICsOEMVmrcKKQtqEsRki4Jh7/2l1FwaiSVhL5ZrDE9Z6H6Rqv1H1 kgaEEghcVC6PI2uQVYTiqrrYJ4TvgGo3bPCruMkU3Qu1gF+B2yNT4MH7wpil4m/au/sbGOTbGjTL pvEa1nhG1sjF9i8yiSjufw8YMhj3RoH2ldaimw20enUxiPMbvuaD6j2vDektxZpBWrIojgE6OUSU H/CQhPkMptij7fdDZbBszUCqNc4h0Cz8AlROF5BDDVS2X5sgb+AxgdvvOkSeVU2kpK/XMJN3ZCaf IKKoDmbnQbAIsnUMpTAQrL3SrQJbgOPbAJOIkIlOGgJoFas1knOhVcfvGS+7xoJ2hpqdySDcQPzv quKvyOE1FPCeFDCIvW902fwsMmownAq4vs6S2J6Or3vbjQJjlCIcwkENVuo0oA+u0kGyVq+mTopV SSp9oXAV3ZZTxUQtllnK2LgmajgTiVDdZLpzsgtjSZ2c6QKG5n/wkLx90RlMWCyqHLDMdUOdNEi6 ZeN2+DZJlHmHPMa3TAmW4TY6Zr2vmp3W/oq53cRxCKeCzcztWWtrHbnmdp5zkP7OWlIJo4Ovg1Ke c3eTKLIY4AbewD1hUH02vX9LZYS5epKjHF6E1DSSYW1Tlic7pd842aQ0ePSEgo28XyOutFqi7E+b BfUnHL/sA27Zq2QML4Sd5h8qlNCkpb4xwEMFzyIQZy54S2WsQgE2/we3EZZUNlFqq6aopUX7Kvrk 4q9esRuD6dLF2R3W7v5IvXLFZ2a8BJeflnlyi7c12BBDfUj8JdhHjqs3SqWMiO+00pzuw7CcUEnS sUcXo/6msb2U8TRSmxmzpjRF3OC31I/lePSTzGyi+5XCdJ0aXsUKdJ0a8GmX+ole8mrqDJKFLzBc 4PiN+DolrMtC5AYlkFGQOEVIkxQhXgcJwmIM17pSXDSdaSCxcjig27CkLsRWwuu6Z9Xnkj1vSFdN 9QHj95wwadGAVd6fyJdgl7gnuvyacWFcPZMIcEup3VNavSiZ1tozjNT1Oz4KY7eLxyW2AgHR7ZpT PzQXtGCdYLMh2DULkXl6QpB6D8QcnaLovjXZTb+nptJareRby3sNtMLV/A7WMa9hE8+ZfFG6AoOl Uz9bA5ZqS5qP76NymZ06I00tVpnB9v6WrDjDvOH2R1FQcVsJ1qo0rjqisXd9V1ZnPxhGqP+Pa8Pu la68SaljFOjpoxYzZpiCUzduJ0gXmyh95RqgooDX0DxfBkzkTF1iTffFixyjdHAAlDgKRz2AT5Sr 5Xys1zVNOF3KMKaSbsaqj9S9c1+HcY/LymwS69fTpAlJRYza/DK0tVLQLKTxv6wB8fnK6YYl0Zc7 X02XY0UdeKef6oBzYDocwlj6VBtccNMspR7qLfRN06O+7viHkf3evpjlEcXHJoq8WuHTeQX8Aevs WKxr7zIl7r7Vcy3aw+CJTT2co+AzXbwJqPPI6blgIqVqbeo0FOIwNAM88tpF8CDIkBTbf1CpH4x4 gH51Z1S+FT+Y9w39/geqgesaWUPcxYEvfpDJLajDitpZM4VwFfqmhI69Qv+YXHe7vclEt9xx+926 Ef/sFP95/940NZRL6KxybXLW4jyZqt4DJLF+59QxuzUAjq6LnvcmXbE7qLOOIEozCUCNwvn2k7ah WaqaL7dbcJNPzUbbzkaLnXI/C+0XkqVxjOsr7LDX7zrXv/YH/c74q35/2fkK9Cst4fs6hLVYY9We G+E23ZD3lHqSbAtSqStGNypxMq+0uJhbaTWbIRnWvm5BogSIbVe6bRcO/6ZbLrWFEbe/CRG6zmHM VnGYSlTIV4LzYGkaRxCeyMhcWicZtqTJRE+ldqBnVGEjXfspZayphevJlNVQ9D7tVzXEHQzijVOu fVPqE+C3pSDzRhNxC/c8rFSk5Y8qhUP+0BT1mM6bmsKL5UifJ/h93eGixI7FYDy+kp75wyJZWJs8 Xu0Pq+nCE9hKjl2ZttnsieZLakwrNaWZsvkCbBjtWLf5uX1qOpK5s/DJlxihG8EaO1hAKk340ZqX e+psK6IzpNJy94E1TJl8GixUg+0WxOfR8RFVo79xlGDfa0NpWG2DwEtkxoi4G4XHT/KbHu5At8Ud Y0ioF3WhlNHSkfckwA7zurY2j6I/drU9YhJM4QyelPerqy6MdLB7xIW7JGLTeneD3adPSI30ielP N2vDONIYrknI61HXEEreh1GBGu6wj0wXiEsJ1nRjLo36DVSQHPhmphnRJFIgf/CTIWEX+ll/yz0K K1+j2WTULWHp8WNZ/XPdNEKz955tvdPNH5VuSB1Gl5nuHNiDfJxkBH/2OSBpnN607ZVOo2Iwq2+i RCBBj/iUeidh9rbbrIhndxUVF5/WnuuVyA8s2JZHdqqGQUaOgB1KP6K83TU/YFf30VHr6Bjkcto+ +q0ejWuFsrjpcZIDPLqC3FO1wHzucXkX8R6YR1Qc0VWK1cT61tdyd6hzd8eX3amSiX60xAqA05bt ijO2ag24QSAQ+OPWVnIF3Rj+xMpYU7B3hsah21XBrVNihVyY0ZUZn1FQHc7ZXNzrRy+KI4fToFM0 4JrhzkWrfnDzqTOK0yMIkazSLstNLRhGKh2KaNxPn1DemjEOYLTC2DVfMtBDL7LbdrfLEtH7tZMs ztRt0fhgJVJlqKkHjcbnvTGgv+qgEXbYg92VBq+BTE/sWAdSms+uJ51PvaLiNbL1gX1jD8f16eSl 8qyWir5Q0cUayVRYQETKdrXzWzsC+8bqLmS4Bi/whAtqLSrxtvvLuYbtiCN28Bb+85u5BS9TNgua my+XGXweVkZAMXw0mBFm8bOxTxWqsDKTR0hA3/fYJdazvrMV61sR/VM2KCOOhqtS/n9tgCeiglzW MT0IdYulfRTNvfcp18tLdwPraej9ioYc3p7QTZkdjg3P8+Sw9X9Eey9ristbzzYps5akmOsTCl5k JeouiPMUvKrcogwu/Au6bFq0ppRo0UMdCXizfmgdn3832AhhOCKv2wBvcjjBsK4tbOp8HF44UMGc mf7MzrS9s60BFUIrfKcbv/ClLzOpZ9Jg/vuz+Kki8wmzIysdAW+xGrn6QC3s8G/ji267fdr+u4GB BQtAPsoXoEIPyyjw9yO3lfES9slT58CrXnoE+EfInyi5Ax+YWwDAwnUoxjF2TdcjopuVzZ0oI/Ny v+OLNJytBZXH38AoX57vys64sVYYq0YvoMX1Y+UKMfYyvPWA1VC16/Oryf3bWMbVC2vSXFndVvtI 7c8okLnXrFi6hbGm9HPpEUjjKwxvnU5Fo0qd+rSjlXy30tmvG7tNYZHOCs7DgTPzWAYWIhYYhmhD nLttFRCfcVUJZlwLI2AHcDKMlPLpIR7pc/82tgljFMWnGTXs5s3oh6i4fpknyzhVK9TMgQZE+Oly aiaukwDaRysJwD5PsBL8nThHubkAxTVhnfTNMWPDKH1ytH6Ufiuqp/3NEuotzqykrLT+qhRBle6f W0+0rRXRunyulVzr2CuuQA2FOhY3y7PrpU4W+VlRS3k+Lc5CiR5h7/3EHl3Y4K3a/hPNcLZlSz9r vnKaqlykRvbGyBxPzOWrAerYk8y34tXegnVU2F5RIe27Rnd6k1R7WQH6TieaO7v+bmhn/cuhPwRF ua/UVsLonFuv0GUc0K9AxJWqSKpnVarb9mjLVZP1JH28IukyZzUiX4sRzcSqzH2+eswDbHYfyo0d otX+fvFv7Zzjz1VIcEPK2L/gXVDxNFX590BMfd8tyOpbCP24NVZZsL7GN3b4g0fmrnm7MxH9yTY+ 5x7wA+rTzz3RHQ2n4/7H6+lo3KAPRuNPnWH/t860PxqKz73DCXw27l2Ne5PecDohSqMxEBKTq9Fw Mhr3zsXHr2KvfyE6w6/7TKM/nPbGw95UTEbdfg8E3Bmel74gMr3hp/6wx5h+2pn8RVyMxt2eOO9P uoNO/1J0BgPxpTMed4bTfm/SEL1fkYsJLX95Nej3zrma2x92B9fnSAW2IYajqRj0L/tTYGw6QqYM ka/AQmdKfFxPYKMX+FJTgKUvzZbHvf5QfOnD6kgLvkMOe0Rp3P/0eUoc4DvNBT84YhlFwpe9cfcz vO187JOBwYSL/nSI3F/gZHHVGU/73etBZyyursdXo0mvycZQ/ODCxPza0sY/xVDzKzK6GcJ9bpR/ g6thfseKTQKCEni67nUpLAus6mP3Spy9a9grJPVAT2lIvtwFc+RbebRAxiT80zGI8pAI1fC4pYMX bm5t/Q9QSwMEFAACAAgAAG65Ppjh1fQHAwAAAgcAAAoAAABzbGFwZC5jb25mrVRZTxsxEH5OpPyH EXkpUkgQUtUKiQeOHqiEPiT0FXnt2ayL12N8APvvO/Zm6aEStRK7ijae+Tz3fFM4uziDMyHv0CqQ ZGu9SV5ETRZqbXAynsIKEYIRTs2z/s3bfajJg8IotAnAwN+vkcufMM9X140OxQ6EhpJRcP11DRXC I3k+eBRKVAYZmqQSURw4EZvRfNGfJmNtpUkKRywKssFWLCR5nPf//64O2u4CWB12aPluJL9x6APZ HThyaI0SbgdEdXbjKe2COEdGy+4ZkV+nVS5XRvlkF33ZWTgZC78JRfWrJgv7i1P4YHMtYX21Al2D Ix+Bi6+w5qxUaVkOeQtn1Df0uu7OjUYbweID+iI+165Bv0o6Iny+/PT5ePnh4vJmeXywWl09HPUQ 9FHXWoqIH3NvOSOUyeNCsiLwwbOxucP2T/QX7P7lwul/OJi+zpMLWKkK8txVImBfN10m+RWd5Hdw MWJ/k3FIda2fRqM9JU9a5HVR1AptZ3yU1O5Nxp4oKssAaU+WwooN+tlL2CmcGxQ+4lMEJ0LgNVNh BhgcSi2M6coYxAahtzrbrmXJHkE8kFZzeF74YkK9eb8PgsnhRQoom37DNaMaQvRkNyASO7ExdzBT AlpJTA8bVPM+IfcI/HBTPcaeJ/CX0muPkvewg+XNag34pAOn43UOnYCH32p2UcKB0+uLfH/LLmQ5 xZyIlBiCzutQdSXfHj2kwXZoG/eSFMK7w0MmI65hyyxYgvwZw3zRcxFLYpcZi3vGNZZNiMyacHSY rVxapdllji93hMti88YrfMpnw9FjmOH9IKPqO1uXhutbVIOch04kEwHvZyFVgzTYrSD/ylAKM+gi GnQNWbSprfIG92L57D7p0l2P94lTUpkacj2IF8iILjNElTS7ZL4SLfeLh2Qybkklg4aEgoGkjMhm tH2gO85zGC4oWs2SfrDY3MXluvRhMh58bE3k+z0blQiGXAflFnU7yPc48pPtYUbpxD0Ovl4c/8FE CnhrSN5Rij+FjQjNrRzWo1/FvI4/AFBLAwQUAAIACADvg54+Ig2vK+YSAABqUAAACwAAAGNvcmUu c2NoZW1h7Txpc+JIsp/bv6LC7g3jfTYGcfiYty9CDbibGAwsx27325gPslSAtoVKo8M2M/H++8us QxLosNzX7Ds6YsZClcrKOysrSzohE4+6o74+JT3mUxKYG7o1jk7IW3X/lnif15eOZXiXAfUfqR9c Bo7hWZcC9NKEx+ri+vyRNOvX13Wtfk20RrNx2WhfNltweau1btvX5HPkh2Tw7JG3RycnZLGxA/LE /M8E/noGDLFVQs2crcInAyj6900YereXl09PT3UGo0hJnfnry/+oAxZE1GPezrfXm5A0b26uL3Bm QE4TXHcsci0jtJmLjxDdcQiHD4hPOU+WQjWjlh2Evv0QITQxXItEASW2SwIW+Sbldx5s1/B3ZMX8 bXBOnuxwQ5jP/7IoRCxbZtkr2+QznhNkwqP+1g5DahHmOjtiBMSIANy3f4NbDzsSpshFDNPowbFN MrJN6gZUUacTE1hFMYUoO0eMoviMR8N2jAeHk4rIVjZcj4a9wXg+kPcQQ8i8C4c+UodYtk/NkPkS HSV7jDMf6HZC6rvABIDv4CdnLa0NRTDXhiSmvgm3DmqGc8F8xBakNFTrnXHdDF1ETkPQs2nTcEdq oLsr0F2jexYraSaUNDtQEjcci5nRlroh10joGy4YpZgM+LFDsjV25IGiwGwQMQKtIt+1gw38Chmi YcC1DwrEMYv69iNnlVtkABIxQnh4y6fgAhHwTzYInD57jgFCtblIYMgIApAe4bcCYm89h+KDnCBF iedTMHJqnUuazomHSkaCEAunQqkARwHZ04aBFgE/XKODnCsjQ7sFSFPoagUP7xDHZ9tFtD57tC1k E3lA1RoP7JGLQirBZaEtbZkbEuA21r7hbdBWEZHtmk5kcWsFM3BIEJkbQXaQK646IR/YE9gVmA1i RByxgkAk1FlxMcDEKArhH4DeRhfbkScD7IvPAY4B3uDTLbDgrrnFbnIoB5H4dEV96ppAUcg4VMak lM4QTTwItmq49m/CVs5BlSb1QpzXpRQ5Bq/m2LzI9xjomq04M+gzwL+7TjAFIYjC8K1AqMpGERnw BH/aZya1IlATIkQMMQ9gunRlu4L7fbpjhPzxICDbKOACU/8Q0Yo5DsgaFM0NDwTxawS+bHExSD+g 6AG2C3ccw11Hxhro4KJAm3ARy8Bdo+1xV/sm/4RjUghKEOiAGh7xwC3QI8G2XLwn7FDGQ4+GkeFw c3qywcakbXBEPn1kn5PImKdZdDQwGRQT8wPlhGsXbTGhqCBcbDBOYvwWHmoy8FWuEhARRS8OEi/i aYAjOtbnZDg/Jg9GYAs/WHwYkOF4MZiNBwsyn/SGg8Unoo/7+wOD8fvheDCYDcfvOT36/GdyN5n1 BqQ/nPdG+vB+TvTRiPxdn8308WI4mJ+TwcfpbDCfk8mMDO+no+Ggfw4Ie6NlX2J5t1yQ8WQBMf5+ uBjAjBOY+JPC8Qko0BecjCUkgMmdpAimvdcXw8kYUXwYzAbDMfn7EOZGVDCMNA44otnw/YcFnx9/ SRpSJAJOxHE/mPU+wB393XA0hGkB/m64GCPpd/gsmeqzxbC3HOkzMl3OppP5oH6E2eEIfZJHmYBg EnlsybUHaJZuwW18tr09Onkzu+sRTetol/C/LqkJ0DP+/Jw6kMJiP0TrNz/vYVEImtpVm9Qi27q0 zDOFtHF1Q2rL2TC+obWvSM0yAWby8E/AHA90rmFg+vMwdQMe7e9cYwtJuh9n0jmkKQhPgYJrdzSY FuwSzBac0uqzLZjZHvEpMwRnyKNda11dcdoVUeJxxbQRypRBwp1HhdyIFFoXQAE22AWAMF7axU/g A6RGtHqn3q43yFi/H5BTxmfpOUD1KVDQH8x75BTwIbpbIkaJicM0UEsH8Cs73CH44K9LnduBABxa OASh3r83QnMDAPNPYCsfYZnYqnfrTZi3WW+2u3DZ7NSbGvyot67JWWWqm4LqGjk1HBuCrxTS2NjS 0/jewA39nbh1lmUJlEh5DhXAkvI9ZjAvQ+iPeLJGRNW5aWpkDj41Glz8TR8tB8haPiealP9nlz05 1FrTYWIZp0eHRMdQaQMCsJhkzETDtQtrc0FrFVI7v7e0q+71f71C/q1Y/qYLAscFE3MLRS2GucRr wRlPtSJvJkaEoReZcyH2ow7my6nQUKHg2jEJAZIQwCpPzn84PRgtLEBX4LTO7uwVVFQgoiO1BwtV 23DG0faB+lmtiVHi8uFD5ynT3fLdfDFL3Z9HD7j+c9dBZe22279321K1IjY1b8RKxOY5sAbKixJH gST4sd5pNHiakwycFTDfTYyA20CU9rdEBjjjLQmfGFQgUAr5kEsnF61mt0vkI/DXoilxVzLaJkAd ONjJF5CZsdUMcZoiW1CZMs1qDn4VT+/A9A4zIeCEOWKStirHY9MEi5TBFxaVNmZN261kmteJf4To H1CV0Ik/xeUNrJ6L5udguKryJODXE3KTIsSnVBCDF7plAaognwwEIIaAiCtfFaO/s89ARGxqIh4W pJ9GzBMDdtK1RZFg0zB70nyAAgOIg2V8JWk2k9THooO5DWcJXl2FAohGEYB+FSEqc0EYc2g26PHb JFkEiQ2TvciXnqRq4peZ5xQM0PRtT+S/jBfHo48HmfKk2HROXradk4rG09BUyO1TqP9Nzj8UNdSF MgwKxDk1fHPzHhZ3tEi67TizxKB5iQUHyRpHz4HpF+Y6rWL8WqdE5yrfPUQB1E1B0IPZ1rAEzpKm IIiZgPzRXiszwSkU+KHhqPCTIV0Mq+CTT/cIloZFtOPYl2TqZgnpV3uk91ieNUi6ZTb97sJuN8pk fZ0ieLJaQXn0jj1naZ7CMBHjRAD8wXTfKLo3u8CGXNynDgQRfydo5LE1y4SEJQpYcSTB/2C711SN F0Lt6W2YS4sWqgsFQGKImPaDh/cZOBj8Ai46DahCyphopph4LmPgOSG+wrRayZRaasqQPi9wawtS Z1Ld5hMAoETBkj3gCvSUBAEtqbpWhhnYUM/QxYFKceg5L/vfqSdI7c54PstTdYXcUCYtlbGeAbYw tn5ETETPhlYojqBKMufcbPaNa2/oC0yr1f292SkzLZXVbFd2PnCBZM/74yIz2wOEkqE/lsXdD+So W8aRynQ+XUMyoj61CjWSgGQTHy7Q9pLl1+Yx7SpZvoW2kODQtbBnxnLknIICmSdg371kfiGgxsmN dyNAdCrw39Nww6yc1KwAgSWZIrYKtEKEb2eL3QLKbhLKAtWJKl7opIDyljs5SKoLsVWV5pZKT0Hk ecyH5avueY5so/YYuNpzmLP0VcDESKD5jr4Af2FHsvKGZAHNKhttaX6EEPf5/iJZ+yzypDdlthRL 5lDphz25eVPw26Qmt5MEm2dfMI2qqHzm0IlpRp7h5sibyRFkCSHLJqq6iZjUOFR3ApZTx0Fgxfmo w6uaZIv2q6dWIT8KqD+FIvWJ+VZm/kut1bgCN5HjSArC7294m4A6HeOr1IjtRhxhTsi9bPbxJp6M Elg8rclP4sQBwPDa2aR+KM4X0MGzYYr6g/gR5nQPTAE37m6KNuta3RTHvQRTXooGNJzR9Izn/ECE pGgvBOdRVcW/rn8o+yrxmHoF5nv6vwjrBcyo/CMPk4S7GX1kIgRi8VnEVgzOG60yZDrwwCGHL3Nw 85UcqDyVEmE1HlIPfHMuAlhdyEMj2F2HxUfSrU8d/ilqSKg8ZvosCFJWNjVsv5AdhN1jygPo13PS bLwi+rVV9uIdkx+zJ5a0mApo0uLiZg0LJLmPerp284qZle2Dxr5pJ6fdiosAO7QNJ8hb9YsRzAMB 2/JtcjwlAz8Rd3BOACs/z4B0yIYUEFivRoDKhmsKeZ1b9V8jKEPy60yO61c1rhbH6Hiw3ogRVJtY 5cLnTqOxdG0w/LIKV7SHIg5H7DRgbEUPdrhf9bxoIN0S8lTissrkAQuFX1OjxQXCZNbnJzJSIxMf zzUd1mhfWUKUMKRSUf4O7QFjCmhvr7dasV5Sh7WTCoaFzGROaddZARU1nXOQVJeU9prApdJGZu33 Dfv2xc1eFeCF8d8XLP2la+RVADGFaQzVC5ISo+qokL5hkDrK/JcDFDju99qfTJ8v+NIlQ0fLlInO Glczm21QWh6moSrY41eubDpJg8oJjZfWNBzocB3z05etYwroUWnF2lr5u9fqIEz/vl8pX3RVvvAC GlnM3W1jnJAbtEatHW7OIGio0fhoZdy93e/7xUeaDg4ZqRNN/EBTNkIIaA4sSevGh5lC5uUUk3BX Hb4A86C+eNbcGDZvDOpo6npvAZf3y/mCpE5E5YaoPAKUF/JDRTkkGC6Jh1AKSBLMuuwtljN9pGbO nGnC+fOmUy4hzypkdWuQZChnPjGdCX/1T4A01Wskb0mqw0rOiihQ1q7OLeSRkBrLpUHMLTr+b4nc DOBXaXICHHSq0qWsPt30zqHNJQcAhUJiitD0jkGWyJj4ww4peXv05k1qaxxAMpuzgrnMvih/tGCr ER5JNUTkr9xeBcdy0KcB+II9bxgB8KI2A1eH1Ndeg0/+Fh1KQXd6+xiHC/tqr9ZxJ0fH4gjEi5qW 5x9KFR79X9P4v7zC4/499YNcdybxSKFaIdK4MB9oD+vKXAVnRZYouRKdV7mGOS2iOmOae1yIHzkR UxyweUv+P6iU2xiLEkMrVNl1rspmLO9kU1ZhqQ3x/AzrKqX9j1JWsaYAUeIT6cYBKqOQTqVeqcEi BZMD9SJ4VQVX9FBVR/LCbLJCREFePOHj8QYPqfXHwVl5dJFl30GEyeaGVEwRjRzJR+Ugo84gnorj mC5uTZWEmBTUy/EFWXFKaH/RikFl+XZMKlqxtNQCOybfLKv9cGN9KRA14xIiaWtOxWthuXpNdz+9 GK5CJErZX/Qa14nPfaZmHqgTneX07R38LPCfnJ4zUGa6iS+VtIn33Uq5k4NaqcZbXLzP9bxwkLw8 K2tBY43vltUMIl6RVrEhI5pM+s573aOQqriEp/iaUS5haqSS4pN3FcrjUHWbiN+DCH3mrvUIamzg W0hgGeRtQxlEwPKmVAIsG6wxH/ry43A01GefJBsH3ctCgrqZ/hLak+p/5RbKKaxGCrCIkhop6L6h uRZ1tXh82GtBglBRLXk9o0Lmrvazl9izfzmHyY3JOJXxRpd4OHVM7YX8lt65/BFZ7jrVtp5TM0J5 l25WG6J1HUjYgz3rPG0eRJV4v7CEqtTWS66BXfxNk5Pljx+9iQkgYv6c7cKS+eP26WzUT72/P2W2 G5brLx1JS8y02Lh5an8FrfHpU2trlZMmdygL67L/vVst5QvtKkXRFy5DcrwQ3zIVO4+kd7ATy9+I BYBcNat1i/fZzkR8eAwdc/rzsCy+g84rhvf4ZC5M1tOzU+FEr4nn3Nq+TTh/WxDKC1nZ6xf0ZqN8 bsrFluuQBy8ML/hb0svZkDjGA43fOU5027i6ebkPl25CaJ0GnlhW2YijpRbMsL/xDXhvMc1gGMZv eogPqqS8RXxJxZO1NEeTOZSQOl9T7cBBVt6HpLeSZUtC+kT1KA7ol70J+XkQ/tmAgHcSUKD772KX 2VgyUeJsffyoBn6BQmkC31oXZwm4ZFz6RI4DME1x4iE4xqcO9dKo34AptTVIDVqj0WqAZvC/ehPE pc5VQOA8FYkUL/befcQpb0XiTHcGf8jJEMjauedCilhqHcUcbQ0bX6r0V+a1pt3Djwd2cPhdMAYX AEAUxBF+JiKHs6HeEZTjeIY9GD3kkMO93IjvxjzuW2Q+h6mXUAL+SRm17MnapuBOQCUrnr0+W9Ei Os6r8ZvB/GMJ/0bUJxEq60PrJAqx8BVbi3/uoMe2HiQyWI9kFHKJ+G+JgMO3wyVgbic6VsqbKhqp ci6im3lz9yThujhmcDSt+JiO+lrE/go0j68ShRCuD8tMEdG6KiIC/6osG38XYm96ePaWL8lfmlEs 2+NXwrX2EX4OBr/jcnr42YrTVHgLPGpiaAhIfzwn/0B1NlrtX/BCa143f+FYNkyezQoERFNr/SIC J34B5vCFUNxM5cTWOQEAZQfnHM+j4UQ0efc3RcWGRY6FYZinFPkZIPF9HGzQ6+/Gd7c8tMI/qYy/ EJ+xkFzK5PfnGulPFvLHmYDkAAQg51O9NxD3BADcGw0W/eF78g/y526zpn5dkg+fph8GY4jl8o6Q gPr1F/Kn51bjonUDkH96bjcvOjq/6jYvrnTyEzluHJMLcnxzDHeP9eOL4//kVwZc/XYsMHFaCMcE C+mCfz+BYgzIqbVjciyZkYTx5/rFz212HhTf8OCFehDFQuSEg+IHPUgisCSuHdePz6pH7isZKbJG lglqUm+H5lL2Bvj3iBSJX7Y7N+TiIv2SLZC3Mh4ZP+MjU1GN+z2WI/LTeFnhNPEzeW0QR7PVad/g 4Q1I0nEApTKl8b/xC/KwzjWDGzmWjqYt7bpxSxy6NsxdykPwxAWHVm918Lf1wWmDHya5+ID7fwNQ SwMEFAACAAgA74OePpHXiJgUDQAALUkAABQAAABpbmV0b3JncGVyc29uLnNjaGVtYdVce2/jNhL/ 2/4URBIgWSBxLPmdOxzgOt7WbZJN46S3xSLA0RJjsyuJiijF6376mxnqZSftZeu9uNqHLVPkcPib B2coUvtMBiJW0TwUkVZBQzsL4XN2csImUP4hml9TOTu6eT+ye4P+u/o+O/gQiuDifHh9xsLP81PP 5eGpFtET1DzVHg/dU0Pl9CXSx0/Malj9ht3oMLtpNU+b7VOrBZdnduus3Wefkyhm4y8hO6jv77Pb hdRsqaLPDL5DDrfUA8u6Z1P1EC95JNg/F3Ecnp2eLpfLhoK7yFIDej79VwOoIKGRCleRnC9iZg0G /RPsGYiLgtZ7lQQujyUwivWHnseovmaRoMG5Gakb4UodR3KWYG3GA5clWgCOTKskcgSVzGTAoxV7 UJGvj9lSxgumIvpWSYxUfOXKB+lQj8cMBwEw+TKOhctU4K0Y14wnUD2Sv0PRbMXiErtI4TqZedJh F9IRgRYZd0PmwFARphix88xdhI8/cenxmUesIrEHCdcXk9H4ajpOy5BCrMITTzwJj7kyEg5IMCUn 2NrAVQR8e7GIAhgEVF/BTxpaWRoZwySNlJnGIvY9lAzo0h9qGdw7F9DY1SwJVQA/GRQ8yECazh8A Zvax0Wk22TA2TAl2uwoN/HDvw+w3YJ6NPK41jIn9oDyXqNwFEsUCckzlNXFFEIMwgAd2dHcz0e/Y J2Sk2Rvc1/drR46KRKq9hjEGKE8T3+cFMsTJ0aD7jt2BtrCpMSPoh3SD5I8wPLUMabvT/SPSqJWj D9PJ1ZhGMgkQYRGnY00JIxHL7rXvGZDQYGc5EaDh8ChVinpqQX7igYi4l4AmwTg9F/UBGHMRGJCx ilwaBVXR2Zgy3VER0InEHIVP+spCjwPaAKxyJEeNpQEC6DJw5ZN0E+416jwTS4xSOWJ2w+o2+u1m A+zfavVazUYLL+u1q+HlmB0WXB/Wa+fj6Ygdptpwxp7EQjpemaMX+IFm45/vhheT218BAi0m8wDQ veSxs6jXpnffTW9vSuXTZIa6HMx1VuPXq9vhR3BOrUYX+Gojb+0uXFqdhmVb+LPDCF9XoCfyQWmu En8mEJ2RcgVJu7iH0C6BbcCFGQ/IZsJT0GGDGak4ABj3tIJyIIHcODEYfpD4Ai7ZkWjMG8fMslvt dzhi7oULvnFz+N3oFCq8ey3adob25hieYy4zqwDPUR4Wilqi2wOe5jyQv5MI3g58qUHaqyvuI2j/ XoggKwJyyBXwGIErEjoUoJweAJpxDH5VnHhgLEynxuuBCh0zCV4rNYiHxEO5zUC50VHCZQoD+GMW QJ/pXbQdEONUBuA/FBgLiAcFcAKUyBOhFDT0g+LXoNzBIfn4kiEeI7PcdcmfcY/lAqS2wA+QCoRw qaNzM0TDArDqoidEYwa9ID8fJlGocBZ4pR60c7srAfpcCcJIPIgogp42Bg+qvY48wg668gZ6ALUm V99fjE9+GV7cjY1WCD/01EqI3CCvUjvZtJtcqyN0X3IeGB+Ymegxgg+zMqrNDNjEGYOmOhcagFtc wIxINFPXh84n831lczC6MfdSl+q+Vi6tTCrrA3oumHQ8xGjZUoMcit0Z6ksC0jqorlQ6mVRgFBUX RQ3+FuaC8RL8vEsjgdzX4eyf1onwRj6QSHjEul7IEKcxI5Y0bgBKxjVICJ7BT+yNFDgFjhHk3jHb G6dE8NpENXh1C7Tp7heKJL099Iso4L274HOglsEeOlQoW5lemA9uMPPAr5Rfe9OqcNzPBUk0QJ1M LZrs0L9mWvg2U1zNoBjdKO//KZrrSEGcJqKh60uSQ1aA1zfCESHRkvFbycjqZkLKRv83FRAM+7dQ zK8XKlYlAWnQcoERBjoiH6+lz+cmmM4DwETjVIki/PF6/D17L0nGZAwOeMO5gDQ08nnMPv34fvL+ voEuU2FEsIAybJb3vBkuLPl6UJBmpJTSbeYQofQU5LUosgDDf5jhReBQwOMWGRZSkTFkkwmkCxSh esrBYP+5RJuNQQOiVBDswG42W00QLf5vdJuZTHO+nwuVGywIrcPXSMHuGynksckFIJdA67K5QB7i UI5SzkkOdSmgWUaYbKNHZjpUnwXOT15KKYvQi6CQ0AjSZJfiNUiaIggyVQCW6ZDUF4nPA4wAHeWH gE7aAhygmXt+MdlVHrNtiPDybnoLTQNKTkm3KOVey3mxZOigdZ5ko2YLwXEeNHldpgMSh2Oy2G7/ Pl2AAOUUX1LTPmNETIvHhPjf2yC7x/bO9nDiXqQKwJRZnShhw5kuT6cbA3p1zDPItOSZRP8sIH0m v1x6b+0UXop30IlNLyeX45GIYrPQg/o5ZNc/jab7PSOaltW5h4gEw51zHvNjDKojQXIBPYgpiUTL B6jToIiyAkms0poQVNMYfpCbeanP1P+D0CaxaY3pvg++00VLQepp0r/gT2Au7D9pzzRFIlUXOMuj KT7TcA+oZNUOjd4V2p0tPBW6gDU55V+pRDQmCxCyoaWUOAUPKINs9Ub70hcjHvKZ9ED70WxIvwm3 bqt1b3jHf0AG5jDpJz5ov3agV6gNGMqIERoQas4VKMvCB0EXBNcMkoxtjWvM1ky6Q57dJcYitBYd k32Vl/hgPkRoD1+SwD9MvUMUwUOxCHe82SEJp1Bv9YTz+4Im0ags0KIFqvn01AwxDL10MVHT+mW+ rhnA/HHG9lIu9hgEZIGGPjLDvvpwm+d0MIfoFQjrC2qcafDaCKtZnr03IXhuxqkVFLqfr0bpJAxV FKcDe9WE0ClMDulaNvzAC7Zv2eyTKboHaCnAQa/1YCZZxA/8oZl4QW+NeoJrN8FWvEJbC0xl48Fp uYGS+lI5mafREdLyYtUU142lI45TV14wWBJi4V/NmsLtplasaSFQ+l96aERg+inpHi4r5mSBTGr1 qObX7z+y6/O7fBQ8Ez7Z/i7UyV6PBs1gXpgMNgVWFgtgUWgBDPErVOnr/tDjhQSw89O8DnUpX5M2 8/3l+IfJlF2DYgO30xWIzqdIn6KeiVtcmbkLgnQc9w4XCq08500Zq8YCIWIaLt2RSmiWuuZaL3Fx mwrQkraE9/Xw5etrGTvfAMBXxMa9dLlFxuInsTqH+XD9V+pQTLaCTumcpszQPMqawwysY/BbHngw sOApNPwsVn8bpWzmoWJpSBXSzFQd/wbqmT8IWOPpTXQ0y6IfZKTjWwjzPDWndMU4SeMdaYqDiVRD kgzVWAz1GFUsZrEGezPFG+R4rXP9JoD1/tKkxKZx+rx8tACVEhjk/IxT/hOPJEagmlmocnazTg8N H60/FMFUvEDHxJp5LmjElN1gmed5E+n0crcAo6iOO3Ae7a0gtyES3A3g/WYBuF0lwFtbAd6KdgZ4 8Zj8sVUlwNtbAd6OF7sC3C4Ab1cJ8M5WgHd2B3irALxTmd0IzmN3K7y7u8O7XeDdrRDeva3w7u0K 7U6Bdq9K7qS/FdyCdlzuCPJuAXm/Qgo+2Arxwc4cyqAUogwqhLfV3Apwq7krxO1macq0mlWCfLtU 07J2p+RlyK0qQb5dqmnZu4O8FKhYdpUg3y7ZtFq7g7wUrVitKkG+Xbpp7S7fHJSiFatdJci3Szit 3WWcg14J8iqlnNZ2Oae1u6Rz0C9BXqWs09ou7bR6u4O8vDbeqxLk26WeVn93cXlpddyqUuppbZd7 WoPdQV5KPq0qZZ/2dtmnvcPss7RCblcl+wR0xlfnr3oo+rUPXF9+4joM9DI7HGa2AxXHcMsP+xl3 HNoVgDu8tnoWS1uEqVfr7dba8lCKV+YJrAHa/hZA228HdL8EtF0loFvfAujW2wE9KAHdqhLQ7W8B dPvt4tNmCejqJL7fwtV/9QxD+5FL70ug4/1ivQzEHeIbK4JYs1CoEDpfLhTt831+Xh/PUZbQM++w 8PE00So7MYCHPOIoceIkwkMv9DYF3IJMh5Aj+UR7kh8i5ZP2lKlxL+XInIIvnVqW9OYG22KfPsLn faOu6F0NRLz2sqbYDbvO4E+6J7U84uc6k593+rDGDsvqI6Hp3fWL3Jqbtzd3o9u7m+FFvXY5/JUd 1Ws1nrhSsQM2w0NcQusRADnHXd4HpRcuwI/Nk/XsABqXDllDlfXDvVCgdVAqprdYHOSnAOFyDjgH pjEQW4CIrhd4mueA0bXSMfeGrgty11BG54W4h5fFeTFsCLooPOHe3Uzglg+6SV8BnxMTvppJ6g1H GZpCaBSa5ixSyi8YFk4kYk6jT6Sbcls+poBNv3SazSSQj4koXrGBtDeP+VDlF0+vHJQ3zR/km6QP 8k2+xGppByP8Xt+h97wA+jqgGIvRl22+WuarjYMrbZd9V6/9hc13eCRFgEfNHWxqqeuFZVN10g3k In1vSf7akjmocXp+4E/896ssqFWyoHVOvt6Eal9tP4XsDPQGeQO8wd157NBnlz579Nmnz4Fp1TRf prVlmlumvWUI4Lb1Gl0YIpahYhkylqEDwX2tRoL9Srn+F1BLAQIUABQAAgAIAPmyjTwmALxUVhYA AOlMAAAOAAAAAAAAAAEAIAAAAAAAAABwcG9saWN5LnNjaGVtYVBLAQIUABQAAgAIAABuuT6Y4dX0 BwMAAAIHAAAKAAAAAAAAAAEAIAAAAIIWAABzbGFwZC5jb25mUEsBAhQAFAACAAgA74OePiINryvm EgAAalAAAAsAAAAAAAAAAQAgAAAAsRkAAGNvcmUuc2NoZW1hUEsBAhQAFAACAAgA74OePpHXiJgU DQAALUkAABQAAAAAAAAAAQAgAAAAwCwAAGluZXRvcmdwZXJzb24uc2NoZW1hUEsFBgAAAAAEAAQA 7wAAAAY6AAAAAA== ------_=_NextPart_001_01CC1AB8.7233BFF9--

1 0

(ITS#6952) Unable to get the Accout Locked message via Password Policy
by srinivas.kondamadugu＠mphasis.com 25 May '11

25 May '11

Full_Name: Srinivas Kondamadugu Version: 2.4.23 OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (15.195.185.82) We installed and configured the OpenLDAP password policy and while testing with bind operation we are getting Error code as 49 (invalid credentials) but we need account locked messages to appeared. Even if we use ppolicy_use_lockout in ppolicy.la we are getting the same error code and when we view the admin console we are not able to see any operation attribute for the user w.r.t password policy etc., Configuration snnippet # required if the overlay is built dynamically moduleload ppolicy.la # invokes password policies for this DIT only overlay ppolicy # define the default policy ppolicy_default "uid=default,ou=pwpolicies,dc=mehisdomain,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext

1 0

Re: (ITS#6915) memberof+accesslog duplicate reqStart
by hyc＠symas.com 24 May '11

24 May '11

ebackes(a)symas.com wrote: > The openldap-techincal traffic Michael mentioned is almost certainly the same issue. In our case, yes this could have appeared as early as 2.4.23. > > What I'm seeing now is that formerly memberof functioned with accesslog in > a delta-syncrepl type environment by having each stage of replication (master, hub, replica, etc) run the overlay to supply the changes. It seems like originally only the group change went through and the overlay relied on reqStart collisions to prevent its internal operations from reaching the replication log. > > So: the recent change that exposed this was something that changed the > order these things are applied and sent to accesslog. > > Changing memberof again to reveal only the group changes should probably a separate ITS, or perhaps a discussion (openldap-devel) on how we want it to work. As-is, the fix in git master breaks compatibility with configurations from prior releases. The breakage seems to go back to ITS#6329. The original design for memberOf was for the internal modifications to not be replicated. Instead, any replicas that wanted to maintain member information was expected to run an identical memberOf overlay configuration. The fact that memberOf didn't update the entryCSN on its internal modifications was intentional. This design constraint was broken by the fix to ITS#6329. The patch for #6329 and any ripple effect from it needs to be reverted. In general it's incorrect to replicate internal operations. The fanout from replicating every internal operation would be too large and the information content of what is being replicated is essentially nil. When the servers are configured identically they will maintain identical data by virtue of the overlays on each node performing the same internal operations in response to a given sequence of user operations. > Emily Backes > Symas - The LDAP Guys > ebackes(a)symas.com > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6951) pcache: valgrind reports some errors when bind-caching is enabled
by ralf＠OpenLDAP.org 24 May '11

24 May '11

Full_Name: Ralf Haferkamp Version: 2.4.25/HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.222.177) Submitted by: ralf I get this when starting a bind-caching slapo-pcache setup under valgrind: ==18290== Invalid write of size 1 ==18290== at 0x59628F: ftemp_attrs (pcache.c:490) ==18290== by 0x5A29E0: pc_cf_gen (pcache.c:4199) [..] ==18290== Address 0x768dcc6 is 0 bytes after a block of size 6 alloc'd ==18290== at 0x4C2683D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==18290== by 0x509CC85: ber_memalloc_x (memory.c:228) ==18290== by 0x46B958: ch_malloc (ch_malloc.c:54) ==18290== by 0x596206: ftemp_attrs (pcache.c:448) [..] ==18290== ==18290== Invalid write of size 1 ==18290== at 0x5A3153: pc_cf_gen (pcache.c:4281) [..] ==18290== Address 0x768e437 is 0 bytes after a block of size 7 alloc'd ==18290== at 0x4C2683D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==18290== by 0x509CC85: ber_memalloc_x (memory.c:228) ==18290== by 0x46B958: ch_malloc (ch_malloc.c:54) ==18290== by 0x5A30D5: pc_cf_gen (pcache.c:4270) [..] A fix is on the way to HEAD.

1 0

Re: (ITS#6920) OpenLDAP 2.4.25 / Berkeley DB 4.8.30 Solaris 10 x86 slapd hangs
by fumiyas＠osstech.jp 24 May '11

24 May '11

At Thu, 28 Apr 2011 18:05:43 GMT, mslby(a)deshaw.com wrote: > My company uses OpenLDAP 2.4.25 with Berkeley DB 4.8.30 compiled on Solaris > 10 x86 using Sun Studio. OpenLDAP is used as the backend for generic naming > services (passwd, group, netgroup etc?) as well as holding mail routing and > some custom data. We have master and slave servers and are using syncrepl > refresh and persist. Are you using Solaris nss_ldap and ldap_cachemgr(1M) on your Solaris 10 with OpenLDAP slapd? If so, Solaris libldap.so breaks your slapd process as the following scenario: (1) slapd calls some name service functions, e.g. getpwnam(3C). (2) Solaris nss_ldap (/usr/lib/nss_ldap.so.1) is loaded. (3) Solaris libldap.so (/usr/lib/libldap.so.5) is loaded. (4) Solaris libldap.so overrides ldap_*() and ber_*() functions in slapd (or OpenLDAP libldap_r.so and liblber.so). (5) OpenLDAP calls ldap_*() and ber_*() functions that are belong to Solaris libldap.so, not OpenLDAP's one. See also: http://www.openldap.org/lists/openldap-technical/200902/msg00000.html https://bugzilla.mozilla.org/show_bug.cgi?id=292127 http://bugzilla.padl.com/show_bug.cgi?id=203 -- -- Name: SATOH Fumiyasu (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- Personal Home: http://www.SFO.jp/blog/ > Lately we have been experiencing hangs with slapd and I cannot figure out > what the cause is. Things will be humming along and then slapd will simply > stop accepting connections and answering any requests for reads/writes. We > have set the loglevel to 256 and there is nothing in the logs that > indicates what the issue it. At the time that the process goes catatonic all > syslogs from slapd stop > > I have not found a way to reproduce this on demand. > > Today we have had three hangs and the truss ouput is exactly the same on > all process. Once the slapd process gets in this state a simple kill does > not work. The syslog always says that slapd is waiting for tasks to > complete but this never happens. I need to kill -9 the pid. > > I am going to include all of the debug info that I have collected and > hopefully someone will have some idea what is going on. I also have a gcore > of the process if anyone wants and info from that > > All and any help is greatly appreciated

1 0

Re: (ITS#6950) pcache crashing when '+' or '*' is used in attrsets
by Ralf Haferkamp 24 May '11

24 May '11

'1.1' is also causing a crash (on shutdown)

1 0

(ITS#6950) pcache crashing when '+' or '*' is used in attrsets
by ralf＠OpenLDAP.org 24 May '11

24 May '11

Full_Name: Ralf Haferkamp Version: 2.4.25/HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.222.177) Submitted by: ralf The pcache overlay crashes slapd when using * or + in a pcacheAttrset. It seems the problem was introduced with the recent changes to support caching of undefined attributes. Fix is on the way.

1 0

Re: (ITS#6941
by rhafer＠suse.de 24 May '11

24 May '11

> Some how this got duplicated from ITS#6940, please close. Done.

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by masarati＠aero.polimi.it 24 May '11

24 May '11

On 05/23/2011 10:15 PM, Tim.Mooney(a)ndsu.edu wrote: > Thank you Pierangelo. We've been running with that patch since last > Friday without problems, so I'm comfortable with the fix. > > If you can do so without having to spend much time on it, could you give > a brief overview of what you believe might be involved in implementing the > longer fix? I won't make any promises, but if you give me a hint at what > would be involved, I might be able to contribute the code to skip mapping > when not needed. That seems like it would be very beneficial. I don't think it's worth the effort, because mapping and rewriting are somehow tightly joined, so as soon as the overlay is loaded it is nearly always worth to scan all data to check whether intervention is needed. Further optimization would make the code even more hairy without significant improvements. p.

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by Tim.Mooney＠ndsu.edu 23 May '11

23 May '11

In regard to: Re: (ITS#6943) segfault in rwmmap in 2.4.25, Pierangelo...: > On 05/20/2011 10:21 PM, Tim.Mooney(a)ndsu.edu wrote: >> In regard to: Re: (ITS#6943) segfault in rwmmap in 2.4.25, >> masarati(a)aero.po...: >> >>> The bug is caused by the fact that "mapping" is always on, and slapo-rwm >>> checks whether there is anything it can/need to do about special >>> attributes, and it (incorrectly) assumed attributes have an equality rule. >>> It has nothing to do with the fact that you defined no rules for search >>> or so. >>> >>> The quick fix would be to check whether sat_equality is NULL; the >>> (possibly) long fix would be to entirely skip mapping when not needed. >> >> My apologies for the delay in responding. >> >> I've uploaded a patch, >> >> TimMooney-110520.patch >> >> to incoming. It tests that sat_equality is not NULL before dereferencing. >> >> Is this essentially what you had in mind as a fix? > > Yes. Fixed in HEAD. Thanks, p. Thank you Pierangelo. We've been running with that patch since last Friday without problems, so I'm comfortable with the fix. If you can do so without having to spend much time on it, could you give a brief overview of what you believe might be involved in implementing the longer fix? I won't make any promises, but if you give me a hint at what would be involved, I might be able to contribute the code to skip mapping when not needed. That seems like it would be very beneficial. Tim -- Tim Mooney Tim.Mooney(a)ndsu.edu Enterprise Computing & Infrastructure 701-231-1076 (Voice) Room 242-J6, IACC Building 701-231-8541 (Fax) North Dakota State University, Fargo, ND 58105-5164

1 0

(ITS#6949) OpenLDAP Logging
by andrew.stringer＠igt.com 23 May '11

23 May '11

Full_Name: Andrew Stringer Version: @(#) $OpenLDAP: slapd 2.3.43 OS: Red Hat 5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.205.160.142) Software Enhancement Requests Hi, we are currently rebuilding our LDAP tree using vendor current version of software, including openLDAP. I don't have much LDAP experience, so may be there is already a way to do this, but I have not found it despite several trips to Google. etc.. Logging in openldap seems to be all via syslog and controlled by a value made up by adding the code for a particular log entry of interest, all of which are sent to syslog under one facility number. I feel that logging could be improved by allowing logging similar to how BIND's named does it, namely having different log files for queries, normal operational logs and zone transfers (or in LDAP's case, replications). This would make it much easier to monitor the activity of the server without having to grep out unwanted information to see the required detail. Regards, Andrew.

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by masarati＠aero.polimi.it 23 May '11

23 May '11

On 05/20/2011 10:21 PM, Tim.Mooney(a)ndsu.edu wrote: > In regard to: Re: (ITS#6943) segfault in rwmmap in 2.4.25, masarati(a)aero.po...: > >> The bug is caused by the fact that "mapping" is always on, and slapo-rwm >> checks whether there is anything it can/need to do about special >> attributes, and it (incorrectly) assumed attributes have an equality rule. >> It has nothing to do with the fact that you defined no rules for search >> or so. >> >> The quick fix would be to check whether sat_equality is NULL; the >> (possibly) long fix would be to entirely skip mapping when not needed. > > My apologies for the delay in responding. > > I've uploaded a patch, > > TimMooney-110520.patch > > to incoming. It tests that sat_equality is not NULL before dereferencing. > > Is this essentially what you had in mind as a fix? Yes. Fixed in HEAD. Thanks, p.

1 0

RE: (ITS#6944) Add option to limit or remove operation list cache
by jorge.perez.burgos＠ericsson.com 22 May '11

22 May '11

Hello Quanah, Our slapd uses back-meta to communicate to other slapds. We have to fulfill some requirements related with bandwith with network latencies and packet loss between slapds, to fulfill such requirements we need to increase these threads. Best Regards -----Original Message----- From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] Sent: viernes, 20 de mayo de 2011 19:01 To: Jorge Perez Burgos; openldap-its(a)openldap.org Subject: Re: (ITS#6944) Add option to limit or remove operation list cache --On May 19, 2011 8:03:00 AM +0000 jorge.perez.burgos(a)ericsson.com wrote: > Full_Name: Jorge Perez Burgos > Version: 2.4.21 > OS: SLES 10 SP3 x86_64 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.235.15.243) > > > Our slapd uses 256 threads Why do you have 256 thread set? Do you have a 64-core box? --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#6948) slaptest fails a converting a working cn=config from a .conf with a pcache configuration
by tgates81＠gmail.com 22 May '11

22 May '11

Full_Name: Tyler Gates Version: 2.4.25 OS: Ubuntu 10.04 LTS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (65.184.61.44) I've been fighting with a strange issue related to a backend database using a pcache configuration since upgrading from 2.4.24 to 2.4.25. Assuming there was just something wrong with my cn=config I decided to start back fresh using slapd.conf instead. Once I got the config working just fine I used slaptest to convert the config to a new cn=config. Unfortunately when I tried using -F cn=config instead of my -f slapd.conf, slapd failed with the same old message: May 22 09:15:58 directory-proxy2 slapd[25055]: backend_startup: warning, database 0 (hdb) has no suffix May 22 09:15:58 directory-proxy2 slapd[25055]: backend_startup_one: starting "(unknown)" May 22 09:15:58 directory-proxy2 slapd[25055]: hdb_db_open: need suffix. May 22 09:15:58 directory-proxy2 slapd[25055]: backend_startup_one (type=hdb, suffix="(null)"): bi_db_open failed! (-1) May 22 09:15:58 directory-proxy2 slapd[25055]: slapd shutdown: initiated The backend database has never required me specify a suffix since it is already specified in the ldap overlay and when I try to add it in I get slapd trying to open the database twice which results in the second instance having access issues thus rendering all of the database inaccessible to queries. I'm assuming there has been a configuration change in cn=config for this particular layout but slaptest has not been updated. Below is a copy of the flat file I used that worked fine but failed once converted to cn=config using slaptest -f slapd.conf -F /etc/ldap/slapd.d/ root@directory-proxy:~# grep "^[^#]" /etc/ldap/slapd.conf.back_ldap_ppcache include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/sudo.schema include /etc/ldap/schema/autofs.schema include /etc/ldap/schema/ppolicy.schema include /etc/ldap/schema/qmail.schema include /etc/ldap/schema/puppet.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_ldap moduleload back_hdb moduleload pcache moduleload ppolicy TLSCertificateFile /etc/ldap/ssl/slapd.crt TLSCertificateKeyFile /etc/ldap/ssl/slapd.key TLSCACertificateFile /etc/ssl/certs/ca.castlebranch.com.crt loglevel -1 allow bind_anon_dn database config rootdn cn=admin,cn=config rootpw secret access to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break database ldap suffix "dc=domain,dc=com" rootdn "cn=Manager,dc=domain,dc=com" rootpw secret uri "ldaps://directory1.domain.com ldaps://directory2.domain.com" overlay pcache proxycache hdb 100000 3 1000 100 proxyAttrset 0 uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description memberUid uniqueMember objectClass proxyAttrset 1 cn automountInformation proxyAttrset 2 cn mail proxyTemplate (&(objectClass=)(|(memberUid=)(uniqueMember=))) 0 1800 proxyTemplate (&(objectClass=)(uid=)) 0 1800 proxyTemplate (&(objectClass=)(cn=)) 0 1800 proxyTemplate (&(objectClass=)) 0 1800 proxyTemplate (objectClass=) 0 1800 proxyTemplate (&(objectClass=)(memberUid=)) 0 1800 900 proxyTemplate (&(objectClass=)(uniqueMember=)) 0 1800 900 proxyTemplate (&(objectClass=)(uidNumber=)) 0 1800 proxyTemplate (&(objectClass=)(gidNumber=)) 0 1800 proxyTemplate (&(objectClass=)(|(cn=)(gidNumber=))) 1 3600 600 proxyTemplate (&(objectClass=)(|(cn=)(cn=))) 1 3600 600 proxyTemplate (&(objectClass=)(|(cn=)(cn=)(cn=))) 1 3600 600 proxyTemplate (|(cn=)(mail=)(sn=)) 2 7200 directory /var/lib/ldap cachesize 1000 idletimeout 600 idlcachesize 3000 index objectClass eq index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq index uid eq,subinitial index nisMapName,automountInformation eq index userPassword,homeDirectory,loginShell,gecos,description eq index pcacheQueryID eq

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by Tim.Mooney＠ndsu.edu 20 May '11

20 May '11

In regard to: Re: (ITS#6943) segfault in rwmmap in 2.4.25, masarati(a)aero.po...: > The bug is caused by the fact that "mapping" is always on, and slapo-rwm > checks whether there is anything it can/need to do about special > attributes, and it (incorrectly) assumed attributes have an equality rule. > It has nothing to do with the fact that you defined no rules for search > or so. > > The quick fix would be to check whether sat_equality is NULL; the > (possibly) long fix would be to entirely skip mapping when not needed. My apologies for the delay in responding. I've uploaded a patch, TimMooney-110520.patch to incoming. It tests that sat_equality is not NULL before dereferencing. Is this essentially what you had in mind as a fix? Tim

1 0

Re: (ITS#6944) Add option to limit or remove operation list cache
by quanah＠zimbra.com 20 May '11

20 May '11

--On May 19, 2011 8:03:00 AM +0000 jorge.perez.burgos(a)ericsson.com wrote: > Full_Name: Jorge Perez Burgos > Version: 2.4.21 > OS: SLES 10 SP3 x86_64 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.235.15.243) > > > Our slapd uses 256 threads Why do you have 256 thread set? Do you have a 64-core box? --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#6947) ldapadd crashes with LDIFs with invalid line termination
by jvcelak＠redhat.com 19 May '11

19 May '11

Full_Name: Jan Vcelak Version: 2.4.25 OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-20110519-ldif-countlines.patch Submission from: (NULL) (209.132.186.34) Hello, adding entries to LDAP database from file using ldapadd tool causes memory corruption error, when the last line of the input file is not terminated by '\n' character. The entries are added correctly. All version since 2.4.23 are affected. $ cat >/tmp/input.ldif << EOF > dn: cn=A,dc=my-domain,dc=com > objectClass: inetOrgPerson > objectClass: organizationalPerson > objectClass: person > objectClass: top > cn: A > sn: A > uid: A > mail: A(a)example.com > EOF $ wc -c /tmp/input.ldif 166 /tmp/input.ldif $ truncate -s 165 /tmp/input.ldif $ hexdump -c /tmp/input.ldif 0000000 d n : c n = A , d c = m y - d 0000010 o m a i n , d c = c o m \n o b j 0000020 e c t C l a s s : i n e t O r 0000030 g P e r s o n \n o b j e c t C l 0000040 a s s : o r g a n i z a t i o 0000050 n a l P e r s o n \n o b j e c t 0000060 C l a s s : p e r s o n \n o b 0000070 j e c t C l a s s : t o p \n c 0000080 n : A \n s n : A \n u i d : 0000090 A \n m a i l : A @ e x a m p l 00000a0 e . c o m 00000a5 $ ldapadd -H ldap:// -D cn=Manager,dc=my-domain,dc=com -x -w password -f /tmp/input.ldif adding new entry "cn=A,dc=my-domain,dc=com" *** glibc detected *** ldapadd: free(): invalid pointer: 0x0000000001c435c8 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3626e76d63] ldapadd[0x404505] /lib64/libc.so.6(__libc_start_main+0xfd)[0x3626e1ee5d] ldapadd[0x4037e9] ======= Memory map: ======== ... I am attaching proposed patch, which fixes this issue. Thank you Jan

1 0

(ITS#6946) ldapexop: ber_free_buf: Assertion failed
by jvcelak＠redhat.com 19 May '11

19 May '11

Full_Name: Jan Vcelak Version: 2.4.25 OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-110519-ldapexop-double-free.patch Submission from: (NULL) (209.132.186.34) Hello. A problem with crashing ldapexop was reported to our bugzilla. All versions since 2.4.24 are affected. It seems that the bug was introduced by following change in ldapexop.c. http://www.openldap.org/devel/cvsweb.cgi/clients/tools/ldapexop.c.diff?r1=1… Easy to reproduce. With clean configuration run: $ ldapexop -H ldap:// -x whoami anonymous ldapexop: ../../../libraries/liblber/io.c:186: ber_free_buf: Assertion `((ber)->ber_opts.lbo_valid==0x2)' failed. Aborted Complete steps to reproduce in Fedora are specified in the original bugreport: https://bugzilla.redhat.com/show_bug.cgi?id=699683 I think it is cause by double freeing the result. I am attaching a proposed patch. Please, review my change. Thank you. Jan

1 0

(ITS#6945) nssov does not build on older Linux distributions (RHEL3, RHEL4)
by bgmilne＠staff.telkomsa.net 19 May '11

19 May '11

Full_Name: Buchan Milne Version: 2.4.25 OS: Red Hat Enterprise Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (196.25.124.16) I am aware that these are old, and almost (or already) EOL distributions, but nssov does not build on RHEL3 and RHEL4. On RHEL3, I get: + make -C contrib/slapd-modules/nssov libdir=/usr/lib moduledir=/usr/lib/openldap2.4 make: Entering directory `/home/bgmilne/rpm/BUILD.rh3/openldap-2.4.25/contrib/slapd-modules/nssov' ../../../libtool --mode=compile gcc -g -O2 -I../../../include -I../../../include -I../../../servers/slapd -Inss-pam-ldapd -c alias.c mkdir .libs gcc -g -O2 -I../../../include -I../../../include -I../../../servers/slapd -Inss-pam-ldapd -c alias.c -fPIC -DPIC -o .libs/alias.o In file included from ../../../include/ldap_pvt_thread.h:21, from ../../../servers/slapd/slap.h:57, from nssov.h:43, from alias.c:23: ../../../include/ldap_int_thread.h:69: syntax error before "ldap_int_thread_rdwr_t" ../../../include/ldap_int_thread.h:69: warning: data definition has no type or storage class In file included from ../../../servers/slapd/slap.h:57, from nssov.h:43, from alias.c:23: ../../../include/ldap_pvt_thread.h:36: syntax error before "ldap_pvt_thread_rdwr_t" ../../../include/ldap_pvt_thread.h:36: warning: data definition has no type or storage class ../../../include/ldap_pvt_thread.h:154: syntax error before '*' token ../../../include/ldap_pvt_thread.h:157: syntax error before '*' token ../../../include/ldap_pvt_thread.h:160: syntax error before '*' token ../../../include/ldap_pvt_thread.h:163: syntax error before '*' token ../../../include/ldap_pvt_thread.h:166: syntax error before '*' token ../../../include/ldap_pvt_thread.h:169: syntax error before '*' token ../../../include/ldap_pvt_thread.h:172: syntax error before '*' token ../../../include/ldap_pvt_thread.h:175: syntax error before '*' token ../../../include/ldap_pvt_thread.h:191: syntax error before '*' token ../../../include/ldap_pvt_thread.h:194: syntax error before '*' token ../../../include/ldap_pvt_thread.h:197: syntax error before '*' token make: *** [alias.lo] Error 1 make: Leaving directory `/home/bgmilne/rpm/BUILD.rh3/openldap-2.4.25/contrib/slapd-modules/nssov' ldap_int_thread.h:69 #if defined( HAVE_PTHREAD_RWLOCK_DESTROY ) #define LDAP_THREAD_HAVE_RDWR 1 typedef pthread_rwlock_t ldap_int_thread_rdwr_t; #endif ldap_int_thread.h includes pthread.h, which includes bits/pthreadtypes.h which defines pthread_rwlock_t ... I can't see why this use fails, where the rest of OpenLDAP builds just fine prior to this. smbk5pwd is also affected. I don't have time to investigate further now, but wanted to capture what info I have now.

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by masarati＠aero.polimi.it 19 May '11

19 May '11

The bug is caused by the fact that "mapping" is always on, and slapo-rwm checks whether there is anything it can/need to do about special attributes, and it (incorrectly) assumed attributes have an equality rule. It has nothing to do with the fact that you defined no rules for search or so. The quick fix would be to check whether sat_equality is NULL; the (possibly) long fix would be to entirely skip mapping when not needed. p.

1 0

(ITS#6944) Add option to limit or remove operation list cache
by jorge.perez.burgos＠ericsson.com 19 May '11

19 May '11

Full_Name: Jorge Perez Burgos Version: 2.4.21 OS: SLES 10 SP3 x86_64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.235.15.243) Our slapd uses 256 threads with conn_max_pending_auth 5000. We have seen that with certain network traffic and conditions a huge increased in the amount of memory. After using valgrind and a little study, we have seen slapd cache operation structure in a list. These lists are per thread and could reach high values, in some cases we have seen 12500 operations cached, so 256*12500 could reach around 3GB. It's suggested adding an option to disable this cache or limit the growth of this one for future versions.

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by Tim.Mooney＠ndsu.edu 18 May '11

18 May '11

In regard to: Re: (ITS#6943) segfault in rwmmap in 2.4.25, masarati(a)aero.po...: >> We don't have any definition for apple-group-nestedgroup in any of the >> schemas that I have loaded. It's not something we support. We're also >> not doing any proxying. Note also that the search base it's using >> (cn=groups,dc=ndsu,dc=nodak,dc=edu) isn't valid. So, it's some Apple >> system on campus that someone has set up to query our LDAP tree, looking >> for things that the Mac OS X expects to find, but that we don't have or >> support. >> >> One thing that confuses me a little -- I set the rwm-rewriteContext to >> "bindDN", which I perhaps incorrectly believed meant that rewriting would >> only be done for authenticated binds (i.e. not anonymous binds), and >> this client did not authenticate. I was under the mistaken impression >> that >> rwm shouldn't even be called in cases like this. I don't (currently) need >> to >> rewrite searches or results from searches, only the bind credentials, for >> when we eventually enable support for ldap authentication. >> >> Does that answer your question? Would it be helpful to see either my >> original slapd.conf or the slapd-config that results from the conversion? > > Yes, either would be useful. Thanks, p. Here it is. Thanks, Tim #@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ #@ #@ TVM: this file is no longer used. All slapd configuration is done via #@ the LDAP/LDIF-based slapd-config(5) backend, using commands like ldapadd, #@ ldapmodify, etc. #@ #@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ # # # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # # TVM: changed all paths from /etc/openldap/schema to # /etc/local/openldap/schema. # TVM: prior slapd.conf files based on earlier distributions of openldap # had fewer default schemas included (the config file we used with 2.3.24 # on RH4 loaded only core, cosine, inetorgperson, misc, and our custom # ndusEduPerson.schema). # For the install on RHEL5, I started with the stock slapd.conf from openldap # 2.4.21 and then removed the ones I didn't think we needed, e.g. corba, # duaconf, dyngroup, java, nis, ppolicy, and collective. # #include /etc/local/openldap/schema/corba.schema include /etc/local/openldap/schema/core.schema include /etc/local/openldap/schema/cosine.schema #include /etc/local/openldap/schema/duaconf.schema #include /etc/local/openldap/schema/dyngroup.schema include /etc/local/openldap/schema/inetorgperson.schema #include /etc/local/openldap/schema/java.schema include /etc/local/openldap/schema/misc.schema #include /etc/local/openldap/schema/nis.schema include /etc/local/openldap/schema/openldap.schema #include /etc/local/openldap/schema/ppolicy.schema #include /etc/local/openldap/schema/collective.schema # # TVM: custom NDUS schema # include /etc/local/openldap/schema/ndusEduPerson.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # # TVM: the sizelimit and timelimits we've historically used for slapd # sizelimit 150 timelimit 180 # Load dynamic backend modules: # modulepath /usr/lib/openldap # or /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # # TVM: uncommented this, we need it for bindDN massaging # moduleload rwm.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /etc/pki/tls/certs/ldap.NoDak.edu.crt TLSCertificateKeyFile /etc/pki/tls/certs/ldap.NoDak.edu.key # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # # TVM: FIXME: for testing just require encryption for simple_bind # TVM: this can't be enabled until Dale's code to populate LDAP is ready # for it. #security simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # # TVM: added NDUS access controls (Note: these were at the bottom of # the older slapd.conf file before, now they're in an earlier section). # # I think we should seriously revisit these # access to filter=(cn=anonymous) attrs=cn,sn by * none # # TVM: inserted this ACL between the two that have been present since # the beginning. This is to try prevent userPassword: from showing up # in ldapsearch output, but still allow it to be used for auth # access to attrs=userPassword by anonymous auth access to * by * read # # TVM: new with our OpenLDAP 2.4.x install: load the rwm overlay # and add rules so that binds with the iid work. # overlay rwm rwm-rewriteEngine on # define a rewriteMap function that returns the dn for a particular attr # This is straight out of the first bindDN example in slapo-rwm(5) rwm-rewriteMap ldap attr2dn "ldap://localhost/dc=nodak,dc=edu?dn?sub" rwm-rewriteContext bindDN # and now the magic: parse out the IID and pass it to the attr2dn function. # This is also almost exactly taken from slapo-rwm(5), though I'm using iid # instead of mail and I'm not anchoring the regex and using $1, so it doesn't # matter if it's qualified or not. rwm-rewriteRule "^(iid=[^, ]+).*" "${attr2dn($1)}" ":@I" ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database hdb suffix "dc=nodak,dc=edu" checkpoint 1024 15 # # TVM: I added these settings as part of the migration to 2.4.x. # These are pure guesses. If memory is still available, we should # probably increase both. Note section 21.4.3 of the guide, that indicates # the idlcachesize should match cachesize when using bdb, but it should # be 3*cachesize for hdb, which doesn't really make a lot # of sense to me, but oh well... See slapd-bdb for more info # cachesize 2048 idlcachesize 6144 # # TVM: using System V shared memory is much faster for recent versions of # the Linux kernel than using mmap(2) files, so we'll give it a try. # # shm_key can be anything, it just identifies a shared memory segment that # BDB can use for its shared memory regions. # shm_key 41 rootdn "cn=Someone Hidden, dc=ndsu, dc=nodak, dc=edu" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SHA}ceHixPjpYAryAobGXZyzztpweto= # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/data-1 # # Indices to maintain for this database # # TVM: with openldap 2.3.24 on RHEL4 we just commented all of these out and # added our own, some of which exactly duplicated these. I'll keep the first # two index lines and comment out the next three, then supplment with ours. # # Also, previously we maintained a presence (pres) index on *every* one of # these. Section 21.2.3 of the OpenLDAP admin guide makes it very clear # that presence indexing is almost always a bad idea. With that in mind, # I've removed presence indexing from all of these. # index objectClass eq index ou,cn,mail,surname,givenname eq,sub #index uidNumber,gidNumber,loginShell eq #index uid,memberUid eq,sub #index nisMapName,nisMapEntry eq,sub # # TVM: added indexes on all of these. # index mailLocalAddress,mailRoutingAddress,nid eq index iid,uid,services eq,sub index class,college,major eq,sub index group,department,institution,title eq,sub index physicalDeliveryOfficeName,telephoneNumber eq,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM # # TVM: this is new with 2.4.x, we'll leave it enabled, see chapter 20 of # the admin guide. # # enable monitoring database monitor rootdn "cn=Someone Hidden, dc=ndsu, dc=nodak, dc=edu" # allow only rootdn to read the monitor access to * by * none

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by masarati＠aero.polimi.it 18 May '11

18 May '11

> In regard to: Re: (ITS#6943) segfault in rwmmap in 2.4.25, Pierangelo...: > >>> At the time of the search, the very last thing that was logged was >>> >>> May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH >>> base="cn=groups,dc=ndsu,dc=nodak,dc=edu" scope=2 deref=0 >>> filter="(&(?objectClass=posixGroup)(?objectClass=apple-group)(objectClass=extensibleObject)(|(?apple-group-nestedgroup=ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000001B)))" >>> >>> May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH attr=cn >>> apple-generateduid gidNumber apple-group-realname ttl sambaSID rid >>> primaryGroupID apple-keyword apple-group-nestedgroup >>> >>> >>> I'll happily provide any details that I've mistakenly left out or that >>> would >>> aid >>> in debugging the issue. >>> >>> The issue certainly could be caused by an error in my rwmRewriteRule, >>> but I >>> imagine that slapd shouldn't segfault even if my rwmRewriteRule is >>> wrong. >> >> Yes (I believe), and yes. I believe the mapping is being applied to an >> attribute that is not explicitly defined in the schema, but rather >> proxied or >> somehow treated as undefined. For this reason, the matching rule >> pointer is >> NULL. Can you check the definition of "apple-group-nestedgroup", if >> any? Of >> course, slapo-rwm should not crash on something like this. > > Thank you Pierangelo. > > We don't have any definition for apple-group-nestedgroup in any of the > schemas that I have loaded. It's not something we support. We're also > not doing any proxying. Note also that the search base it's using > (cn=groups,dc=ndsu,dc=nodak,dc=edu) isn't valid. So, it's some Apple > system on campus that someone has set up to query our LDAP tree, looking > for things that the Mac OS X expects to find, but that we don't have or > support. > > One thing that confuses me a little -- I set the rwm-rewriteContext to > "bindDN", which I perhaps incorrectly believed meant that rewriting would > only be done for authenticated binds (i.e. not anonymous binds), and > this client did not authenticate. I was under the mistaken impression > that > rwm shouldn't even be called in cases like this. I don't (currently) need > to > rewrite searches or results from searches, only the bind credentials, for > when we eventually enable support for ldap authentication. > > Does that answer your question? Would it be helpful to see either my > original slapd.conf or the slapd-config that results from the conversion? Yes, either would be useful. Thanks, p.

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by Tim.Mooney＠ndsu.edu 18 May '11

18 May '11

In regard to: Re: (ITS#6943) segfault in rwmmap in 2.4.25, Pierangelo...: >> At the time of the search, the very last thing that was logged was >> >> May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH >> base="cn=groups,dc=ndsu,dc=nodak,dc=edu" scope=2 deref=0 >> filter="(&(?objectClass=posixGroup)(?objectClass=apple-group)(objectClass=extensibleObject)(|(?apple-group-nestedgroup=ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000001B)))" >> >> May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH attr=cn >> apple-generateduid gidNumber apple-group-realname ttl sambaSID rid >> primaryGroupID apple-keyword apple-group-nestedgroup >> >> >> I'll happily provide any details that I've mistakenly left out or that would >> aid >> in debugging the issue. >> >> The issue certainly could be caused by an error in my rwmRewriteRule, but I >> imagine that slapd shouldn't segfault even if my rwmRewriteRule is wrong. > > Yes (I believe), and yes. I believe the mapping is being applied to an > attribute that is not explicitly defined in the schema, but rather proxied or > somehow treated as undefined. For this reason, the matching rule pointer is > NULL. Can you check the definition of "apple-group-nestedgroup", if any? Of > course, slapo-rwm should not crash on something like this. Thank you Pierangelo. We don't have any definition for apple-group-nestedgroup in any of the schemas that I have loaded. It's not something we support. We're also not doing any proxying. Note also that the search base it's using (cn=groups,dc=ndsu,dc=nodak,dc=edu) isn't valid. So, it's some Apple system on campus that someone has set up to query our LDAP tree, looking for things that the Mac OS X expects to find, but that we don't have or support. One thing that confuses me a little -- I set the rwm-rewriteContext to "bindDN", which I perhaps incorrectly believed meant that rewriting would only be done for authenticated binds (i.e. not anonymous binds), and this client did not authenticate. I was under the mistaken impression that rwm shouldn't even be called in cases like this. I don't (currently) need to rewrite searches or results from searches, only the bind credentials, for when we eventually enable support for ldap authentication. Does that answer your question? Would it be helpful to see either my original slapd.conf or the slapd-config that results from the conversion? Thanks much, Tim

1 0

Re: (ITS#6943) segfault in rwmmap in 2.4.25
by masarati＠aero.polimi.it 18 May '11

18 May '11

On 05/18/2011 12:42 AM, Tim.Mooney(a)ndsu.edu wrote: > Full_Name: Tim Mooney > Version: 2.4.25 > OS: Linux, RHEL 5.6 x86_64 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (2001:4930:106:0:18bb:1140:fa3d:f713) > > > Recently replaced an OpenLDAP 2.3.x server with a newer system running RHEL 5.6 > x86_64. OpenLDAP 2.4.25 + Berkeley DB 4.8.30, built as x86_64 also. We've had > slapd segfault several times now, and the most recent time it happened, I had > slapd running under gdb and caught where it was happening. > > As part of the server and OpenLDAP replacement, we're beginning to support ldap > authentication via SASL pass-through to Kerberos. With the authentication, we > also have the need to do DN rewriting at auth time, which is why I've enabled > rwm and have the following in slapd-config: > > dn: olcOverlay={0}rwm,olcDatabase={-1}frontend,cn=config > objectClass: olcOverlayConfig > objectClass: olcRwmConfig > olcOverlay: {0}rwm > olcRwmRewrite: {0}rwm-rewriteEngine "on" > olcRwmRewrite: {1}rwm-rewriteMap "ldap" "attr2dn" "ldap://localhost/dc=nodak,d > c=edu?dn?sub" > olcRwmRewrite: {2}rwm-rewriteContext "bindDN" > olcRwmRewrite: {3}rwm-rewriteRule "^(iid=[^, ]+).*" "${attr2dn($1)}" ":@I" > olcRwmTFSupport: false > olcRwmNormalizeMapped: FALSE > structuralObjectClass: olcRwmConfig > > > This was generated via the automatic conversion from slapd.conf, the original > entries in slapd.conf were: > > # > # TVM: new with our OpenLDAP 2.4.x install: load the rwm overlay > # and add rules so that binds with the iid work. > # > overlay rwm > rwm-rewriteEngine on > > # define a rewriteMap function that returns the dn for a particular attr > # This is straight out of the first bindDN example in slapo-rwm(5) > rwm-rewriteMap ldap attr2dn "ldap://localhost/dc=nodak,dc=edu?dn?sub" > > rwm-rewriteContext bindDN > # and now the magic: parse out the IID and pass it to the attr2dn function. > # This is also almost exactly taken from slapo-rwm(5), though I'm using iid > # instead of mail and I'm not anchoring the regex and using $1, so it doesn't > # matter if it's qualified or not. > rwm-rewriteRule "^(iid=[^, ]+).*" "${attr2dn($1)}" ":@I" > > > With those rewrite rules in place, certain searches have been triggering the > slapd segfault. > > The segfault: > > [root@server2 ldap]# /etc/init.d/NDUS_ldap stop; gdb /usr/local/sbin/slapd > Stopping slapd: [ OK ] > GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-32.el5_6.2) > Copyright (C) 2009 Free Software Foundation, Inc. > License GPLv3+: GNU GPL version 3 or later<http://gnu.org/licenses/gpl.html> > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. Type "show copying" > and "show warranty" for details. > This GDB was configured as "x86_64-redhat-linux-gnu". > For bug reporting instructions, please see: > <http://www.gnu.org/software/gdb/bugs/>... > > warning: no loadable sections found in added symbol-file system-supplied DSO at > 0x2aaaaaf47000 > [Thread debugging using libthread_db enabled] > [New process 5168] > [Thread debugging using libthread_db enabled] > [New Thread 0x40800940 (LWP 5169)] > [New Thread 0x41001940 (LWP 5170)] > [New Thread 0x41802940 (LWP 5182)] > [New Thread 0x42003940 (LWP 5183)] > [New Thread 0x42804940 (LWP 5302)] > [New Thread 0x43005940 (LWP 5303)] > [New Thread 0x43806940 (LWP 7677)] > > Program received signal SIGSEGV, Segmentation fault. > [Switching to Thread 0x42804940 (LWP 5302)] > 0x00002aaab0a4e95e in map_attr_value (dc=0x428028a0, adp=0x428026b8, > mapped_attr=0x428026a0, value=0x2aaae10015d0, mapped_value=0x42802690, > remap=0, memctx=0x2aaadbb91740) > at ../../../../servers/slapd/overlays/rwmmap.c:439 > 439 } else if ( ad->ad_type->sat_equality->smr_usage& > SLAP_MR_MUTATION_NORMALIZER ) { > Load new symbol table from "/usr/local/sbin/slapd"? (y or n) y > Reading symbols from /usr/local/sbin/slapd...done. > > (gdb) where > #0 0x00002aaab0a4e95e in map_attr_value (dc=0x428028a0, adp=0x428026b8, > mapped_attr=0x428026a0, value=0x2aaae10015d0, mapped_value=0x42802690, > remap=0, memctx=0x2aaadbb91740) > at ../../../../servers/slapd/overlays/rwmmap.c:439 > #1 0x00002aaab0a4ee87 in rwm_int_filter_map_rewrite (op=0x2aaadbb91380, > dc=0x428028a0, f=0x2aaae1001688, fstr=0x42802730) > at ../../../../servers/slapd/overlays/rwmmap.c:528 > #2 0x00002aaab0a4edba in rwm_int_filter_map_rewrite (op=0x2aaadbb91380, > dc=0x428028a0, f=0x2aaae10016b0, fstr=0x428027d0) > at ../../../../servers/slapd/overlays/rwmmap.c:691 > #3 0x00002aaab0a4edba in rwm_int_filter_map_rewrite (op=0x2aaadbb91380, > dc=0x428028a0, f=0x0, fstr=0x428028c0) > at ../../../../servers/slapd/overlays/rwmmap.c:691 > #4 0x00002aaab0a4f5eb in rwm_filter_map_rewrite (op=0x2aaaaaf29fc0, > dc=0x2aaaaaeab420, f=0x0, fstr=0x2aaaaaf67740) > at ../../../../servers/slapd/overlays/rwmmap.c:793 > #5 0x00002aaab0a4b542 in rwm_op_search (op=0x2aaadbb91380, rs=0x42803c10) > at ../../../../servers/slapd/overlays/rwm.c:969 > #6 0x00002aaaaab5ee0a in overlay_op_walk (op=0x2aaadbb91380, rs=0x42803c10, > which=op_search, oi=0x2aaaab01e060, on=0x2aaaab01e240) > at ../../../servers/slapd/backover.c:659 > #7 0x00002aaaaab5f418 in over_op_func (op=0x2aaadbb91380, rs=0x42803c10, > which=op_search) at ../../../servers/slapd/backover.c:721 > #8 0x00002aaaaaaf7325 in do_search (op=0x2aaadbb91380, rs=0x42803c10) > at ../../../servers/slapd/search.c:217 > #9 0x00002aaaaaaf4644 in connection_operation (ctx=0x42803d60, > arg_v=<value optimized out>) at ../../../servers/slapd/connection.c:1113 > #10 0x00002aaaaaaf4ca1 in connection_read_thread (ctx=0x42803d60, > argv=<value optimized out>) at ../../../servers/slapd/connection.c:1249 > #11 0x00002aaaaabf3d08 in ldap_int_thread_pool_wrapper (xpool=0x2aaaaaf7dfa0) > at ../../../libraries/libldap_r/tpool.c:685 > #12 0x00002aaaad5b973d in start_thread () from /lib64/libpthread.so.0 > #13 0x00002aaaadaac0cd in clone () from /lib64/libc.so.6 > (gdb) print dc > $1 = (dncookie *) 0x428028a0 > (gdb) print *dc > $2 = {rwmap = 0x2aaaab01e420, conn = 0x2aaab0c70330, > ctx = 0x2aaab0a50519 "searchFilterAttrDN", rs = 0x42803c10} > (gdb) print dc->rwmap > $3 = (struct ldaprwmap *) 0x2aaaab01e420 > (gdb) print *(dc->rwmap) > $4 = {rwm_rw = 0x2aaaab01e480, rwm_bva_rewrite = 0x2aaaab023a50, rwm_oc = { > drop_missing = 0, map = 0x0, remap = 0x0}, rwm_at = {drop_missing = 0, > map = 0x0, remap = 0x0}, rwm_bva_map = 0x0, rwm_flags = 2} > > (gdb) print adp > $5 = (AttributeDescription **) 0x428026b8 > (gdb) print *adp > $6 = (AttributeDescription *) 0x2aaae10015f0 > (gdb) print **adp > $7 = {ad_next = 0x7564652e6b61646f, ad_type = 0x2aaaaaeab420, ad_cname = { > bv_len = 23, bv_val = 0x2aaae1001628 "apple-group-nestedgroup"}, > ad_tags = {bv_len = 145, bv_val = 0x91<Address 0x91 out of bounds>}, > ad_flags = 4096} > (gdb) print ad->ad_type->sat_equality->smr_usage > Cannot access memory at address 0x58 > > > > (gdb) print ad->ad_type->sat_equality > $8 = (MatchingRule *) 0x0 > > (gdb) print *(ad->ad_type) > $10 = {sat_atype = {at_oid = 0x2aaaaac38a54 "1.1.1", at_names = 0x0, > at_desc = 0x2aaaaac35d10 "Catchall for undefined attribute types", > at_obsolete = 1, at_sup_oid = 0x0, at_equality_oid = 0x0, > at_ordering_oid = 0x0, at_substr_oid = 0x0, at_syntax_oid = 0x0, > at_syntax_len = 0, at_single_value = 0, at_collective = 0, > at_no_user_mod = 1, at_usage = 3, at_extensions = 0x0}, sat_cname = { > bv_len = 9, bv_val = 0x2aaaaac38a5a "UNDEFINED"}, sat_sup = 0x0, > sat_subtypes = 0x0, sat_equality = 0x0, sat_approx = 0x0, > sat_ordering = 0x0, sat_substr = 0x0, sat_syntax = 0x2aaaaaf694e0, > sat_check = 0, sat_oidmacro = 0x0, sat_soidmacro = 0x0, sat_flags = 768, > sat_next = {stqe_next = 0x0}, sat_ad = 0x0, sat_ad_mutex = {__data = { > __lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, > __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, > __size = '\000'<repeats 39 times>, __align = 0}} > (gdb) print value > $11 = (struct berval *) 0x2aaae10015d0 > (gdb) print *value > $12 = {bv_len = 36, > bv_val = 0x2aaae1001650 "ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000001B"} > (gdb) print *mapped_value > $13 = {bv_len = 0, bv_val = 0x2aaae10015a0 "\243"} > (gdb) print *mapped_attr > $14 = {bv_len = 23, bv_val = 0x2aaae1001628 "apple-group-nestedgroup"} > > > At the time of the search, the very last thing that was logged was > > May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH > base="cn=groups,dc=ndsu,dc=nodak,dc=edu" scope=2 deref=0 > filter="(&(?objectClass=posixGroup)(?objectClass=apple-group)(objectClass=extensibleObject)(|(?apple-group-nestedgroup=ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000001B)))" > > May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH attr=cn > apple-generateduid gidNumber apple-group-realname ttl sambaSID rid > primaryGroupID apple-keyword apple-group-nestedgroup > > > I'll happily provide any details that I've mistakenly left out or that would aid > in debugging the issue. > > The issue certainly could be caused by an error in my rwmRewriteRule, but I > imagine that slapd shouldn't segfault even if my rwmRewriteRule is wrong. Yes (I believe), and yes. I believe the mapping is being applied to an attribute that is not explicitly defined in the schema, but rather proxied or somehow treated as undefined. For this reason, the matching rule pointer is NULL. Can you check the definition of "apple-group-nestedgroup", if any? Of course, slapo-rwm should not crash on something like this. p.

1 0

(ITS#6943) segfault in rwmmap in 2.4.25
by Tim.Mooney＠ndsu.edu 17 May '11

17 May '11

Full_Name: Tim Mooney Version: 2.4.25 OS: Linux, RHEL 5.6 x86_64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:4930:106:0:18bb:1140:fa3d:f713) Recently replaced an OpenLDAP 2.3.x server with a newer system running RHEL 5.6 x86_64. OpenLDAP 2.4.25 + Berkeley DB 4.8.30, built as x86_64 also. We've had slapd segfault several times now, and the most recent time it happened, I had slapd running under gdb and caught where it was happening. As part of the server and OpenLDAP replacement, we're beginning to support ldap authentication via SASL pass-through to Kerberos. With the authentication, we also have the need to do DN rewriting at auth time, which is why I've enabled rwm and have the following in slapd-config: dn: olcOverlay={0}rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmRewrite: {0}rwm-rewriteEngine "on" olcRwmRewrite: {1}rwm-rewriteMap "ldap" "attr2dn" "ldap://localhost/dc=nodak,d c=edu?dn?sub" olcRwmRewrite: {2}rwm-rewriteContext "bindDN" olcRwmRewrite: {3}rwm-rewriteRule "^(iid=[^, ]+).*" "${attr2dn($1)}" ":@I" olcRwmTFSupport: false olcRwmNormalizeMapped: FALSE structuralObjectClass: olcRwmConfig This was generated via the automatic conversion from slapd.conf, the original entries in slapd.conf were: # # TVM: new with our OpenLDAP 2.4.x install: load the rwm overlay # and add rules so that binds with the iid work. # overlay rwm rwm-rewriteEngine on # define a rewriteMap function that returns the dn for a particular attr # This is straight out of the first bindDN example in slapo-rwm(5) rwm-rewriteMap ldap attr2dn "ldap://localhost/dc=nodak,dc=edu?dn?sub" rwm-rewriteContext bindDN # and now the magic: parse out the IID and pass it to the attr2dn function. # This is also almost exactly taken from slapo-rwm(5), though I'm using iid # instead of mail and I'm not anchoring the regex and using $1, so it doesn't # matter if it's qualified or not. rwm-rewriteRule "^(iid=[^, ]+).*" "${attr2dn($1)}" ":@I" With those rewrite rules in place, certain searches have been triggering the slapd segfault. The segfault: [root@server2 ldap]# /etc/init.d/NDUS_ldap stop; gdb /usr/local/sbin/slapd Stopping slapd: [ OK ] GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-32.el5_6.2) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... warning: no loadable sections found in added symbol-file system-supplied DSO at 0x2aaaaaf47000 [Thread debugging using libthread_db enabled] [New process 5168] [Thread debugging using libthread_db enabled] [New Thread 0x40800940 (LWP 5169)] [New Thread 0x41001940 (LWP 5170)] [New Thread 0x41802940 (LWP 5182)] [New Thread 0x42003940 (LWP 5183)] [New Thread 0x42804940 (LWP 5302)] [New Thread 0x43005940 (LWP 5303)] [New Thread 0x43806940 (LWP 7677)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x42804940 (LWP 5302)] 0x00002aaab0a4e95e in map_attr_value (dc=0x428028a0, adp=0x428026b8, mapped_attr=0x428026a0, value=0x2aaae10015d0, mapped_value=0x42802690, remap=0, memctx=0x2aaadbb91740) at ../../../../servers/slapd/overlays/rwmmap.c:439 439 } else if ( ad->ad_type->sat_equality->smr_usage & SLAP_MR_MUTATION_NORMALIZER ) { Load new symbol table from "/usr/local/sbin/slapd"? (y or n) y Reading symbols from /usr/local/sbin/slapd...done. (gdb) where #0 0x00002aaab0a4e95e in map_attr_value (dc=0x428028a0, adp=0x428026b8, mapped_attr=0x428026a0, value=0x2aaae10015d0, mapped_value=0x42802690, remap=0, memctx=0x2aaadbb91740) at ../../../../servers/slapd/overlays/rwmmap.c:439 #1 0x00002aaab0a4ee87 in rwm_int_filter_map_rewrite (op=0x2aaadbb91380, dc=0x428028a0, f=0x2aaae1001688, fstr=0x42802730) at ../../../../servers/slapd/overlays/rwmmap.c:528 #2 0x00002aaab0a4edba in rwm_int_filter_map_rewrite (op=0x2aaadbb91380, dc=0x428028a0, f=0x2aaae10016b0, fstr=0x428027d0) at ../../../../servers/slapd/overlays/rwmmap.c:691 #3 0x00002aaab0a4edba in rwm_int_filter_map_rewrite (op=0x2aaadbb91380, dc=0x428028a0, f=0x0, fstr=0x428028c0) at ../../../../servers/slapd/overlays/rwmmap.c:691 #4 0x00002aaab0a4f5eb in rwm_filter_map_rewrite (op=0x2aaaaaf29fc0, dc=0x2aaaaaeab420, f=0x0, fstr=0x2aaaaaf67740) at ../../../../servers/slapd/overlays/rwmmap.c:793 #5 0x00002aaab0a4b542 in rwm_op_search (op=0x2aaadbb91380, rs=0x42803c10) at ../../../../servers/slapd/overlays/rwm.c:969 #6 0x00002aaaaab5ee0a in overlay_op_walk (op=0x2aaadbb91380, rs=0x42803c10, which=op_search, oi=0x2aaaab01e060, on=0x2aaaab01e240) at ../../../servers/slapd/backover.c:659 #7 0x00002aaaaab5f418 in over_op_func (op=0x2aaadbb91380, rs=0x42803c10, which=op_search) at ../../../servers/slapd/backover.c:721 #8 0x00002aaaaaaf7325 in do_search (op=0x2aaadbb91380, rs=0x42803c10) at ../../../servers/slapd/search.c:217 #9 0x00002aaaaaaf4644 in connection_operation (ctx=0x42803d60, arg_v=<value optimized out>) at ../../../servers/slapd/connection.c:1113 #10 0x00002aaaaaaf4ca1 in connection_read_thread (ctx=0x42803d60, argv=<value optimized out>) at ../../../servers/slapd/connection.c:1249 #11 0x00002aaaaabf3d08 in ldap_int_thread_pool_wrapper (xpool=0x2aaaaaf7dfa0) at ../../../libraries/libldap_r/tpool.c:685 #12 0x00002aaaad5b973d in start_thread () from /lib64/libpthread.so.0 #13 0x00002aaaadaac0cd in clone () from /lib64/libc.so.6 (gdb) print dc $1 = (dncookie *) 0x428028a0 (gdb) print *dc $2 = {rwmap = 0x2aaaab01e420, conn = 0x2aaab0c70330, ctx = 0x2aaab0a50519 "searchFilterAttrDN", rs = 0x42803c10} (gdb) print dc->rwmap $3 = (struct ldaprwmap *) 0x2aaaab01e420 (gdb) print *(dc->rwmap) $4 = {rwm_rw = 0x2aaaab01e480, rwm_bva_rewrite = 0x2aaaab023a50, rwm_oc = { drop_missing = 0, map = 0x0, remap = 0x0}, rwm_at = {drop_missing = 0, map = 0x0, remap = 0x0}, rwm_bva_map = 0x0, rwm_flags = 2} (gdb) print adp $5 = (AttributeDescription **) 0x428026b8 (gdb) print *adp $6 = (AttributeDescription *) 0x2aaae10015f0 (gdb) print **adp $7 = {ad_next = 0x7564652e6b61646f, ad_type = 0x2aaaaaeab420, ad_cname = { bv_len = 23, bv_val = 0x2aaae1001628 "apple-group-nestedgroup"}, ad_tags = {bv_len = 145, bv_val = 0x91 <Address 0x91 out of bounds>}, ad_flags = 4096} (gdb) print ad->ad_type->sat_equality->smr_usage Cannot access memory at address 0x58 (gdb) print ad->ad_type->sat_equality $8 = (MatchingRule *) 0x0 (gdb) print *(ad->ad_type) $10 = {sat_atype = {at_oid = 0x2aaaaac38a54 "1.1.1", at_names = 0x0, at_desc = 0x2aaaaac35d10 "Catchall for undefined attribute types", at_obsolete = 1, at_sup_oid = 0x0, at_equality_oid = 0x0, at_ordering_oid = 0x0, at_substr_oid = 0x0, at_syntax_oid = 0x0, at_syntax_len = 0, at_single_value = 0, at_collective = 0, at_no_user_mod = 1, at_usage = 3, at_extensions = 0x0}, sat_cname = { bv_len = 9, bv_val = 0x2aaaaac38a5a "UNDEFINED"}, sat_sup = 0x0, sat_subtypes = 0x0, sat_equality = 0x0, sat_approx = 0x0, sat_ordering = 0x0, sat_substr = 0x0, sat_syntax = 0x2aaaaaf694e0, sat_check = 0, sat_oidmacro = 0x0, sat_soidmacro = 0x0, sat_flags = 768, sat_next = {stqe_next = 0x0}, sat_ad = 0x0, sat_ad_mutex = {__data = { __lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}} (gdb) print value $11 = (struct berval *) 0x2aaae10015d0 (gdb) print *value $12 = {bv_len = 36, bv_val = 0x2aaae1001650 "ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000001B"} (gdb) print *mapped_value $13 = {bv_len = 0, bv_val = 0x2aaae10015a0 "\243"} (gdb) print *mapped_attr $14 = {bv_len = 23, bv_val = 0x2aaae1001628 "apple-group-nestedgroup"} At the time of the search, the very last thing that was logged was May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH base="cn=groups,dc=ndsu,dc=nodak,dc=edu" scope=2 deref=0 filter="(&(?objectClass=posixGroup)(?objectClass=apple-group)(objectClass=extensibleObject)(|(?apple-group-nestedgroup=ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000001B)))" May 17 17:03:03 server2 slapd[5168]: conn=28588 op=3 SRCH attr=cn apple-generateduid gidNumber apple-group-realname ttl sambaSID rid primaryGroupID apple-keyword apple-group-nestedgroup I'll happily provide any details that I've mistakenly left out or that would aid in debugging the issue. The issue certainly could be caused by an error in my rwmRewriteRule, but I imagine that slapd shouldn't segfault even if my rwmRewriteRule is wrong.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs