- openldap-bugs - openldap.org

(ITS#5867) back-config does not return sizeLimitExceeded
by h.b.furuseth＠usit.uio.no 20 Dec '08

20 Dec '08

Full_Name: Hallvard B Furuseth Version: HEAD, RE24 OS: Linux URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard back-config obeys sizelimit, but returns success instead of sizeLimitExceeded. slapd.conf: database config access to * by * read sizelimit 2 $ ldapsearch -xhlocalhost:3890 -b cn=config 1.1 # extended LDIF # (...) # config dn: cn=config # schema, config dn: cn=schema,cn=config # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2

1 0

(ITS#5866) syncrepl : all entries not replicated (glue entryCSN problem)
by julien.combes＠i-carre.net 19 Dec '08

19 Dec '08

Full_Name: Julien Combes Version: 2.4.13 OS: debian 4.0 etch URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.23.162.38) Hello, I am studying the migration of my architecture from 2.3.39 to 2.4.13. The provider is in 2.4.13. I have a problem with syncrepl (and delta-syncrepl) with two consumers in openldap 2.4.13 when I start them with an empty database : some entries are not replicated. A consumer with openldap 2.3.39 is not affected by the problem : all entries are replicated correctly. All consumers are using the same replication account. As I am in a testing environment, I have retried several times the test: every time, the same entries are not replicated on both consumers. All entries not replicated are "organizationalUnit" on the provider and have entries below them. All entries below them are correctly replicated. With a slapcat on the consumers I can see that the entries not replicated are "glue". Servers : -> provider : openldap 2.4.13, BDB 4.7.25 - number of entries : 191961 -> consumer-1 : openldap 2.4.13, BDB 4.7.25 - number of entries after replication : 191937 -> consumer-2 : openldap 2.4.13, BDB 4.7.25 - number of entries after replication : 191937 -> consumer-3 : openldap 2.3.39, BDB 4.2.52 - number of entries after replication : 191961 The logfile (sync, stats) indicate that : -> one entry below the organizationalUnit (not replicated) is replicated before the organizationalUnit itself Dec 18 18:18:17 consumer-2 slapd[13897]: syncrepl_entry: rid=003 mineqRDN=_uid_john.doe,ou=foo6,ou=foo5,ou=foo4,ou=foo3,ou=foo2,ou=foo,ou=bar,dc=my,dc=domain -> when it's the turn of this organizationalUnit to be replicated, the log indicate lignes like that : Dec 18 18:18:17 consumer-2 slapd[13897]: syncrepl_entry: rid=003 ou=foo6,ou=foo5,ou=foo4,ou=foo3,ou=foo2,ou=foo,ou=bar,dc=my,dc=domain Dec 18 18:18:17 consumer-2 slapd[13897]: syncrepl_entry: rid=003 be_add (68) Dec 18 18:18:17 consumer-2 slapd[13897]: dn_callback : new entry is older than ours ou=foo6,ou=foo5,ou=foo4,ou=foo3,ou=foo2,ou=foo,ou=bar,dc=my,dc=domain ours 20081204104512.468400Z#000000#000#000000, new 20081020233519.000000Z#000018#000#000000 Dec 18 18:18:17 consumer-2 slapd[13897]: syncrepl_entry: rid=003 entry unchanged, ignored (ou=foo6,ou=foo5,ou=foo4,ou=foo3,ou=foo2,ou=foo,ou=bar,dc=my,dc=domain) About the entryCSN of this log : -> "ours 20081204104512.468400Z#000000#000#000000" seems to be the entryCSN of the entry below replicated befor the organizationalUnit : On consumer-[12] : dn: mineqRDN=_uid_john.doe,ou=foo6,ou=foo5,ou=foo4,ou=foo3,ou=foo2,ou=foo,ou=bar,dc=my,dc=domain entryCSN: 20081204104512.468400Z#000000#000#000000 On Provider : dn: mineqRDN=_uid_john.doe,ou=foo6,ou=foo5,ou=foo4,ou=foo3,ou=foo2,ou=foo,ou=bar,dc=my,dc=domain entryCSN: 20081204104512.468400Z#000000#000#000000 -> "new 20081020233519.000000Z#000018#000#000000" is the entryCSN of the organisazionalUnit on the provider : dn: ou=foo6,ou=foo5,ou=foo4,ou=foo3,ou=foo2,ou=foo,ou=bar,dc=my,dc=domain entryCSN: 20081020233519.000000Z#000018#000#000000 All servers are a the same time. Configuration files : ===================================================================== provider : openldap 2.4.13, BDB 4.7.25 ===================================================================== include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/pamela.schema include /etc/ldap/schema/rfc2739.schema include /etc/ldap/schema/samba.schema sizelimit 5000 timelimit 10 pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel stats sync modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov moduleload accesslog moduleload back_monitor defaultsearchbase "dc=my,dc=domain" TLSCACertificateFile /etc/certs/CA_cert.pem TLSCertificateFile /etc/certs/provider.my.domain.pem TLSCertificateKeyFile /etc/certs/provider.my.domain.key access to dn.subtree="cn=monitor" by peername.ip=127.0.0.1 read by * none access to dn.subtree="cn=accesslog" by dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" read by dn.base="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" read by * none access to attrs=userPassword by dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by dn.base="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" read by anonymous auth by self write by * none access to * by dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by dn.base="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" read by * read database hdb suffix "cn=accesslog" rootdn "cn=accesslog" directory "/var/lib/ldap/accesslog" index entryCSN,objectClass,reqEnd,reqResult,reqStart eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.base="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited database hdb suffix "dc=my,dc=domain" directory "/var/lib/ldap/database" cachesize 75000 cachefree 1000 idlcachesize 225000 heckpoint 512 10 index objectClass eq index mineqMelPartages,mineqLiensImport,mineqMelmailEmission,cn pres,eq,sub index mail pres,eq index uid,mineqMelMembres,employeeNumber,ou,gidnumber,uidNumber,mineqTypeEntree,sn,drink,aliasedObjectName,memberUid pres,eq index entryCSN,entryUUID eq lastmod on overlay syncprov syncprov-checkpoint 100 10 overlay accesslog logdb "cn=accesslog" logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 limits dn.base="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited database monitor ===================================================================== consumer-1 : openldap 2.4.13, BDB 4.7.25 ===================================================================== allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/pamela.schema include /etc/ldap/schema/rfc2739.schema include /etc/ldap/schema/samba.schema sizelimit 20000 pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel stats sync modulepath /usr/lib/ldap moduleload back_hdb moduleload back_monitor defaultsearchbase "dc=my,dc=domain" TLSCACertificateFile /etc/certs/CA_cert.pem TLSCertificateFile /etc/certs/consumer-01.my.domain.pem TLSCertificateKeyFile /etc/certs/consumer-01.my.domain.key access to dn.subtree="cn=monitor" by peername.ip=127.0.0.1 read by * none access to attrs=userPassword by dn="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by anonymous auth by self write by * none access to * by dn="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by * read database hdb suffix "dc=my,dc=domain" rootdn "dc=my,dc=domain" limits dn.exact="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited syncrepl rid=2 provider=ldaps://provider.my.domain type=refreshAndPersist retry="10 3 30 3 60 +" searchbase="dc=my,dc=domain" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" credentials=<secret> logbase="cn=accesslog" syncdata=accesslog updateref ldaps://provider.my.domain directory "/var/lib/ldap/database" cachesize 75000 cachefree 1000 idlcachesize 225000 checkpoint 0 10 index objectClass eq index uid,mail pres,eq index cn pres,eq,sub index entryCSN,entryUUID eq lastmod on database monitor ===================================================================== consumer-2 : openldap 2.4.13, BDB 4.7.25 ===================================================================== include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/pamela.schema include /etc/ldap/schema/rfc2739.schema include /etc/ldap/schema/samba.schema sizelimit 5000 timelimit 10 pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel stats sync modulepath /usr/lib/ldap moduleload back_hdb moduleload back_monitor defaultsearchbase "dc=my,dc=domain" TLSCACertificateFile /etc/certs/CA_cert.pem TLSCertificateFile /etc/certs/consumer-02.my.domain.pem TLSCertificateKeyFile /etc/certs/consumer-02.my.domain.key access to dn.subtree="cn=monitor" by peername.ip=127.0.0.1 read by * none access to attrs=userPassword by dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by anonymous auth by self write by * none access to * by dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by * read database hdb suffix "dc=my,dc=domain" rootdn "dc=my,dc=domain" directory "/var/lib/ldap/database" cachesize 75000 cachefree 1000 idlcachesize 225000 checkpoint 512 10 index objectClass eq index mineqMelPartages,mineqLiensImport,mineqMelmailEmission,cn eq,sub index mail eq index uid,mineqMelMembres,employeeNumber,ou,gidnumber,uidNumber,mineqTypeEntree,sn,drink,aliasedObjectName,memberUid eq index entryCSN,entryUUID eq lastmod on syncrepl rid=3 provider=ldaps://provider.my.domain type=refreshAndPersist retry="10 3 30 3 60 +" searchbase="dc=my,dc=domain" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" credentials=<secret> updateref ldaps://provider.my.domain limits dn.base="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited database monitor ===================================================================== consumer-3 : openldap 2.3.39, BDB 4.2.52 ===================================================================== allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/pamela.schema include /etc/ldap/schema/rfc2739.schema include /etc/ldap/schema/samba.schema schemacheck on sizelimit 20000 pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel stats sync modulepath /usr/lib/ldap moduleload back_hdb moduleload back_monitor defaultsearchbase "dc=my,dc=domain" TLSCACertificateFile /etc/certs/CA_cert.pem TLSCertificateFile /etc/certs/consumer-03.my.domain.pem TLSCertificateKeyFile /etc/certs/consumer-03.my.domain.key access to dn.subtree="cn=monitor" by peername.ip=127.0.0.1 read by * none access to attrs=userPassword by dn="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by anonymous auth by self write by * none access to * by dn="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" write by * read database hdb suffix "dc=my,dc=domain" rootdn "dc=my,dc=domain" limits dn.exact="cn=admin,ou=admin,ou=ressources,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited syncrepl rid=1 provider=ldaps://provider.my.domain type=refreshAndPersist retry="10 3 30 3 60 +" searchbase="dc=my,dc=domain" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncuser.csac,ou=admin,ou=ressources,dc=my,dc=domain" credentials=<secret> logbase="cn=accesslog" syncdata=accesslog updateref ldaps://provider.my.domain directory "/var/lib/ldap/database" cachesize 75000 cachefree 1000 idlcachesize 225000 checkpoint 0 10 index objectClass eq index uid,mail eq index cn eq,sub index entryCSN,entryUUID eq lastmod on database monitor Regards, Julien

1 0

Re: (ITS#5858) Segfault with overlay ppolicy
by maniac＠maniac.nl 18 Dec '08

18 Dec '08

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_server11-8238-1229608279-0001-2 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I've figured it out... I got everything working now with 2.4.13. I had the overlay configured before the database definition... this caused the segfault. This same setup didn't segfault on 2.3.x, but still didn't work. Once I got it working on 2.3.x I migrated my config back to 2.4.13, and it works again. Still, openldap shouldn't segfault on something like this, but I am a happy camper again. Mark --=_server11-8238-1229608279-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEABECAAYFAklKVVcACgkQb6urvDV9IXjZdwCdFnV9JBfHsdiHDGunptLUs25H VJwAn3m2OQQ/lo/yJ6Z/KwWkmOqGRlZV =A0Pg -----END PGP SIGNATURE----- --=_server11-8238-1229608279-0001-2--

1 0

Re: (ITS#5859) back-hdb entrycache problem
by rhafer＠suse.de 17 Dec '08

17 Dec '08

Am Mittwoch 17 Dezember 2008 15:03:49 schrieb rhafer(a)suse.de: > This problem seems to be only present when using an empty suffix. I wasn't > able to reproduce it with a non-empty suffix at least. > > It seems to be a problem with the idlcache. After setting "idlcachesize" to > 0 the problem went a way for me. > > And yes, it seems to have been in the RE24 tree for a longer time already > (2.4.12 was affected as well). Digging a bit deeper into this, I found that only back-hdb is affected and that it is most probably a bug in hdb_dn2id_add(). It seems that after adding a new entry, hdb_dn2id_add() fails to correctly update the IDLs in the idl- cache for the entry's parent entries. The following patch seems to fix the problem for me: --- dn2id.c 31 Oct 2008 23:23:59 -0000 1.137.2.13 +++ dn2id.c 17 Dec 2008 19:45:32 -0000 @@ -620,6 +620,11 @@ tmp[1] = eip->bei_id; bdb_idl_cache_add_id( bdb, db, &key, e->e_id ); } + if ( !op->o_bd->be_suffix[0].bv_len && eip) + { + tmp[1] = eip->bei_id; + bdb_idl_cache_add_id( bdb, db, &key, e->e_id ); + } } } I suspect that hdb_dn2id_delete() has a similar issue. -- Ralf

1 0

Re: (ITS#5859) back-hdb entrycache problem
by rhafer＠suse.de 17 Dec '08

17 Dec '08

This problem seems to be only present when using an empty suffix. I wasn't able to reproduce it with a non-empty suffix at least. It seems to be a problem with the idlcache. After setting "idlcachesize" to 0 the problem went a way for me. And yes, it seems to have been in the RE24 tree for a longer time already (2.4.12 was affected as well). -- Ralf

1 0

Re: (ITS#5856) adauth overlay contribution
by neil.dunbar＠hp.com 17 Dec '08

17 Dec '08

On Tue, 2008-12-16 at 14:52 +0000, Neil Dunbar wrote: > Andrew: > > One suggestion following a very quick scan of the code: I think it > > would be worth bringing the warning about turning off TLS checks > > into the manual page. > > Agreed. Done. The tarball is uploaded as adauth-20081217.tar.gz Neil -- SSL, HP Labs/Office of Strategy and Technology Hewlett-Packard Limited Registered Office: Cain Road, Bracknell, Berks RG12 1HN Registered No: 690597 England

1 0

Re: (ITS#5863) assertion failed in ber_bvreplace_x() with translucent overlay
by quanah＠zimbra.com 16 Dec '08

16 Dec '08

--On Tuesday, December 16, 2008 3:20 PM +0000 guillaume.pujol(a)eds.com wrote: > I'm not sure if this crash is due to an incoherent configuration, or to an > interaction problem with the Active Directory backend. > In the former case, I think the server should output an error message when > started. In the later case, it is probably a bug. > > Please let me know if you need more specific information. Can you reproduce with OpenLDAP 2.4.13? --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5864) slapadd trickle task slows down slapadd when using libdb-4.5
by rhafer＠suse.de 16 Dec '08

16 Dec '08

Full_Name: Ralf Haferkamp Version: HEAD, RE24 OS: openSUSE 11.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.233.197) Regardless of the recent slapadd fixes discussed on the -devel list (http://www.openldap.org/lists/openldap-devel/200811/msg00126.html), slapadd performance is still bad when linking against berkely-db 4.5.X, there seem to be problems with libdb-4.5's memp_trickle() function. IMO we should just disable the trickle_task when linking against libdb < 4.6.

1 0

(ITS#5863) assertion failed in ber_bvreplace_x() with translucent overlay
by guillaume.pujol＠eds.com 16 Dec '08

16 Dec '08

Full_Name: Guillaume Pujol Version: 2.4.11 (latest debian package) OS: Debian Lenny URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (193.251.11.120) Hello, I have an OpenLDAP test instance configured as a translucent proxy to an Active Directory server (the later running on W2k3). The relevant database configuration (from slapd.conf) is as follows: database hdb directory /var/lib/ldap-proxy suffix "dc=eds,dc=local" index objectClass eq overlay translucent uri ldap://192.168.65.130:389 lastmod off acl-bind bindmethod=simple binddn="CN=ldapsync,CN=Users,DC=EDS,DC=local" credentials="ldapsync" idassert-bind bindmethod=simple mode=self chase-referrals yes The server loads and runs fine with this configuration, as long as no one binds. The credentials for acl-bind are valid. When I connect to the server and bind with valid credentials, the server crashes with a SIG_ABRT due to an assertion failed (backtrace below). Steps to reproduce: root@debian:~# /etc/init.d/slapd start Starting OpenLDAP: slapd. root@debian:~# ps aux | grep slapd openldap 5978 0.2 2.0 25188 5364 ? Ssl 14:21 0:00 /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf root 5983 0.0 0.2 3144 760 pts/2 R+ 14:21 0:00 grep slapd root@debian:~# ldapsearch -H ldap://192.168.65.134 -x -b dc=eds,dc=local -D "cn=myuser,cn=Users,dc=eds,dc=local" -W -LL Enter LDAP Password: <input correct password here> ldap_result: Can't contact LDAP server (-1) root@debian:~# ps aux | grep slapd root 5970 0.0 0.2 3144 764 pts/2 S+ 14:20 0:00 grep slapd # TO MAKE SURE THE SERVER WORKS FINE, I TRY TO BIND WITH A WRONG PASSWORD: root@debian:~# /etc/init.d/slapd start Starting OpenLDAP: slapd. root@debian:~# ldapsearch -x -b dc=eds,dc=local -D "cn=myuser,cn=Users,dc=eds,dc=local" -W Enter LDAP Password: <input wrong password here> ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece root@debian:~# ps aux | grep slapd openldap 5982 0.2 2.0 25188 5364 ? Ssl 14:21 0:00 /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf root 5984 0.0 0.2 3144 760 pts/2 R+ 14:21 0:00 grep slapd The backtrace of the SIG_ABRT is as follows: #0 0xb7faf424 in __kernel_vsyscall () #1 0xb7bbb640 in raise () from /lib/i686/cmov/libc.so.6 #2 0xb7bbd018 in abort () from /lib/i686/cmov/libc.so.6 #3 0xb7bb45be in __assert_fail () from /lib/i686/cmov/libc.so.6 #4 0xb7f62d3b in ber_bvreplace_x (dst=0x8b3d458, src=0xb6981d48, ctx=0x0) at /build/buildd/openldap-2.4.11/libraries/liblber/memory.c:700 #5 0xb7f62d6c in ber_bvreplace (dst=0x8b3d458, src=0xb6981d48) at /build/buildd/openldap-2.4.11/libraries/liblber/memory.c:715 #6 0xb77c78ff in ldap_back_dobind_int (lcp=0xb6981e78, op=0x8b3d018, rs=0xb6983148, sendok=22, retries=0, dolock=1) at /build/buildd/openldap-2.4.11/servers/slapd/back-ldap/bind.c:2211 #7 0xb77c2ecd in ldap_back_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/back-ldap/search.c:166 #8 0xb77b65d2 in translucent_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/overlays/translucent.c:976 #9 0x080db6c6 in overlay_op_walk (op=0x8b3d018, rs=0xb6983148, which=op_search, oi=0x8ae4028, on=0x8ae4128) at /build/buildd/openldap-2.4.11/servers/slapd/backover.c:636 #10 0x080dc205 in over_op_func (op=0x8b3d018, rs=0xb6983148, which=op_search) at /build/buildd/openldap-2.4.11/servers/slapd/backover.c:698 #11 0x08078a23 in fe_op_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/search.c:366 #12 0x08079290 in do_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/search.c:217 #13 0x08076436 in connection_operation (ctx=0xb6983238, arg_v=0x8b3d018) at /build/buildd/openldap-2.4.11/servers/slapd/connection.c:1084 #14 0x08076eb7 in connection_read_thread (ctx=0xb6983238, argv=0x13) at /build/buildd/openldap-2.4.11/servers/slapd/connection.c:1211 #15 0xb7f73fb8 in ldap_int_thread_pool_wrapper (xpool=0x8ab46f8) at /build/buildd/openldap-2.4.11/libraries/libldap_r/tpool.c:663 #16 0xb7cf14c0 in start_thread () from /lib/i686/cmov/libpthread.so.0 #17 0xb7c7061e in clone () from /lib/i686/cmov/libc.so.6 So it looks like this assert fails for some reason: at /build/buildd/openldap-2.4.11/libraries/liblber/memory.c:700 assert( !BER_BVISNULL( src ) ); Reproducible: always with the configuration above. If I remove "mode=self" in the configuration above, the server loads and runs fine (no crash when binding), but I can't search anything in the database: root@debian:~# ldapsearch -LL -x -b dc=eds,dc=local -D "cn=myuser,cn=Users,dc=eds,dc=local" -W Enter LDAP Password: <correct password> result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece I'm not sure if this crash is due to an incoherent configuration, or to an interaction problem with the Active Directory backend. In the former case, I think the server should output an error message when started. In the later case, it is probably a bug. Please let me know if you need more specific information. Regards,

1 0

Re: (ITS#5856) adauth overlay contribution
by neil.dunbar＠hp.com 16 Dec '08

16 Dec '08

Andrew: > One suggestion following a very quick scan of the code: I think it > would be worth bringing the warning about turning off TLS checks > into the manual page. Agreed. Done. > In particular, there is no reason for this > to be AD-specific and it should be easy to adapt it to authenticate > against any [collection of] remote LDAP servers. Actually, it may not be AD specific as is. If you define default_domain to be some rubbish, and default_realm to be the remote AD server, then everything else (including the remote bind DN) can be fetched from the DIT. But I haven't tried this. But what wouldn't get passed back is any information flowing from password controls - and that's an annoyance, which is why I didn't generalise the code (and because HP had no business need for that approach anyway). Cheers, Neil -- SSL, HP Labs/Office of Strategy and Technology Hewlett-Packard Limited Registered Office: Cain Road, Bracknell, Berks RG12 1HN Registered No: 690597 England

1 0

Re: (ITS#5858) Segfault with overlay ppolicy
by maniac＠maniac.nl 16 Dec '08

16 Dec '08

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_server11-25943-1229438597-0001-2 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I can also NOT reproduce this with OpenLDAP 2.3.43 on Solaris 10. So this seems to be a regression in OpenLDAP 2.4.x For the moment I'm sticking with 2.3, though it still doens't solve my problem of hashing passwords on change (exop's don't seem to be triggered) Mark --=_server11-25943-1229438597-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEABECAAYFAklHvocACgkQb6urvDV9IXhY5ACgkuKEb8H03RbTZWDAthb/n10Z d5AAoLsPNEL3UONsg0oG90coRtIT0ktq =T44A -----END PGP SIGNATURE----- --=_server11-25943-1229438597-0001-2--

1 0

Re: (ITS#5858) Segfault with overlay ppolicy
by maniac＠maniac.nl 16 Dec '08

16 Dec '08

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_server11-25317-1229436747-0001-2 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Also tested my config on OpenLDAP 2.3.27 on CentOS 5 (i386) with packages from: http://dev.centos.org/centos/5/testing/i386/RPMS/ This hasn't resulted in a segfault yet.=20 I will try version 2.3.27 on Solaris now. --=_server11-25317-1229436747-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEABECAAYFAklHt0gACgkQb6urvDV9IXjtlwCeJ8q/q2q+kX48VSoWCyaAfEE5 TIIAoKHn1k0gkXrxqZjiCekBQC3OMR9D =+iFS -----END PGP SIGNATURE----- --=_server11-25317-1229436747-0001-2--

1 0

(ITS#5862) Assert control ignored on non-database entries
by h.b.furuseth＠usit.uio.no 16 Dec '08

16 Dec '08

Full_Name: Hallvard B Furuseth Version: HEAD OS: Linux URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard slapd does not apply the Assert control to non-database entries (at least the root and subschema entries), yet does not reject a critical control either. I have not explored the magnitutde of the problem: Where the control can get ignored, and which other controls are ignored. $ ldapsearch -LLLx -e\!assert='(objectClass=person)' -b "" -s base dn: objectClass: top objectClass: OpenLDAProotDSE $ ldapsearch -LLLx -e\!assert='(objectClass=person)' -b cn=subschema -s base dn: cn=Subschema objectClass: top objectClass: subentry objectClass: subschema objectClass: extensibleObject cn: Subschema -b "" -s sub does apply the control with database bdb + suffix "". Don't know about back-sql. However I imagine it varies how careful backends "" are about generating the root DSE when suffix == "" so controls can be applied to it. Might need a backend flag which says whether the backend does this, and reject the critical controls with unwillingToPerform if this flag is not set.

1 0

(ITS#5861) Assert control on Add request fails
by h.b.furuseth＠usit.uio.no 16 Dec '08

16 Dec '08

Full_Name: Hallvard B Furuseth Version: HEAD OS: Linux URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard RFC 4528 says the Assert control is appropriate for Add. Slapd disagrees: $ ldapadd -xhlocalhost:3890 -e\!assert='(objectClass=organization)' <test.ldif adding new entry "o=test" ldap_add: Critical extension is unavailable (12) additional info: critical extension is unavailable back-bdb and back-sql do not apply the assert control to Add. The message comes from slapd/controls.c. Don't fix that before fixing Add in the backends, otherwise critical controls can be ignored. Another strangeness: overlays/syncprov.c applies the Assert control to Compare but not other operations. I don't know why, there are no comments about it.

1 0

(ITS#5860) slapd memeory leak under openldap 2.4
by rlvcosta＠yahoo.com 15 Dec '08

15 Dec '08

Full_Name: Rodrigo Costa Version: 2.4.11 OS: RHEL4 U4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (201.82.161.220) Opeldap dev team, I'm facing an issue and after many tentatives I believe this is really a bug that maybe could be identified and solved by openldap community. I tried to include dmalloc into openldap 2.4.11 code but even I could compile with it any tentative to execute the code generated "Segmentation Fault" so I could not use dmalloc to identify where the memory leak is happening. I compiled both Berkeley DB 4.6.21 with its patches from source and then compiled openldap 2.4.11 also from source. I download both from links provided at Oracle and Openldap so I think the code is ok. For reference I compiled Berkeley DB with the following configuration : env CFLAGS="-march=pentium4 -O3 -pipe -fomit-frame-pointer" \ ../dist/configure --enable-largefiles --enable-java --prefix=/usr It compiled without problems. The openldap is compiled with the following configuration : env CFLAGS="-march=pentium4 -O3 -pipe -fomit-frame-pointer" ./configure --with-tls --enable-crypt --enable-syslog --enable-modules --enable-bdb=mod --enable-monitor=mod --enable-shared --with-gnu-ld --enable-overlays=mod --sysconfdir=/etc --prefix=/usr It identifies correctly bdb libraries and compile without any problem. The CHANGES file make reference for ITS#5557 which I saw as possible candidate for the problem I'm having. Even with it looks like there is memory leak. My system is a HP DL380-G3 32 bits with 12GB of memory. The OS is Red Hat Enterprise Linux 4 Update 4. I have actually an old version of OpenLdap(version 2.1.30 with bdb 4.2.52) running in a similar machine without any problem. The specific details are "Linux brtldp11 2.6.9-42.ELsmp #1 SMP Wed Jul 12 23:27:17 EDT 2006 i686 i686 i386 GNU/Linux". I made several slapd.conf files trying to control cache and see this could be a configuration problem. I put into debug 64 and the file is read correctly without any problem. Please see output below : all schema stuff... line 23 (pidfile /var/run/slapd.pid) line 24 (argsfile /var/run/slapd.args) line 26 (allow bind_v2) line 28 (sizelimit 10000) line 29 (timelimit 5400) line 31 (loglevel 0) line 34 (modulepath /usr/libexec/openldap) line 35 (moduleload back_bdb.la) loaded module back_bdb.la module back_bdb.la: null module registered line 36 (moduleload back_monitor.la) loaded module back_monitor.la module back_monitor.la: null module registered line 78 (database bdb) line 79 (suffix "ou=CONTENT,o=alcatel,c=fr") line 80 (rootdn "cn=admin,ou=CONTENT,o=alcatel,c=fr") line 84 (rootpw ***) line 87 (directory /var/openldap-data/bdb1) line 90 (index userid,pnnumber,submxid,maillogin,abookaliasid eq,pres) index uid 0x0006 index pnnumber 0x0006 index submxid 0x0006 index maillogin 0x0006 index abookaliasid 0x0006 line 91 (index objectClass eq) index objectClass 0x0004 line 93 (cachesize 45000) line 94 (dncachesize 45000) line 95 (idlcachesize 45000) line 96 (cachefree 9000) line 104 (database bdb) line 105 (suffix "ou=INDEXES,o=alcatel,c=fr") line 106 (rootdn "cn=admin,ou=INDEXES,o=alcatel,c=fr") line 110 (rootpw ***) line 113 (directory /var/openldap-data/bdb2) line 116 (index weblogin,maillogin,mail,pnnumber eq,pres) index weblogin 0x0006 index maillogin 0x0006 index mail 0x0006 index pnnumber 0x0006 line 117 (index profileid,loginname eq,pres) index profileid 0x0006 index loginname 0x0006 line 118 (index objectClass eq) index objectClass 0x0004 line 120 (cachesize 45000) line 121 (dncachesize 45000) line 122 (idlcachesize 45000) line 123 (cachefree 9000) line 131 (database monitor) slapd starting My DB has around 4 million entrances and the bdb DB file size is around 15GB. The DB itself is not big since the entrances are not soo big. By openLDAP documents a DB with 4million entrances should be supported correctly into a 32 bits system. The issue becomes clear when I try to make a ldapsearch in these DBs(bdb1 and bdb2). If I do it the memory usage by slapd start to increase until all possible memory be allocated and system start to paging. After sometime slapd cannot allocate anymore memory using malloc and slapd crashes. After I put the cache this behavior is taking a little longer but not much longer. It ends memory in around 1 hour. Even if I stop the ldapsearch the memory previously allocated by slad isn't released and the process can be seen in the machine top with a lot of allocated memory. The only way to release this memory is to stop slapd process manually. I beleive there is a memory leakage but I could not identify where. My tentatives to used dmalloc were not successful and then I would like to report this bug. Your expertise identifying if the correct patches are really applied into the openldap2.4.11 is really important to solve this issue. Please let me know if you need more information. Regards, Rodrigo Costa.

1 0

Re: (ITS#5856) adauth overlay contribution
by andrew.findlay＠skills-1st.co.uk 15 Dec '08

15 Dec '08

On Fri, Dec 12, 2008 at 07:31:47PM +0000, kartik_subbarao(a)hp.com wrote: > As discussed with Howard Chu, HP is contributing the code for an Active > Directory Authentication overlay (written by Neil Dunbar) to OpenLDAP. > > The adauth overlay provides passthrough authentication to Active Directory for > LDAP simple bind operations. The local LDAP entry referenced in the bind > operation is mapped to its counterpart in the Active Directory, an LDAP bind > operation is performed against Active Directory, and results are returned based > on the results of that remote operation. If a local userPassword attribute is > populated for the entry, it is used instead of the AD authentication. This is very good news, as it deals with a common requirement without having to configure saslauthd. One suggestion following a very quick scan of the code: I think it would be worth bringing the warning about turning off TLS checks into the manual page. It is worth noting that this overlay raises issues similar to those raised by the contributed adpwc/extpwc module - see ITS#5042. In this case the access to AD is via LDAP rather than Kerberos, but most of the arguments are similar. In particular, there is no reason for this to be AD-specific and it should be easy to adapt it to authenticate against any [collection of] remote LDAP servers. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Re: (ITS#5859) back-hdb entrycache problem
by quanah＠OpenLDAP.org 15 Dec '08

15 Dec '08

--On Monday, December 15, 2008 4:16 PM +0000 openldap-its(a)OpenLDAP.org wrote: Appears to be broken in 2.4.13 as well. Search prior to adding zimbra-3 entry: [zimbra@freelancer ~]$ ldapsearch -x -h freelancer -b "cn=zimbra" -D "uid=zimbra,cn=admins,cn=zimbra" -W # com_zimbra_license, zimlets, zimbra dn: cn=com_zimbra_license,cn=zimlets,cn=zimbra zimbraZimletTarget: admin-main zimbraZimletDescription: License Management for Admin UI zimbraZimletVersion: 5.2 objectClass: zimbraZimletEntry zimbraZimletIndexingEnabled: TRUE zimbraZimletKeyword: com_zimbra_license cn: com_zimbra_license zimbraZimletIsExtension: TRUE zimbraZimletPriority: 1 zimbraZimletEnabled: TRUE # zimbra-2, zimlets, zimbra dn: cn=zimbra-2,cn=zimlets,cn=zimbra cn: zimbra-2 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # search result search: 2 result: 0 Success # numResponses: 46 # numEntries: 45 Then we add the new entry: [zimbra@freelancer ~]$ ldapadd -f /tmp/test.ldif -x -h freelancer -D "uid=zimbra,cn=admins,cn=zimbra" -W Enter LDAP Password: adding new entry "cn=zimbra-3,cn=zimlets,cn=zimbra" Now we search again: # com_zimbra_license, zimlets, zimbra dn: cn=com_zimbra_license,cn=zimlets,cn=zimbra zimbraZimletTarget: admin-main zimbraZimletDescription: License Management for Admin UI zimbraZimletVersion: 5.2 objectClass: zimbraZimletEntry zimbraZimletIndexingEnabled: TRUE zimbraZimletKeyword: com_zimbra_license cn: com_zimbra_license zimbraZimletIsExtension: TRUE zimbraZimletPriority: 1 zimbraZimletEnabled: TRUE # zimbra-2, zimlets, zimbra dn: cn=zimbra-2,cn=zimlets,cn=zimbra cn: zimbra-2 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # search result search: 2 result: 0 Success # numResponses: 46 # numEntries: 45 Same result, this is bad. Now we stop/restart slapd: [zimbra@freelancer ~]$ ldap stop Killing slapd with pid 15613 done. [zimbra@freelancer ~]$ ldap start Started slapd: pid 20224 search again: # zimbra-2, zimlets, zimbra dn: cn=zimbra-2,cn=zimlets,cn=zimbra cn: zimbra-2 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # zimbra-3, zimlets, zimbra dn: cn=zimbra-3,cn=zimlets,cn=zimbra cn: zimbra-3 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # search result search: 2 result: 0 Success # numResponses: 46 # numEntries: 45 And there is our missing entry. --Quanah -- Quanah Gibson-Mount Release and QA Engineer <http://www.openldap.org>

1 0

(ITS#5859) back-hdb entrycache problem
by quanah＠OpenLDAP.org 15 Dec '08

15 Dec '08

Full_Name: Quanah Gibson-Mount Version: 2.4.13+patches OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.29.239) In using 2.4.13 + the slapadd fix from Ralf, ITS#5841, ITS#5842,ITS#5849,ITS#5850, ITS#5854, I found the following: Create an database with back-hdb with a few subtrees, with several entries under that subtree (My database is rooted at "". I have a "cn=zimbra" tree, with "cn=zimlets,cn=zimbra" underneath it). Now, create a brand new entry under one of those subtrees. The new entry will not be returned in queries rooted at the upper level ("cn=zimbra"). It will show up at its level ("cn=zimlets,cn=zimbra"). If you stop/restart slapd to flush the entry/idl cache, things work correctly.

1 0

Re: (ITS#5858) Segfault with overlay ppolicy
by maniac＠maniac.nl 15 Dec '08

15 Dec '08

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_server11-3551-1229353986-0001-2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline I spoke too soon, both on Solaris and on Linux I still get reproducable segfaults with 2.4.13 as soon as I use a ppolicy overlay in my configuration and query the directory. I have a public shellbox available which has the config loaded Mark --=_server11-3551-1229353986-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFJRnQBb6urvDV9IXgRAt7aAKCC3GveYtw6mHaWWi/EkStXn6YtFwCeIKNx mFaCqgogqL0dkjGJQ6mul4s= =ADsB -----END PGP SIGNATURE----- --=_server11-3551-1229353986-0001-2--

1 0

Re: (ITS#5858) Segfault with overlay ppolicy
by maniac＠maniac.nl 15 Dec '08

15 Dec '08

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_server11-2243-1229351458-0001-2 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I can reproduce this problem also on Linux/amd64 (Debian Testing) with OpenLDAP 2.4.11. I can confirm that it is FIXED on OpenLDAP 2.4.13 on Linux (and am now compiling it on Solaris) Mark --=_server11-2243-1229351458-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEABECAAYFAklGaiIACgkQb6urvDV9IXiCRQCgoNI6qsFg+gORmzPaYtWLSmmE higAoI2Cq0G0HQevFuC6Q7y1L/62geES =FKcN -----END PGP SIGNATURE----- --=_server11-2243-1229351458-0001-2--

1 0

(ITS#5858) Segfault with overlay ppolicy
by maniac-openldap＠maniac.nl 15 Dec '08

15 Dec '08

Full_Name: Mark Janssen Version: 2.4.11 OS: Solaris 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.64.241.2) Program received signal SIGSEGV, Segmentation fault. [Switching to LWP 3] over_entry_get_rw (op=0x403648, dn=0x403664, oc=0x0, ad=0x0, rw=0, e=0xfd3ff4d4) at backover.c:394 394 return overlay_entry_get_ov( op, dn, oc, ad, rw, e, on ); (gdb) bt full #0 over_entry_get_rw (op=0x403648, dn=0x403664, oc=0x0, ad=0x0, rw=0, e=0xfd3ff4d4) at backover.c:394 oi = (slap_overinfo *) 0x293788 on = (slap_overinst *) 0x275148 #1 0x0009b8a8 in fe_entry_get_rw (op=Cannot access memory at address 0xfcfffec0 ) at frontend.c:62 bd = Cannot access memory at address 0xfcfffe88 (gdb) info threads 4 LWP 4 0xfe3c4a9c in __lwp_park () from /lib/libc.so.1 * 3 LWP 3 over_entry_get_rw (op=0x403648, dn=0x403664, oc=0x0, ad=0x0, rw=0, e=0xfd3ff4d4) at backover.c:394 2 LWP 2 0xfe3c57c8 in __pollsys () from /lib/libc.so.1 1 LWP 1 0xfe3c5c1c in __lwp_wait () from /lib/libc.so.1 (gdb) As soon as I enable 'ppolicy' I get a segfault when I login (with lbe) to the ldap server. Repeatable 100% (goes away when I remove ppolicy overlay from slapd.conf) Config snippet: overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=domain,dc=tld" ppolicy_hash_cleartext

1 0

(ITS#5856) adauth overlay contribution
by kartik_subbarao＠hp.com 12 Dec '08

12 Dec '08

Full_Name: Kartik Subbarao Version: 2.4 OS: Red Hat Enterprise Linux URL: ftp://ftp.openldap.org/incoming/adauth.tar.gz Submission from: (NULL) (76.99.180.78) As discussed with Howard Chu, HP is contributing the code for an Active Directory Authentication overlay (written by Neil Dunbar) to OpenLDAP. The adauth overlay provides passthrough authentication to Active Directory for LDAP simple bind operations. The local LDAP entry referenced in the bind operation is mapped to its counterpart in the Active Directory, an LDAP bind operation is performed against Active Directory, and results are returned based on the results of that remote operation. If a local userPassword attribute is populated for the entry, it is used instead of the AD authentication.

1 0

(ITS#5855) slapd crash at hang or shutdown
by carlcarl＠comcast.net 12 Dec '08

12 Dec '08

Full_Name: Carl Traub Version: all ? OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (141.202.248.52) On Windows,I have found that by simply starting slapd, waiting a few minutes for it to get fully loaded, and then hitting Ctrl-C, slapd will often hang and not terminate properly. It occasionally crashed, and that may been related. The problem is that in slapd_daemon_destroy(), tcp_close() was being called for both wake_sds[1] and wake_sds[0], and the 2 values were always the same. This meant that Windows was being asked to close a connection that had already been closed and was no longer valid. A coworker stated that on Windows, these 2 values are always the same, but he thought that on Unix they would always be different. I uploaded the diff file "carlTraub-121208.diff". I wasn't clear on using the diff tool. Below is the diff. --- P:\temp\daemon.c_bef Fri Dec 12 10:05:38 2008 +++ P:\temp\daemon.c_after Fri Dec 12 10:24:30 2008 @@ -1645,14 +1645,10 @@ slapd_daemon_destroy( void ) { connections_destroy(); + // If the 2 connections are actually the same, closing it twice can cause bad things, like hangs or crashes. + // It may be that they are always the same on Windows, always different on Unix. + if (wake_sds[1] != wake_sds[0] ) { #ifdef HAVE_WINSOCK + if ( wake_sds[1] != INVALID_SOCKET ) - if ( wake_sds[1] != INVALID_SOCKET ) #endif /* HAVE_WINSOCK */ + tcp_close( SLAP_FD2SOCK(wake_sds[1]) ); + } - tcp_close( SLAP_FD2SOCK(wake_sds[1]) ); #ifdef HAVE_WINSOCK if ( wake_sds[0] != INVALID_SOCKET ) #endif /* HAVE_WINSOCK */

1 0

Re: (ITS#5854) Double send response in meta backend
by ando＠sys-net.it 12 Dec '08

12 Dec '08

jorge.perez(a)adaptia.net wrote: > Full_Name: Jorge Perez Burgos > Version: 2.4.11 > OS: SLES 10 > URL: ftp://ftp.openldap.org/incoming/back-meta_changes.diff.gz > Submission from: (NULL) (194.237.142.20) > > > Meta backend send two response codes when trying to reconnect to other slapd. > > Steps to reproduce: > Configure two slapds, slapd_A and slapd_B. slapd_A connects to slapd_B trough > meta backend. Do some traffic operations. Restart slapd_B and do some modify, > delete or add operation, response code 52 is received although the operation is > sucessful. Using a tcpdump you can see two response codes for the request. > > I attach a possible patch for this issue. Thanks. I've committed an alternative fix to this issue, in line with the analogous code in back-ldap. It makes use of the specific bit of the ldap_back_send_t mask instead of an additional argument. Please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by ando＠sys-net.it 12 Dec '08

12 Dec '08

Andrew Bartlett wrote: > On Thu, 2008-12-11 at 23:17 +0100, Pierangelo Masarati wrote: >> Andrew Bartlett wrote: >>> On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: >>>> A tentative implementation is in HEAD, please test. You need to: >>> Thankyou very much. I downloaded CVS HEAD and tested it out (finally - >>> the Samba4 side of the implementation took far longer than I expected). >>> >>>> - configure as --enable-deref >>>> >>>> - enable the "deref" overlay in slapd, with "overlay deref" (doesn't >>>> work as global overlay yet, sorry). >>> This is something Samba4 will need, as many of our links are >>> cross-database. But fixing this for a single DB is a big help in any >>> case. >>> >>>> - run searches like >>>> >>>> $ ldapsearch -x -b dc=example,dc=com -E 'deref=member:entryUUID' >>>> >>>> you'll see results like >>> When using Samba4's client, it seems to work, but it is as if it extends >>> the control to the full expected length, but not the data. Ie, attached >>> this is the control response I got back from the 'make testenv' >>> environment in Samba4. I've also attached the full LDAP request. >>> >>> The extra zeros also appear in the OpenLDAP logs (so it's not a Samba4 >>> parsing bug). >> I've found the bug (erroneous manipulation of octet strings containing >> '\0' octets). The objectSid is octet string-valued. Should be fixed >> now; please test. > > While I'm mostly at sea on ASN.1, I don't think the OpenLDAP's > implementation matches your IETF draft (if not, an education on subtle > details of ASN.1 will be appreciated) > > draft-masarati-ldap-deref-00 > > >> 2.3. Control Response >> >> >> The control type is deref-oid (IANA assigned; see Section 6). The >> specification of the Dereference Control response is: >> >> controlValue ::= SEQUENCE OF derefRes DerefRes >> >> DerefRes ::= SEQUENCE { >> derefAttr AttributeDescription, >> derefVal LDAPDN, >> attrVals [0] PartialAttributeList OPTIONAL } >> >> PartialAttributeList ::= SEQUENCE OF >> partialAttribute PartialAttribute >> >> PartialAttribute is defined in [RFC4511]; the definition is reported >> here for clarity: >> >> PartialAttribute ::= SEQUENCE { >> type AttributeDescription, >> vals SET OF value AttributeValue } >> > > the output of dumpasn1 on the control: > >> 0 983: SEQUENCE { >> 4 168: SEQUENCE { >> 7 8: OCTET STRING 'memberOf' >> 17 56: OCTET STRING >> : 'cn=Enterprise Admins,cn=Users,dc=samba,dc=exampl' >> : 'e,dc=com' >> 75 98: [0] { >> 77 51: SEQUENCE { > > Shouldn't there be another SEQUENCE { here? Well, that was my intention when I ber_printf("{{OOt{{O[W]}{O[W]}}}}"), which, AFAIK, means: "{" SEQUENCE "{" SEQUENCE "OO" derefAttr, derefVal "t" [0] "{" SEQUENCE "{O[W]}" SEQUENCE, type, SET OF vals Am I missing anything? Couldn't "[0] {" be a shortcut in dumpasn1 to indicate SEQUENCE OF and the presence of a context+constructed tag? Looking at the raw data of an example, I see a sequence 240 126 060 063 004 011 which means: 240 context + constructed 126 (the length, 86 octets) 060 sequence 063 (the length, 51 octets) 004 octet string 011 (the length, 9 octets: "entryUUID") I'm not an expert in ASN.1, but from what I infer by looking at LDAP specs and at OpenLDAP implementation, this is consistent with the way similar cases are dealt with (e.g. the "Controls" at the end of a request message). p. > >> 79 9: OCTET STRING 'entryUUID' >> 90 38: SET { >> 92 36: OCTET STRING >> '24476f18-5c24-102d-9945-7320c1040f54' >> : } >> : } >> 130 43: SEQUENCE { >> 132 9: OCTET STRING 'objectSid' >> 143 30: SET { >> 145 28: OCTET STRING >> : 01 05 00 00 00 00 00 05 15 00 00 00 AB BE DB 7B >> : 16 72 AE E6 53 BE 65 6F 07 02 00 00 >> : } >> : } >> : } >> : } >> > > Thanks, > > Andrew Bartlett > Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5854) Double send response in meta backend
by ando＠sys-net.it 12 Dec '08

12 Dec '08

hyc(a)symas.com wrote: > Thanks for your report. Sounds a lot like ITS#4782... Howard, the proposed fix is fine, but I think the issue is better addressed in back-ldap by means of the ldap_back_send_t mask without the need of an additional argument. I'm testing a different fix. p. > On Thu, Dec 11, 2008 at 10:14:23AM +0000, jorge.perez(a)adaptia.net wrote: >> Full_Name: Jorge Perez Burgos >> Version: 2.4.11 >> OS: SLES 10 >> URL: ftp://ftp.openldap.org/incoming/back-meta_changes.diff.gz >> Submission from: (NULL) (194.237.142.20) >> >> >> Meta backend send two response codes when trying to reconnect to other slapd. >> >> Steps to reproduce: >> Configure two slapds, slapd_A and slapd_B. slapd_A connects to slapd_B trough >> meta backend. Do some traffic operations. Restart slapd_B and do some modify, >> delete or add operation, response code 52 is received although the operation is >> sucessful. Using a tcpdump you can see two response codes for the request. >> >> I attach a possible patch for this issue. >> >> > > Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5854) Double send response in meta backend
by hyc＠symas.com 12 Dec '08

12 Dec '08

Thanks for your report. Sounds a lot like ITS#4782... On Thu, Dec 11, 2008 at 10:14:23AM +0000, jorge.perez(a)adaptia.net wrote: > Full_Name: Jorge Perez Burgos > Version: 2.4.11 > OS: SLES 10 > URL: ftp://ftp.openldap.org/incoming/back-meta_changes.diff.gz > Submission from: (NULL) (194.237.142.20) > > > Meta backend send two response codes when trying to reconnect to other slapd. > > Steps to reproduce: > Configure two slapds, slapd_A and slapd_B. slapd_A connects to slapd_B trough > meta backend. Do some traffic operations. Restart slapd_B and do some modify, > delete or add operation, response code 52 is received although the operation is > sucessful. Using a tcpdump you can see two response codes for the request. > > I attach a possible patch for this issue. > >

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by abartlet＠samba.org 12 Dec '08

12 Dec '08

--=-3TUJtt6yg+CvD9VzraMk Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2008-12-11 at 23:22 +0100, Pierangelo Masarati wrote: > Andrew Bartlett wrote: > > On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: > >> A tentative implementation is in HEAD, please test. You need to: > >=20 > > Thankyou very much. I downloaded CVS HEAD and tested it out (finally - > > the Samba4 side of the implementation took far longer than I expected). > >=20 > >> - configure as --enable-deref > >> > >> - enable the "deref" overlay in slapd, with "overlay deref" (doesn't > >> work as global overlay yet, sorry). > >=20 > > This is something Samba4 will need, as many of our links are > > cross-database. But fixing this for a single DB is a big help in any > > case. >=20 > Apparently this was fixed during the overlay's shakedown, as it seems to=20 > work as expected when only instantiated as global. In fact, nothing was=20 > preventing it from working this way by design, it only didn't work at=20 > some point of its evolution. Please test. Indeed, it works well as a global. Thanks! My only issue remaining is the clarification over the ASN.1 encoding of the control. Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. --=-3TUJtt6yg+CvD9VzraMk Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBJQdk5z4A8Wyi0NrsRAiiOAKCUywnlFS2RIZlclADU/woC7id7OwCfbfwD fh4vPeyWTWqBYACEYVFgdZA= =UdNB -----END PGP SIGNATURE----- --=-3TUJtt6yg+CvD9VzraMk--

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by abartlet＠samba.org 12 Dec '08

12 Dec '08

--=-WGywWWDfCXc78PSX7dDA Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2008-12-11 at 23:17 +0100, Pierangelo Masarati wrote: > Andrew Bartlett wrote: > > On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: > >> A tentative implementation is in HEAD, please test. You need to: > >=20 > > Thankyou very much. I downloaded CVS HEAD and tested it out (finally - > > the Samba4 side of the implementation took far longer than I expected). > >=20 > >> - configure as --enable-deref > >> > >> - enable the "deref" overlay in slapd, with "overlay deref" (doesn't > >> work as global overlay yet, sorry). > >=20 > > This is something Samba4 will need, as many of our links are > > cross-database. But fixing this for a single DB is a big help in any > > case. > >=20 > >> - run searches like > >> > >> $ ldapsearch -x -b dc=3Dexample,dc=3Dcom -E 'deref=3Dmember:entryUUID' > >> > >> you'll see results like > >=20 > > When using Samba4's client, it seems to work, but it is as if it extend= s > > the control to the full expected length, but not the data. Ie, attache= d > > this is the control response I got back from the 'make testenv' > > environment in Samba4. I've also attached the full LDAP request. > >=20 > > The extra zeros also appear in the OpenLDAP logs (so it's not a Samba4 > > parsing bug). >=20 > I've found the bug (erroneous manipulation of octet strings containing=20 > '\0' octets). The objectSid is octet string-valued. Should be fixed=20 > now; please test. While I'm mostly at sea on ASN.1, I don't think the OpenLDAP's implementation matches your IETF draft (if not, an education on subtle details of ASN.1 will be appreciated) draft-masarati-ldap-deref-00 > 2.3. Control Response >=20 >=20 > The control type is deref-oid (IANA assigned; see Section 6). The > specification of the Dereference Control response is: >=20 > controlValue ::=3D SEQUENCE OF derefRes DerefRes >=20 > DerefRes ::=3D SEQUENCE { > derefAttr AttributeDescription, > derefVal LDAPDN, > attrVals [0] PartialAttributeList OPTIONAL } >=20 > PartialAttributeList ::=3D SEQUENCE OF > partialAttribute PartialAttribute >=20 > PartialAttribute is defined in [RFC4511]; the definition is reported > here for clarity: >=20 > PartialAttribute ::=3D SEQUENCE { > type AttributeDescription, > vals SET OF value AttributeValue } >=20 the output of dumpasn1 on the control: > 0 983: SEQUENCE { > 4 168: SEQUENCE { > 7 8: OCTET STRING 'memberOf' > 17 56: OCTET STRING > : 'cn=3DEnterprise Admins,cn=3DUsers,dc=3Dsamba,dc=3Dexamp= l' > : 'e,dc=3Dcom' > 75 98: [0] { > 77 51: SEQUENCE { Shouldn't there be another SEQUENCE { here? > 79 9: OCTET STRING 'entryUUID' > 90 38: SET { > 92 36: OCTET STRING > '24476f18-5c24-102d-9945-7320c1040f54' > : } > : } > 130 43: SEQUENCE { > 132 9: OCTET STRING 'objectSid' > 143 30: SET { > 145 28: OCTET STRING > : 01 05 00 00 00 00 00 05 15 00 00 00 AB BE DB 7B > : 16 72 AE E6 53 BE 65 6F 07 02 00 00 > : } > : } > : } > : } >=20 Thanks, Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. --=-WGywWWDfCXc78PSX7dDA Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBJQa1Nz4A8Wyi0NrsRAtyAAJ9Dqzqn3DknKqThzy7KML5Z+i/h2wCfZ2nM d8HdE9UXPLaN2DZRwIseCk0= =HFZS -----END PGP SIGNATURE----- --=-WGywWWDfCXc78PSX7dDA--

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by ando＠sys-net.it 11 Dec '08

11 Dec '08

Andrew Bartlett wrote: > On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: >> A tentative implementation is in HEAD, please test. You need to: > > Thankyou very much. I downloaded CVS HEAD and tested it out (finally - > the Samba4 side of the implementation took far longer than I expected). > >> - configure as --enable-deref >> >> - enable the "deref" overlay in slapd, with "overlay deref" (doesn't >> work as global overlay yet, sorry). > > This is something Samba4 will need, as many of our links are > cross-database. But fixing this for a single DB is a big help in any > case. Apparently this was fixed during the overlay's shakedown, as it seems to work as expected when only instantiated as global. In fact, nothing was preventing it from working this way by design, it only didn't work at some point of its evolution. Please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by ando＠sys-net.it 11 Dec '08

11 Dec '08

Andrew Bartlett wrote: > On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: >> A tentative implementation is in HEAD, please test. You need to: > > Thankyou very much. I downloaded CVS HEAD and tested it out (finally - > the Samba4 side of the implementation took far longer than I expected). > >> - configure as --enable-deref >> >> - enable the "deref" overlay in slapd, with "overlay deref" (doesn't >> work as global overlay yet, sorry). > > This is something Samba4 will need, as many of our links are > cross-database. But fixing this for a single DB is a big help in any > case. > >> - run searches like >> >> $ ldapsearch -x -b dc=example,dc=com -E 'deref=member:entryUUID' >> >> you'll see results like > > When using Samba4's client, it seems to work, but it is as if it extends > the control to the full expected length, but not the data. Ie, attached > this is the control response I got back from the 'make testenv' > environment in Samba4. I've also attached the full LDAP request. > > The extra zeros also appear in the OpenLDAP logs (so it's not a Samba4 > parsing bug). I've found the bug (erroneous manipulation of octet strings containing '\0' octets). The objectSid is octet string-valued. Should be fixed now; please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5854) Double send response in meta backend
by jorge.perez＠adaptia.net 11 Dec '08

11 Dec '08

Full_Name: Jorge Perez Burgos Version: 2.4.11 OS: SLES 10 URL: ftp://ftp.openldap.org/incoming/back-meta_changes.diff.gz Submission from: (NULL) (194.237.142.20) Meta backend send two response codes when trying to reconnect to other slapd. Steps to reproduce: Configure two slapds, slapd_A and slapd_B. slapd_A connects to slapd_B trough meta backend. Do some traffic operations. Restart slapd_B and do some modify, delete or add operation, response code 52 is received although the operation is sucessful. Using a tcpdump you can see two response codes for the request. I attach a possible patch for this issue.

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by abartlet＠samba.org 11 Dec '08

11 Dec '08

--=-svDYOuAyXlEqIDWU48Ko Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2008-12-11 at 12:22 +1100, Andrew Bartlett wrote: > On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: > > A tentative implementation is in HEAD, please test. You need to: >=20 > Thankyou very much. I downloaded CVS HEAD and tested it out (finally - > the Samba4 side of the implementation took far longer than I expected). >=20 > > - configure as --enable-deref > >=20 > > - enable the "deref" overlay in slapd, with "overlay deref" (doesn't > > work as global overlay yet, sorry). >=20 > This is something Samba4 will need, as many of our links are > cross-database. But fixing this for a single DB is a big help in any > case. >=20 > > - run searches like > > > > $ ldapsearch -x -b dc=3Dexample,dc=3Dcom -E 'deref=3Dmember:entryUUID' > >=20 > > you'll see results like >=20 > When using Samba4's client, it seems to work, but it is as if it extends > the control to the full expected length, but not the data. Ie, attached > this is the control response I got back from the 'make testenv' > environment in Samba4. I've also attached the full LDAP request. >=20 > The extra zeros also appear in the OpenLDAP logs (so it's not a Samba4 > parsing bug). >=20 > I can make the Samba4 tree that reproduces this available as a GIT > repository if you like. =20 To reproduce: In a checkout from git://git.samba.org/abartlet/samba.git master run: OPENLDAP_ROOT=3D/usr/local/ TEST_LDAP=3Dyes make testenv Then in the xterm that pops up, run: bin/ldbsearch -H ldap://localdc1 cn=3Dadministrator --controls=3Dextended_dn:1:1 This will not return the extended DN (compare with TEST_LDAP=3Dno), because it fails to parse the returned control in libcli/ldap/ldap_controls.c (I suspect my parser also needs work) Thanks, Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. --=-svDYOuAyXlEqIDWU48Ko Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBJQJosz4A8Wyi0NrsRAuLgAJwIYEfeK/rj9xXw+/2KiVhDPw6bvwCeJwaj Q/I64Xu6suP53nnqNT6Bkv0= =GSzF -----END PGP SIGNATURE----- --=-svDYOuAyXlEqIDWU48Ko--

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by abartlet＠samba.org 11 Dec '08

11 Dec '08

--=-3DGTDdLilVnhuysLkRP/ Content-Type: multipart/mixed; boundary="=-vUh+QDuuW5KKlkVC19pp" --=-vUh+QDuuW5KKlkVC19pp Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: > A tentative implementation is in HEAD, please test. You need to: Thankyou very much. I downloaded CVS HEAD and tested it out (finally - the Samba4 side of the implementation took far longer than I expected). > - configure as --enable-deref >=20 > - enable the "deref" overlay in slapd, with "overlay deref" (doesn't > work as global overlay yet, sorry). This is something Samba4 will need, as many of our links are cross-database. But fixing this for a single DB is a big help in any case. > - run searches like > > $ ldapsearch -x -b dc=3Dexample,dc=3Dcom -E 'deref=3Dmember:entryUUID' >=20 > you'll see results like When using Samba4's client, it seems to work, but it is as if it extends the control to the full expected length, but not the data. Ie, attached this is the control response I got back from the 'make testenv' environment in Samba4. I've also attached the full LDAP request. The extra zeros also appear in the OpenLDAP logs (so it's not a Samba4 parsing bug). I can make the Samba4 tree that reproduces this available as a GIT repository if you like. =20 Thanks, Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. --=-vUh+QDuuW5KKlkVC19pp Content-Disposition: attachment; filename=control Content-Type: application/octet-stream; name=control Content-Transfer-Encoding: base64 MIIDnzCBqAQIbWVtYmVyT2YEOGNuPUVudGVycHJpc2UgQWRtaW5zLGNuPVVzZXJzLGRjPXNhbWJh LGRjPWV4YW1wbGUsZGM9Y29toGIwMwQJZW50cnlVVUlEMSYEJGU4MmNiMjE4LTViNmEtMTAyZC05 MDk4LTU1MGYxMWFkZWE4OTArBAlvYmplY3RTaWQxHgQcAQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAA== --=-vUh+QDuuW5KKlkVC19pp Content-Disposition: attachment; filename=request Content-Type: application/octet-stream; name=request Content-Transfer-Encoding: base64 MIINiwIBBmOBvQQaREM9c2FtYmEsREM9ZXhhbXBsZSxEQz1jb20KAQIKAQACAQACAQABAQCgKqIT oxEECWlzRGVsZXRlZAQEVFJVRaMTBAJjbgQNYWRtaW5pc3RyYXRvcjBkBAlpc0RlbGV0ZWQEAmNu BAEqBAllbnRyeVVVSUQED2NyZWF0ZVRpbWVzdGFtcAQPbW9kaWZ5VGltZXN0YW1wBA9jcmVhdGVU aW1lc3RhbXAECGVudHJ5Q1NOBAhtZW1iZXJPZqCCDMQwggzABBkxLjMuNi4xLjQuMS40MjAzLjY2 Ni41LjE2BIIMoTCCDJ0wIQQHb3duZXJCTDAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAiBAhtZW1i ZXJPZjAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAtBBNub25TZWN1cml0eU1lbWJlckJMMBYECWVu dHJ5VVVJRAQJb2JqZWN0U0lEMCsEEWROUmVmZXJlbmNlVXBkYXRlMBYECWVudHJ5VVVJRAQJb2Jq ZWN0U0lEMCQECnNpdGVPYmplY3QwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKwQRaXNQcml2aWxl Z2VIb2xkZXIwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKwQRc2VydmVyUmVmZXJlbmNlQkwwFgQJ ZW50cnlVVUlEBAlvYmplY3RTSUQwJQQLZE1ETG9jYXRpb24wFgQJZW50cnlVVUlEBAlvYmplY3RT SUQwKwQRcXVlcnlQb2xpY3lPYmplY3QwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwIwQJYXNzaXN0 YW50MBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMDEEF21zRFMtTWVtYmVyc0ZvckF6Um9sZUJMMBYE CWVudHJ5VVVJRAQJb2JqZWN0U0lEMCkED2xhc3RLbm93blBhcmVudDAWBAllbnRyeVVVSUQECW9i amVjdFNJRDAnBA1mU01PUm9sZU93bmVyMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMCgEDm1zQ09N LVVzZXJMaW5rMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMCQECm1hc3RlcmVkQnkwFgQJZW50cnlV VUlEBAlvYmplY3RTSUQwMwQZbXNEUy1OQy1SZXBsaWNhLUxvY2F0aW9uczAWBAllbnRyeVVVSUQE CW9iamVjdFNJRDAuBBRpcHNlY0lTQUtNUFJlZmVyZW5jZTAWBAllbnRyeVVVSUQECW9iamVjdFNJ RDAhBAdzZWVBbHNvMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMCYEDGhhc01hc3Rlck5DczAWBAll bnRyeVVVSUQECW9iamVjdFNJRDAuBBRmUlNNZW1iZXJSZWZlcmVuY2VCTDAWBAllbnRyeVVVSUQE CW9iamVjdFNJRDAwBBZtc0RTLVNEUmVmZXJlbmNlRG9tYWluMBYECWVudHJ5VVVJRAQJb2JqZWN0 U0lEMCoEEG5vdGlmaWNhdGlvbkxpc3QwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwJQQLcHJlZmVy cmVkT1UwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKQQPbXNEUy1Ob25NZW1iZXJzMBYECWVudHJ5 VVVJRAQJb2JqZWN0U0lEMC8EFW1zRFMtVGFza3NGb3JBelJvbGVCTDAWBAllbnRyeVVVSUQECW9i amVjdFNJRDArBBFpcHNlY05GQVJlZmVyZW5jZTAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAjBAlz ZWNyZXRhcnkwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwMAQWYnJpZGdlaGVhZFNlcnZlckxpc3RC TDAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAqBBBySURTZXRSZWZlcmVuY2VzMBYECWVudHJ5VVVJ RAQJb2JqZWN0U0lEMDAEFmZyc0NvbXB1dGVyUmVmZXJlbmNlQkwwFgQJZW50cnlVVUlEBAlvYmpl Y3RTSUQwNAQabXNDT00tVXNlclBhcnRpdGlvblNldExpbmswFgQJZW50cnlVVUlEBAlvYmplY3RT SUQwLwQVbXNEUy1UYXNrc0ZvckF6VGFza0JMMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMCMECW1h bmFnZWRCeTAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAvBBVkZWZhdWx0T2JqZWN0Q2F0ZWdvcnkw FgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKwQRbm9uU2VjdXJpdHlNZW1iZXIwFgQJZW50cnlVVUlE BAlvYmplY3RTSUQwIAQGbWVtYmVyMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMCsEEXN1YlNjaGVt YVN1YkVudHJ5MBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMDIEGGRlZmF1bHRMb2NhbFBvbGljeU9i amVjdDAWBAllbnRyeVVVSUQECW9iamVjdFNJRDArBBFkeW5hbWljTERBUFNlcnZlcjAWBAllbnRy eVVVSUQECW9iamVjdFNJRDArBBFtc0RTLU5vbk1lbWJlcnNCTDAWBAllbnRyeVVVSUQECW9iamVj dFNJRDAoBA5kb21haW5Dcm9zc1JlZjAWBAllbnRyeVVVSUQECW9iamVjdFNJRDA0BBptc0RTLU9w ZXJhdGlvbnNGb3JBelJvbGVCTDAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAsBBJkb21haW5Qb2xp Y3lPYmplY3QwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKAQOb2JqZWN0Q2F0ZWdvcnkwFgQJZW50 cnlVVUlEBAlvYmplY3RTSUQwLgQUaGFzUGFydGlhbFJlcGxpY2FOQ3MwFgQJZW50cnlVVUlEBAlv YmplY3RTSUQwJgQMc2l0ZU9iamVjdEJMMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMCcEDXF1ZXJ5 UG9saWN5QkwwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKwQRZGlzdGluZ3Vpc2hlZE5hbWUwFgQJ ZW50cnlVVUlEBAlvYmplY3RTSUQwMQQXYnJpZGdlaGVhZFRyYW5zcG9ydExpc3QwFgQJZW50cnlV VUlEBAlvYmplY3RTSUQwNAQabXNEUy1PcGVyYXRpb25zRm9yQXpUYXNrQkwwFgQJZW50cnlVVUlE BAlvYmplY3RTSUQwKwQRbXNEUy1oYXNNYXN0ZXJOQ3MwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQw KwQRZGVmYXVsdENsYXNzU3RvcmUwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKwQRc2hvd0luQWRk cmVzc0Jvb2swFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwLgQUaXBzZWNPd25lcnNSZWZlcmVuY2Uw FgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKQQPc2VydmVyUmVmZXJlbmNlMBYECWVudHJ5VVVJRAQJ b2JqZWN0U0lEMCsEEW1zRFMtSGFzRG9tYWluTkNzMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMC4E FG1zRFMtT2JqZWN0UmVmZXJlbmNlMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMDAEFm1zRFMtT2Jq ZWN0UmVmZXJlbmNlQkwwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwJgQMbmV0Ym9vdFNDUEJMMBYE CWVudHJ5VVVJRAQJb2JqZWN0U0lEMCkED21zRHMtbWFzdGVyZWRCeTAWBAllbnRyeVVVSUQECW9i amVjdFNJRDAwBBZtc0NPTS1QYXJ0aXRpb25TZXRMaW5rMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lE MCYEDGRlZmF1bHRHcm91cDAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAuBBRpcHNlY0ZpbHRlclJl ZmVyZW5jZTAWBAllbnRyeVVVSUQECW9iamVjdFNJRDAnBA1kaXJlY3RSZXBvcnRzMBYECWVudHJ5 VVVJRAQJb2JqZWN0U0lEMCUEC3RydXN0UGFyZW50MBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMC0E E3JJRE1hbmFnZXJSZWZlcmVuY2UwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwIQQHbWFuYWdlcjAW BAllbnRyeVVVSUQECW9iamVjdFNJRDAwBBZwaHlzaWNhbExvY2F0aW9uT2JqZWN0MBYECWVudHJ5 VVVJRAQJb2JqZWN0U0lEMCEEB3N1YlJlZnMwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwIwQJcm9v dFRydXN0MBYECWVudHJ5VVVJRAQJb2JqZWN0U0lEMDkEH2lwc2VjTmVnb3RpYXRpb25Qb2xpY3lS ZWZlcmVuY2UwFgQJZW50cnlVVUlEBAlvYmplY3RTSUQwKAQObWFuYWdlZE9iamVjdHMwFgQJZW50 cnlVVUlEBAlvYmplY3RTSUQwIAQGbkNOYW1lMBYECWVudHJ5VVVJRAQJb2JqZWN0U0lE --=-vUh+QDuuW5KKlkVC19pp Content-Disposition: attachment; filename=response Content-Type: application/octet-stream; name=response Content-Transfer-Encoding: base64 MIITbwIBBmSCD54ENGNuPUFkbWluaXN0cmF0b3IsY249VXNlcnMsZGM9c2FtYmEsZGM9ZXhhbXBs ZSxkYz1jb20wgg9kMBUEAmNuMQ8EDUFkbWluaXN0cmF0b3IwRwQLZGVzY3JpcHRpb24xOAQ2QnVp bHQtaW4gYWNjb3VudCBmb3IgYWRtaW5pc3RlcmluZyB0aGUgY29tcHV0ZXIvZG9tYWluMB0EEnVz ZXJBY2NvdW50Q29udHJvbDEHBAU2NjA0ODArBAlvYmplY3RTaWQxHgQcAQUAAAAAAAUVAAAAUZnM kG8t4Wyarf059AEAADARBAphZG1pbkNvdW50MQMEATEwJwQOYWNjb3VudEV4cGlyZXMxFQQTOTIy MzM3MjAzNjg1NDc3NTgwNzAhBA5zQU1BY2NvdW50TmFtZTEPBA1BZG1pbmlzdHJhdG9yMCAEFmlz Q3JpdGljYWxTeXN0ZW1PYmplY3QxBgQEVFJVRTAcBAlzYW1iYTRSRE4xDwQNQWRtaW5pc3RyYXRv cjBDBAtvYmplY3RDbGFzczE0BAN0b3AEBnBlcnNvbgQUb3JnYW5pemF0aW9uYWxQZXJzb24EBHVz ZXIECXNhbWJhNFRvcDBTBA5vYmplY3RDYXRlZ29yeTFBBD9jbj1QZXJzb24sY249U2NoZW1hLGNu PUNvbmZpZ3VyYXRpb24sZGM9c2FtYmEsZGM9ZXhhbXBsZSxkYz1jb20wggPGBBRuVFNlY3VyaXR5 RGVzY3JpcHRvcjGCA6wEggOoAQAEgBQAAAAgAAAAAAAAADAAAAABAQAAAAAABRIAAAABAgAAAAAA BSAAAAAgAgAABAB4AxcAAAAAACQA/wEPAAEFAAAAAAAFFQAAAFGZzJBvLeFsmq39OQACAAAAABQA /wEPAAEBAAAAAAAFEgAAAAAAGAD/AQ8AAQIAAAAAAAUgAAAAJAIAAAAAFACUAAIAAQEAAAAAAAUK AAAABQAoAAABAAABAAAAUxpyqy8e0BGYGQCqAEBSmwEBAAAAAAAFCgAAAAUAKAAAAQAAAQAAAFQa cqsvHtARmBkAqgBAUpsBAQAAAAAABQoAAAAFACgAAAEAAAEAAABWGnKrLx7QEZgZAKoAQFKbAQEA AAAAAAUKAAAABQAoADAAAAABAAAAhri1d0qU0RGuvQAA+ANnwQEBAAAAAAAFCgAAAAUAKAAwAAAA AQAAALKVV+RVlNERrr0AAPgDZ8EBAQAAAAAABQoAAAAFACgAMAAAAAEAAACzlVfkVZTREa69AAD4 A2fBAQEAAAAAAAUKAAAABQAsABAAAAABAAAA+IhwA+EK0hG0IgCgyWj5OQECAAAAAAAFIAAAACkC AAAFACwAEAAAAAEAAAAAQhZMwCDQEadoAKoAbgUpAQIAAAAAAAUgAAAAKQIAAAUALAAQAAAAAQAA AEDCCrypedARkCAAwE/C1M8BAgAAAAAABSAAAAApAgAAAAAUAAAAAgABAQAAAAAABQsAAAAFACgA EAAAAAEAAABCL7pZonnQEZAgAMBPwtPPAQEAAAAAAAULAAAABQAoABAAAAABAAAAhri1d0qU0RGu vQAA+ANnwQEBAAAAAAAFCwAAAAUAKAAQAAAAAQAAALOVV+RVlNERrr0AAPgDZ8EBAQAAAAAABQsA AAAFACgAEAAAAAEAAABUAY3k+LzREYcCAMBPuWBQAQEAAAAAAAULAAAABQAoAAABAAABAAAAUxpy qy8e0BGYGQCqAEBSmwEBAAAAAAABAAAAAAUALAAQAAAAAQAAABAgIF+ledARkCAAwE/C1M8BAgAA AAAABSAAAAApAgAABQA4ADAAAAABAAAAf3qWv+YN0BGihQCqADBJ4gEFAAAAAAAFFQAAAFGZzJBv LeFsmq39OQUCAAAFACwAEAAAAAEAAAAdsalGrmBaQLfo/4pY1FbSAQIAAAAAAAUgAAAAMAIAAAUA LAAwAAAAAQAAAByatm0ilNERrr0AAPgDZ8EBAgAAAAAABSAAAAAxAgAAMBIEC2JhZFB3ZENvdW50 MQMEATAwDwQIY29kZVBhZ2UxAwQBMDASBAtjb3VudHJ5Q29kZTEDBAEwMBYED2JhZFBhc3N3b3Jk VGltZTEDBAEwMBEECmxhc3RMb2dvZmYxAwQBMDAQBAlsYXN0TG9nb24xAwQBMDAXBA5wcmltYXJ5 R3JvdXBJRDEFBAM1MTMwEQQKbG9nb25Db3VudDEDBAEwMB0EDnNBTUFjY291bnRUeXBlMQsECTgw NTMwNjM2ODAgBAp1bmljb2RlUHdkMRIEEFbmq7Kw6TnpZ8QxgOHGErcwHQQHZEJDU1B3ZDESBBBX Elb3c3RGQrJn3yLLlF4+MCIEDG50UHdkSGlzdG9yeTESBBBW5quysOk56WfEMYDhxhK3MCIEDGxt UHdkSGlzdG9yeTESBBBXElb3c3RGQrJn3yLLlF4+MIIGIgQXc3VwcGxlbWVudGFsQ3JlZGVudGlh bHMxggYFBIIGAQAAAAD0BQAAAAAAACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAg ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAA IAAgAFAAAwAgADABAQBQAHIAaQBtAGEAcgB5ADoASwBlAHIAYgBlAHIAbwBzADAzMDAwMDAwMDIw MDAwMDAzQzAwM0MwMDRDMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzMDAwMDAwMDgwMDAwMDA4ODAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDA4MDAwMDAwOTAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwNTMwMDQxMDA0RDAwNDIwMDQxMDAyRTAwNDUwMDU4 MDA0MTAwNEQwMDUwMDA0QzAwNDUwMDJFMDA0MzAwNEYwMDREMDA0MTAwNjQwMDZEMDA2OTAwNkUw MDY5MDA3MzAwNzQwMDcyMDA2MTAwNzQwMDZGMDA3MjAwNzk0OUNCRkJGNDBCMjM0OTc5NDlDQkZC RjQwQjIzNDkQAEAAAgBQAGEAYwBrAGEAZwBlAHMANEIwMDY1MDA3MjAwNjIwMDY1MDA3MjAwNkYw MDczMDAwMDAwNTcwMDQ0MDA2OTAwNjcwMDY1MDA3MzAwNzQwMB4AwAMBAFAAcgBpAG0AYQByAHkA OgBXAEQAaQBnAGUAcwB0ADMxMDAwMTFEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwRUI2RjczQUZC QzMzOTYxNEVFNjQ3MUZDMEVEQ0FEN0VBMTk5RThCRjEwNDc5NzJCMjE1NzUwNEM0RUM4OUJCM0M1 MERFNDc4OTk5OEQwODdCQkJCQkFFREVGMjE3OUVGRUI2RjczQUZCQzMzOTYxNEVFNjQ3MUZDMEVE Q0FEN0U4MjNERDkxRUQ2NzI1NjU3RUUxQTNDRDQ0NTFGRTZGRTFFOEU0OEEyMjYxNTYwNDcwQzkz MUQwMTAxM0I3OEYzRDI4QzI1RjU1Nzk2QzhFM0FDRjIwQURFNjZGRTMwMDY4NjNGOTA4QTE2RkZG QzZFQTAzM0Q1OTFERkQzRUJGRjlGRjI3OEU1NEM2NjQ1MzM2RTcyNUM5NkNDQkJDMUZGQkM3QTA0 QUI5QTg3NzVCQkIyRkExMEQ0RkQ0QkY0MUIxNTY1QjJFMzNCRjA4ODUzMjI2MDVDQTRERTM2NEU3 Qzg2M0Y5MDhBMTZGRkZDNkVBMDMzRDU5MURGRDNFQkZGNjI5NzU5N0MxNThBNzA4QTM4MEVDOTZE MTY0MzhERjZGMjAyQ0QwNUQ4QjcxRjgzQjBBQkY0OEMzOEFERjJGNDhBMTA0MzA1OEExNDU0RTk2 NUE0NjI5REYzMjZGMjQ4QkYxQUZFNkFDQTU0OEU0OEVBN0I1NUQ4ODJGMDY2MEE4QTMyRTI5RkQ0 RDMyMzI3Mjk1Qzk5QTUyQzA4NTY3NUZENDVCNTI2M0MxMDQ2NDhBQ0Y4QUNEQjExNDVFQ0JEQzMy OTc5RkQ4RjZCMkU0RTI0MkQ4N0JFRTlGMEREODVDMzA2NTZFQTJENTUyRjhCNEExNzQ5QTA0OTFD QTA2NDMwQkM2NjlCNjIwNDlEQTdGRkY5MzI5Nzc1RDk1QjZERTg3OUExMTg5QjM2QUNFNTlFMDEx MzNCQTJFNDM5RTJENzQ5MTYzRDI4MEI1Q0VEMDQyMEE4RTUyRERFMTkzRjRFM0Q2OUY5REQ4NThB ODBFQjI5NUY0ODEwOUQ3RDlCMkVFOUUyNzY0NTQxOTNERDgxOUUzNjg1RUVDM0VDMEI4MzRBRDQ3 OTk4NEM3MjUxNzRDNzk4NTNDNUZGMDkwRUE1Q0M0RjU5QjIzREEzOTBDMEM4MkMyRTEyMkQwOEM1 M0IxMjAzRTdDRkNBN0UzQjI2Q0Y1MkREQjczRjFBM0VGQzExQjdEREQ4M0YyREJERDgzMzY2RTM5 MEYwMkNGOQAwIgQKcHdkTGFzdFNldDEUBBIxMjg3MzQzMDg1NDAwMDAwMDAwHAQVbXNEUy1LZXlW ZXJzaW9uTnVtYmVyMQMEATEwEwQMaW5zdGFuY2VUeXBlMQMEATQwMwQJZW50cnlVVUlEMSYEJGU4 MDFjMTBjLTViNmEtMTAyZC05MDk2LTU1MGYxMWFkZWE4OTAkBA9jcmVhdGVUaW1lc3RhbXAxEQQP MjAwODEyMTEwMTAwNTRaMDYECGVudHJ5Q1NOMSoEKDIwMDgxMjExMDEwMDU0LjQwNjkzOFojMDAw MDAwIzAwMCMwMDAwMDAwJAQPbW9kaWZ5VGltZXN0YW1wMREEDzIwMDgxMjExMDEwMDU0WjCCATEE CG1lbWJlck9mMYIBIwQ4Y249RW50ZXJwcmlzZSBBZG1pbnMsY249VXNlcnMsZGM9c2FtYmEsZGM9 ZXhhbXBsZSxkYz1jb20ENGNuPVNjaGVtYSBBZG1pbnMsY249VXNlcnMsZGM9c2FtYmEsZGM9ZXhh bXBsZSxkYz1jb20ENGNuPURvbWFpbiBBZG1pbnMsY249VXNlcnMsZGM9c2FtYmEsZGM9ZXhhbXBs ZSxkYz1jb20EQmNuPUdyb3VwIFBvbGljeSBDcmVhdG9yIE93bmVycyxjbj1Vc2VycyxkYz1zYW1i YSxkYz1leGFtcGxlLGRjPWNvbQQ3Y249QWRtaW5pc3RyYXRvcnMsY249QnVpbHRpbixkYz1zYW1i YSxkYz1leGFtcGxlLGRjPWNvbaCCA8YwggPCBBkxLjMuNi4xLjQuMS40MjAzLjY2Ni41LjE2BIID ozCCA58wgagECG1lbWJlck9mBDhjbj1FbnRlcnByaXNlIEFkbWlucyxjbj1Vc2VycyxkYz1zYW1i YSxkYz1leGFtcGxlLGRjPWNvbaBiMDMECWVudHJ5VVVJRDEmBCRlODJjYjIxOC01YjZhLTEwMmQt OTA5OC01NTBmMTFhZGVhODkwKwQJb2JqZWN0U2lkMR4EHAEFAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAA= --=-vUh+QDuuW5KKlkVC19pp-- --=-3DGTDdLilVnhuysLkRP/ Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBJQGs/z4A8Wyi0NrsRApYSAKCypwyLcW8Xy7h/bZm+jVgwfXsrzACgqKLt aQNMQH/eZvlH1z5jyZ7/FYA= =OLsg -----END PGP SIGNATURE----- --=-3DGTDdLilVnhuysLkRP/--

1 0

Re: (ITS#5853) LDAP search crashes when chasing multiple referrals
by ando＠sys-net.it 10 Dec '08

10 Dec '08

jsafrane(a)redhat.com wrote: > Following ldapsearch crashes when referral chasing is enabled in very unusual > environment with many AD servers referring to each other (I had to increase > refhoplimit to chase all the referrals). Thanks for the detailed report. However, IMHO, automatic referral chasing Is Broken. Clients should explicitly chase them, possibly providing some interactive means for rebinding. This is what is currently done, for example, by slapd when using slapo-chain(5), and what should be done by proxy backends as well. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5853) LDAP search crashes when chasing multiple referrals
by jsafrane＠redhat.com 09 Dec '08

09 Dec '08

Full_Name: Jan Safranek Version: 2.4.13 OS: Linux. Fedora 9, x86_64 URL: http://people.redhat.com/jsafrane/openldap-referral-crash/ Submission from: (NULL) (89.102.11.105) Following ldapsearch crashes when referral chasing is enabled in very unusual environment with many AD servers referring to each other (I had to increase refhoplimit to chase all the referrals). $ ldapsearch -x -C -D cn=uzivatelk,ou=Services,ou=BOUDA,ou=administrace,dc=broken,dc=net -w 'mojeheslo' -b "dc=broken,dc=net" -h f9 "(sAMAccountName=uzivatel)" ldapsearch: sockbuf.c:88: ber_sockbuf_ctrl: Assertion `sb != ((void *)0)' failed. You can find the stack trace below and ldapsearch -d -1 output at http://people.redhat.com/jsafrane/openldap-referral-crash/, together with LDAP traffic in pcap format. IMO, if there are more referrals involved (A refers to B, which refers to C), wait4msg() and try_read1msg() functions are called recursively several times. When referral to C is being resolved, the stack looks like this: 1: try_read1msg 2: wait4msg 3: ldap_result ... 4: ldap_chase_v3referrals 5: try_read1msg 6: wait4msg 7: ldap_result ... 8: ldap_chase_v3referrals 9: try_read1msg 10: ldap_result 11: wait4msg 12: do_search 13: main Looking at the wait4msg(), result.c:393, it goes through all connections inside LDAP structure: for ( lc = ld->ld_conns; rc == LDAP_MSG_X_KEEP_LOOKING && lc != NULL; ) { if ( lc->lconn_status == LDAP_CONNST_CONNECTED && ldap_is_read_ready( ld, lc->lconn_sb ) ) { <...mutexes...> rc = try_read1msg( ld, msgid, all, &lc, result ); <...mutexes...> if ( lc == NULL ) { /* if lc gets free()'d, * there's no guarantee * lc->lconn_next is still * sane; better restart * (ITS#4405) */ lc = ld->ld_conns; /* don't get to next conn! */ break; } } /* next conn */ lc = lc->lconn_next; } And try_read1msg() can release the connection and change the list of connections, see result.c:944: ldap_free_connection( ld, lc, 0, 1 ); <...mutexes...> lc = *lcp = NULL; The calling wait4msg() expects that called try_read1msg() may free a connection and does not crash. But if more wait4msg() are called recursively, the "bottom ones", #6 and #11 in my stack example above, do not know about the change which try_read1msg() in #1 has made and can hold already freed 'lc' pointer -> crash. IMHO there should be some other check, that ensures that wait4msg() restarts the loop even if some inner try_read1msg() modifies the list. Or there could be some ldap_use_connecion() in try_read1msg() when referrals are being chased, so the connection does get freed only by the right try_read1msg() - #5 in my case and not #1. However, my knowledge of OpenLDAP internals is somewhat limited and I am not able to tell which way is the best. It's quite hard to reproduce the bug, the packets must arrive in the right order, so the connection to B is being freed when referral to C is being chased. I am not able to reproduce it in more controlled environment, the log is quite huge and it contains some other not so interesting referrals. The connection, which is freed too early, is connection to 'sec.broken.net' - look for the last 'ldap_free_connection: actually freed' in the log. I hope my explanation above is somewhat readable and I didn't confuse you too much :). Do not hesitate to ask for specific details. Here is the promised real stack trace. It asserts when the 'lc' in wait4msg() has been freed by previous call to try_read1msg. (gdb) bt full #0 0x0000003b49632215 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x0000003b49633d83 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x0000003b4962b039 in __assert_fail () from /lib64/libc.so.6 No symbol table info available. #3 0x000000000044d4b1 in ber_sockbuf_ctrl (sb=0x0, opt=8, arg=0x0) at sockbuf.c:88 p = (Sockbuf_IO_Desc *) 0x452f65 ret = 0 __PRETTY_FUNCTION__ = "ber_sockbuf_ctrl" #4 0x0000000000416222 in try_read1msg (ld=0x1b80fa0, msgid=18, all=1, lcp=0x7fffe4f67ae8, result=0x7fffe4f67be8) at result.c:1190 ber = (BerElement *) 0x1b8c040 newmsg = (LDAPMessage *) 0x1b91ca0 l = (LDAPMessage *) 0x0 prev = (LDAPMessage *) 0x1b8d370 id = 2 idx = 0 tag = 115 len = 78 foundit = 0 lr = (LDAPRequest *) 0x0 tmplr = (LDAPRequest *) 0x1b8d220 dummy_lr = {lr_msgid = 0, lr_status = 0, lr_refcnt = 0, lr_outrefcnt = 0, lr_abandoned = 0, lr_origid = 0, lr_parentcnt = 0, lr_res_msgtype = 0, lr_res_errno = 0, lr_res_error = 0x0, lr_res_matched = 0x0, lr_ber = 0x0, lr_conn = 0x0, lr_dn = {bv_len = 0, bv_val = 0x0}, lr_parent = 0x0, lr_child = 0x0, lr_refnext = 0x0, lr_prev = 0x0, lr_next = 0x0} lc = (LDAPConn *) 0x1b8e3e0 tmpber = {ber_opts = {lbo_valid = 2, lbo_options = 1, lbo_debug = -1}, ber_tag = 0, ber_len = 87, ber_usertag = 0, ber_buf = 0x1b8c0a0 "\002\001\005s\204", ber_ptr = 0x1b8c0f7 "", ber_end = 0x1b8c0f7 "", ber_sos = 0x0, ber_rwptr = 0x0, ber_memctx = 0x0} rc = -2 refer_cnt = 1 hadref = 1 simple_request = 0 err = 5 lderr = 1 __PRETTY_FUNCTION__ = "try_read1msg" bv_nod = {bv_len = 22, bv_val = 0x452b0b "1.3.6.1.4.1.1466.20036"} #5 0x0000000000414c67 in wait4msg (ld=0x1b80fa0, msgid=18, all=1, timeout=0x7fffe4f67bf0, result=0x7fffe4f67be8) at result.c:402 err = 0 lc_ready = 0 rc = -2 tv = {tv_sec = 0, tv_usec = 100000} tv0 = {tv_sec = 0, tv_usec = 100000} start_time_tv = {tv_sec = 1228828417, tv_usec = 878311} tvp = (struct timeval *) 0x7fffe4f67b10 lc = (LDAPConn *) 0x1b8e3e0 __PRETTY_FUNCTION__ = "wait4msg" #6 0x0000000000414433 in ldap_result (ld=0x1b80fa0, msgid=18, all=1, timeout=0x7fffe4f67bf0, result=0x7fffe4f67be8) at result.c:127 lm = (LDAPMessage *) 0x0 rc = 18 __PRETTY_FUNCTION__ = "ldap_result" #7 0x0000000000428313 in ldap_new_connection (ld=0x1b80fa0, srvlist=0x7fffe4f67df0, use_ldsb=0, connect=1, bind=0x7fffe4f67dc0) at request.c:560 tv = {tv_sec = 0, tv_usec = 100000} res = (LDAPMessage *) 0x0 msgid = 18 rc = 0 passwd = {bv_len = 0, bv_val = 0x0} err = 1 savedefconn = (LDAPConn *) 0x1b8a380 lc = (LDAPConn *) 0x1b8c690 async = 0 __PRETTY_FUNCTION__ = "ldap_new_connection" ---Type <return> to continue, or q <return> to quit--- #8 0x00000000004276b5 in ldap_send_server_request (ld=0x1b80fa0, ber=0x1b8d290, msgid=17, parentreq=0x1b8a6e0, srvlist=0x7fffe4f67df0, lc=0x0, bind=0x7fffe4f67dc0) at request.c:207 lr = (LDAPRequest *) 0x1b8d290 incparent = 1 rc = 389 #9 0x0000000000429be6 in ldap_chase_v3referrals (ld=0x1b80fa0, lr=0x1b8cb40, refs=0x0, sref=1, errstrp=0x1b8cb70, hadrefp=0x7fffe4f67f2c) at request.c:1209 unfollowed = 0x0 unfollowedcnt = 0 origreq = (LDAPRequest *) 0x1b8a6e0 srv = (LDAPURLDesc *) 0x1b8c7b0 ber = (BerElement *) 0x1b8d290 refarray = (char **) 0x1b8c670 lc = (LDAPConn *) 0x0 rc = 0 count = 0 i = 0 j = 0 id = 17 rinfo = {ri_msgid = 2, ri_request = 99, ri_url = 0x1b91c30 "ldap://DomainDnsZones.sec.broken.net/DC=DomainDnsZones,DC=sec,DC=broken,DC=…"} #10 0x000000000041553d in try_read1msg (ld=0x1b80fa0, msgid=-1, all=0, lcp=0x7fffe4f680e8, result=0x7fffe4f68228) at result.c:729 refs = (char **) 0x1b8c670 ber = (BerElement *) 0x1b8ae00 newmsg = (LDAPMessage *) 0x0 l = (LDAPMessage *) 0x1e4f68080 prev = (LDAPMessage *) 0x7fffe4f68080 id = 2 idx = 0 tag = 115 len = 80 foundit = 0 lr = (LDAPRequest *) 0x1b8cb40 tmplr = (LDAPRequest *) 0x1b8a550 dummy_lr = {lr_msgid = 0, lr_status = 0, lr_refcnt = 0, lr_outrefcnt = 0, lr_abandoned = 0, lr_origid = 0, lr_parentcnt = 0, lr_res_msgtype = 0, lr_res_errno = 0, lr_res_error = 0x0, lr_res_matched = 0x0, lr_ber = 0x0, lr_conn = 0x0, lr_dn = {bv_len = 0, bv_val = 0x0}, lr_parent = 0x0, lr_child = 0x0, lr_refnext = 0x0, lr_prev = 0x0, lr_next = 0x0} lc = (LDAPConn *) 0x1b8beb0 tmpber = {ber_opts = {lbo_valid = 2, lbo_options = 1, lbo_debug = -1}, ber_tag = 0, ber_len = 89, ber_usertag = 0, ber_buf = 0x1b8c600 "\002\001\003s\204", ber_ptr = 0x1b8c659 "", ber_end = 0x1b8c659 "", ber_sos = 0x0, ber_rwptr = 0x0, ber_memctx = 0x0} rc = -2 refer_cnt = 0 hadref = 0 simple_request = 0 err = 4 lderr = 1 __PRETTY_FUNCTION__ = "try_read1msg" bv_nod = {bv_len = 22, bv_val = 0x452b0b "1.3.6.1.4.1.1466.20036"} #11 0x0000000000414c67 in wait4msg (ld=0x1b80fa0, msgid=-1, all=0, timeout=0x0, result=0x7fffe4f68228) at result.c:402 err = 0 lc_ready = 0 rc = -2 tv = {tv_sec = 0, tv_usec = 0} tv0 = {tv_sec = 0, tv_usec = 0} start_time_tv = {tv_sec = 0, tv_usec = 0} tvp = (struct timeval *) 0x0 lc = (LDAPConn *) 0x1b8beb0 __PRETTY_FUNCTION__ = "wait4msg" #12 0x0000000000414433 in ldap_result (ld=0x1b80fa0, msgid=-1, all=0, timeout=0x0, result=0x7fffe4f68228) at result.c:127 lm = (LDAPMessage *) 0x0 rc = 100 __PRETTY_FUNCTION__ = "ldap_result" ---Type <return> to continue, or q <return> to quit--- #13 0x0000000000408dbf in dosearch (ld=0x1b80fa0, base=0x1b7f5e0 "dc=broken,dc=net", scope=2, filtpatt=0x0, value=0x7fffe4f6b881 "(sAMAccountName=uzivatel)", attrs=0x0, attrsonly=0, sctrls=0x0, cctrls=0x0, timeout=0x0, sizelimit=-1) at ldapsearch.c:1280 filter = 0x7fffe4f6b881 "(sAMAccountName=uzivatel)" rc = 0 nresponses = 7 nentries = 1 nreferences = 6 nextended = 0 npartial = 0 res = (LDAPMessage *) 0x0 msg = (LDAPMessage *) 0x0 msgid = 2 retoid = 0x0 retdata = (struct berval *) 0x0 nresponses_psearch = -1 cancel_msgid = -1 #14 0x00000000004084cc in main (argc=14, argv=0x7fffe4f6a4f8) at ldapsearch.c:1112 filtpattern = 0x7fffe4f6b881 "(sAMAccountName=uzivatel)" attrs = (char **) 0x0 line = '\0' <repeats 1344 times>, "\006\000\000\000\000\000\000\000\200\220öäÿ\177\000\000\220\220öäÿ\177\000\000\231C!J;\000\000\000\237C!J;\000\000\000\023pdI;", '\0' <repeats 47 times>, "º\005\000\000\004\000\000\000\000\000\000\000à\220öäÿ\177\000\000ð\220öäÿ\177\000\000ÔB!J;\000\000\000ØB!J;\000\000\000\023pdI;", '\0' <repeats 47 times>, "º\005\000\000X\220öäÿ\177\000\000x\220öäÿ\177\000\000 \220öäÿ\177\000\000p\220öäÿ\177\000\000Ð\213öäÿ\177", '\0' <repeats 18 times>, "\205ç Iøÿÿÿ\000\000\000\000\000\000\000\000èÔAI;\000\000\000"... fp = (FILE *) 0x0 rc = 4213523 rc1 = 0 i = 0 first = 32767 ld = (LDAP *) 0x1b80fa0 seber = (BerElement *) 0x0 vrber = (BerElement *) 0x0 syncber = (BerElement *) 0x0 syncbvalp = (struct berval *) 0x0 err = 4216832 (gdb)

1 0

Re: (ITS#5840) bdb_online_index and shutdown
by h.b.furuseth＠usit.uio.no 09 Dec '08

09 Dec '08

hyc(a)symas.com writes: >ando(a)sys-net.it wrote: >>h.b.furuseth(a)usit.uio.no wrote: >>> If it knows enough to complain, why not restart the indexing task? >> >> There should be an option in doing that. I don't quite see why. If you add an index via cn=config, that starts an indexing task while slapd is running. A following shutdown-restart is not necessarily related to a desire to not run that task. >> In fact, I suspect running slapindex -q can be much more efficient >> than letting slapd index while serving without index. (...) If you shut down slapd because you want to use slapindex, then you know what you want - so just go ahead and use slapindex. No extra flag needed. I suppose there could be a flag to _not_ start the indexing task when you add an index via cn=config, so you always must slapindex. > I suppose we should save the last entryID that was indexed at shutdown time, > so that the indexer task can resume at the next startup. We'd also need some > coordination with slapindex, so that if you ran slapindex after shutdown, it > would erase the saved status. Rather than add any fields to the DB index > files, it would probably be OK to write the status in the cn=config tree. Or a status file in the database directory. A cn=config attribute would make it messy to swap database directories around, since one must also modify cn=config when doing so. -- Hallvard

1 0

Re: (ITS#5852) ACL behaviour does not match Admin Guide
by andrew.findlay＠skills-1st.co.uk 09 Dec '08

09 Dec '08

On Mon, Dec 08, 2008 at 09:01:44PM +0000, quanah(a)zimbra.com wrote: > > Full_Name: Andrew Findlay > > Version: HEAD 2008-12-05 > > OS: SuSE 10.2 > > URL: > > Submission from: (NULL) (88.97.25.132) > > > > > > Section 7.2.5 Access Control Examples says: > > ... > > Also note that if no access to directive matches or no by <who> clause, > > access is denied. That is, every access to directive ends with an > > implicit by * none clause and every access list ends with an implicit > > access to * by * none directive. > > > > The statement about access *lists* ending with a deny directive is wrong > > (or at least misleading). > > I think it is quite clear: > > The structure of the access control directives is > ... > Lists of access directives are evaluated in the order they appear in > slapd.conf. > > Each <who> clause list is implicitly terminated by a > > by * none stop > > > So, there are acl directives where each directive is an element of a list. > Every element of a list of acl directives is terminated by * none stop. That is not the aspect that worries me here. The statement in 7.2.5 agrees with what you say about individual directives. I am concerned about the behaviour of complete access *lists*. For example, if my global acccess list says: access to * by * read and the access list for a BDB database holding the suffix 'dc=example,dc=org' says: access to dn.exact="cn=nonesuch,dc=example,dc=org" by users read (i.e. it is very restrictive and does not give ANON anything) In this case the statement in 7.2.5 implies that ANON should not be able to read dc=example,dc=org but tests show that it can. Changing the global access list to: access to * by users read prevents ANON from reading dc=example,dc=org and thus proves that the per-database access list does not end with 'by * none stop' (but the complete list including the global section does). Sections 7.2.4 and 7.3.4 describe this behaviour rather better, but do not mention the default-deny that gets appended to a non-empty access list. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Re: slapd hanging upon shutdown (ITS#5841)
by rhafer＠suse.de 09 Dec '08

09 Dec '08

Am Montag 08 Dezember 2008 16:39:33 schrieb Hallvard B Furuseth: > Yes, this sounds familiar. I guess I mentioned it but didn't have time > to check it. The offending if() comes from tpool.c rev 1.81, which was > apparently a wrong fix to ITS#5194. rev 1.82 was the right fix. > (Except I'm not so sure it was the _complete_ fix - might need to lock > ldap_pvt_thread_pool_mutex while changing or even accessing *tpool, or > something like that...) > > Anyway, the patch looks correct to me, undoing rev 1.81. Thanks very much for the clarification. > The current code is clear enough in retrospect - a thread pool pause in > halts pool_destroy() since pool_resume() doesn't broadcast - and thus a > cn=config update (or access?) aborts slapd shutdown:-( It doesn't really abore shutdown in sense of slapd accepting requests again. slapd is completely lockup in such a condition. It doesn't accept requests anymore, neither does it shutdown completely. Anyway, I've just applied the fix to HEAD. -- regards, Ralf

1 0

Re: (ITS#5840) bdb_online_index and shutdown
by hyc＠symas.com 09 Dec '08

09 Dec '08

ando(a)sys-net.it wrote: > h.b.furuseth(a)usit.uio.no wrote: >> ando(a)sys-net.it writes: >>> - the index should be invalidated >>> - slapd, at the next manual startup, should complain about the need to >>> run slapindex first. >> If it knows enough to complain, why not restart the indexing task? > > There should be an option in doing that. In fact, I suspect running > slapindex -q can be much more efficient than letting slapd index while > serving without index. Of course, slapd cannot serve while > slapindex'ing, so I think human intervention is needed to determine > what's most appropriate on a case by case basis. I suppose we should save the last entryID that was indexed at shutdown time, so that the indexer task can resume at the next startup. We'd also need some coordination with slapindex, so that if you ran slapindex after shutdown, it would erase the saved status. Rather than add any fields to the DB index files, it would probably be OK to write the status in the cn=config tree. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5852) ACL behaviour does not match Admin Guide
by quanah＠zimbra.com 08 Dec '08

08 Dec '08

--On Monday, December 08, 2008 7:33 PM +0000 andrew.findlay(a)skills-1st.co.uk wrote: > Full_Name: Andrew Findlay > Version: HEAD 2008-12-05 > OS: SuSE 10.2 > URL: > Submission from: (NULL) (88.97.25.132) > > > Section 7.2.5 Access Control Examples says: > ... > Also note that if no access to directive matches or no by <who> clause, > access is denied. That is, every access to directive ends with an > implicit by * none clause and every access list ends with an implicit > access to * by * none directive. > > The statement about access *lists* ending with a deny directive is wrong > (or at least misleading). I think it is quite clear: The structure of the access control directives is ... Lists of access directives are evaluated in the order they appear in slapd.conf. Each <who> clause list is implicitly terminated by a by * none stop So, there are acl directives where each directive is an element of a list. Every element of a list of acl directives is terminated by * none stop. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5852) ACL behaviour does not match Admin Guide
by andrew.findlay＠skills-1st.co.uk 08 Dec '08

08 Dec '08

Full_Name: Andrew Findlay Version: HEAD 2008-12-05 OS: SuSE 10.2 URL: Submission from: (NULL) (88.97.25.132) Section 7.2.5 Access Control Examples says: ... Also note that if no access to directive matches or no by <who> clause, access is denied. That is, every access to directive ends with an implicit by * none clause and every access list ends with an implicit access to * by * none directive. The statement about access *lists* ending with a deny directive is wrong (or at least misleading). The truth is that the global access list is effectively appended to each per-database list. If the resulting list is non-empty then a default deny is appended. If there are *no* access directives applicable to a backend at all then a default read is used. slapd.access(5) is clearer about this but still not clear enough about the default-deny case. Sections 7.2.4 and 7.3.4 are fairly clear about the drop-though from backend ACLs to global ACLs, but say nothing about the default-deny case. Clearly the docs do not match the code in this area. In many ways I prefer the idea that an access list should end with a default deny (and *not* get the global list appended), but there may well be people depending on the current behaviour.

1 0

(ITS#5851) ACL behaviour does not match slapd.access(5)
by andrew.findlay＠skills-1st.co.uk 08 Dec '08

08 Dec '08

Full_Name: Andrew Findlay Version: HEAD 2008-12-05 OS: SuSE 10.2 URL: Submission from: (NULL) (88.97.25.132) Some ACL behaviours do not match slapd.access(5). slapd.access(5) says: > For entries not held in any backend (such as a root DSE), > the directives of the first backend (and any global directives) are used. I created a slapd.conf where the global ACL was: access to * by * none and the single BDB backend had acls: access to dn.exact="" by * read access to dn.exact="cn=nonesuch" by * read The anon user could not read the root DSE: ldapsearch -LLL -H ldap://localhost:1389/ -b '' -s base -x '(objectclass=*)' + I next moved the root access clause to the global section: access to dn.exact="" by * read access to * by * none The BDB backend now had this ACL: access to dn.exact="cn=nonesuch" by * read Anon was now able to read the root DSE. Thus it appears that the root DSE is controlled by the global ACL but not by the first backend ACL. My feeling is that the behaviour is right and the manpage needs updating. The Admin Guide has similar statements in 7.2.4 and 7.3.4. The complete slapd.conf file follows for reference: ------------------------------------------------------------------------------- # Logging - this goes to syslog as 'local4' # # 512+256 to enable stats logging # loglevel 768 # Schema definitions # include ../../etc/schema/core.schema include ../../etc/schema/cosine.schema include ../../etc/schema/inetorgperson.schema # These should have absolute pathnames on production systems pidfile ./slapd.pid argsfile ./slapd.args ######################################################################## # Default ACL ######################################################################## access to * by * none ######################################################################## ####################################################################### # The main database ####################################################################### ######################################################################## database bdb suffix "dc=example,dc=org" rootdn "cn=root,dc=example,dc=org" password-hash {SSHA} # rootpw password # The database directory MUST exist prior to running slapd AND # should only be accessable by the slapd/tools. Mode 700 recommended. # This should be an absolute pathname on production servers. # directory ./openldap-db # Entry cache size # cachesize 4000 # How often we force a checkpoint on the underlying database # kilobytes and seconds # checkpoint 128 300 ######################################################################## # Indices to maintain ######################################################################## index objectClass eq ######################################################################## # ACLs for this database ######################################################################## access to dn.exact="" by * read access to dn.exact="cn=nonesuch" by * read

1 0

Re: (ITS#5840) bdb_online_index and shutdown
by ando＠sys-net.it 08 Dec '08

08 Dec '08

h.b.furuseth(a)usit.uio.no wrote: > ando(a)sys-net.it writes: >> - the index should be invalidated >> - slapd, at the next manual startup, should complain about the need to >> run slapindex first. > > If it knows enough to complain, why not restart the indexing task? There should be an option in doing that. In fact, I suspect running slapindex -q can be much more efficient than letting slapd index while serving without index. Of course, slapd cannot serve while slapindex'ing, so I think human intervention is needed to determine what's most appropriate on a case by case basis. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5840) bdb_online_index and shutdown
by h.b.furuseth＠usit.uio.no 08 Dec '08

08 Dec '08

ando(a)sys-net.it writes: > - the index should be invalidated > - slapd, at the next manual startup, should complain about the need to > run slapindex first. If it knows enough to complain, why not restart the indexing task? -- Hallvard

1 0

Re: slapd hanging upon shutdown (ITS#5841)
by h.b.furuseth＠usit.uio.no 08 Dec '08

08 Dec '08

Yes, this sounds familiar. I guess I mentioned it but didn't have time to check it. The offending if() comes from tpool.c rev 1.81, which was apparently a wrong fix to ITS#5194. rev 1.82 was the right fix. (Except I'm not so sure it was the _complete_ fix - might need to lock ldap_pvt_thread_pool_mutex while changing or even accessing *tpool, or something like that...) Anyway, the patch looks correct to me, undoing rev 1.81. The current code is clear enough in retrospect - a thread pool pause in halts pool_destroy() since pool_resume() doesn't broadcast - and thus a cn=config update (or access?) aborts slapd shutdown:-( -- Hallvard

1 0

Re: slapd hanging upon shutdown (ITS#5841)
by rhafer＠suse.de 08 Dec '08

08 Dec '08

Am Freitag 05 Dezember 2008 09:07:53 schrieb Howard Chu: > I seem to recall there was a race such that the condvar had already been > destroyed before it got here. Don't remember the details at the moment, and > not in a position to look it up either, but perhaps trawling thru -devel > will reveal it. Sounds like something Hallvard brought up in the past. I failed to see how such a race could happen with the current code in HEAD. The condvar is only destroyed after ltp_open_count decreased to 0. There might have been such problems when _thread_pool_destroy just used a simple if statement (instead of a while loop) for checking ltp_open_count. But that has been changed long ago, as part of ITS#4943. Maybe Hallvard can shed some light on this. -- regards, Ralf

1 0

(ITS#5850) adding a new server to ammr pool switches mirror-mode off
by ando＠sys-net.it 06 Dec '08

06 Dec '08

Full_Name: Pierangelo Masarati Version: HEAD/re24 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (82.63.140.131) Submitted by: ando When adding a new value to olcSyncrepl to a member of a mmr pool, in order to configure a new pool member, olcMirrorMode is automatically reset since the URI of the new olcSyncrepl differs from the olcServerID. A workaround consists in explicitly reseting olcMirrorMode to TRUE within the same modify operation. p.

1 0

Re: (ITS#5849) memory leak when using client certificates
by dhawes＠vt.edu 05 Dec '08

05 Dec '08

dhawes(a)vt.edu wrote: > dhawes(a)vt.edu wrote: >> Full_Name: David Hawes >> Version: 2.4.13 >> OS: Debian GNU/Linux 4.0 >> URL: >> Submission from: (NULL) (98.117.88.57) >> >> >> As outlined at: >> >> http://www.openldap.org/lists/openldap-software/200811/msg00136.html >> >> OpenLDAP 2.4 leaks memory when TLS client certificates are used. Running slapd >> under valgrind yields the following: >> >> ==13311== 4,906 (92 direct, 4,814 indirect) bytes in 1 blocks are >> definitely lost in loss record 19 of 23 >> ==13311== at 0x401D898: malloc (vg_replace_malloc.c:207) >> ==13311== by 0x41FCCC4: default_malloc_ex (mem.c:79) >> ==13311== by 0x41FD33F: CRYPTO_malloc (mem.c:304) >> ==13311== by 0x428CA65: asn1_item_ex_combine_new (tasn_new.c:191) >> ==13311== by 0x428C79C: ASN1_item_ex_new (tasn_new.c:85) >> ==13311== by 0x428ECAA: ASN1_item_ex_d2i (tasn_dec.c:399) >> ==13311== by 0x428E5F9: ASN1_item_d2i (tasn_dec.c:134) >> ==13311== by 0x4286A57: d2i_X509 (x_x509.c:136) >> ==13311== by 0x4194F26: ssl3_get_client_certificate (s3_srvr.c:2521) >> ==13311== by 0x4191897: ssl3_accept (s3_srvr.c:462) >> ==13311== by 0x41AD930: SSL_accept (ssl_lib.c:867) >> ==13311== by 0x815D00E: ldap_pvt_tls_accept (tls.c:1594) >> ==13311== by 0x8076926: connection_read_thread (connection.c:1286) >> ==13311== by 0x813CEE5: ldap_int_thread_pool_wrapper (tpool.c:663) >> ==13311== by 0x415823F: start_thread (in >> /lib/tls/i686/cmov/libpthread-2.3.6.so) >> ==13311== by 0x43ED49D: clone (in /lib/tls/i686/cmov/libc-2.3.6.so) >> >> Philip Guenther notes: >> >> In 2.4.x, tls_get_cert_dn() leaks a reference to the client's X509 cert: >> the call to SSL_get_peer_certificate() in tls_get_cert() increments the >> reference count on the cert and it never gets decremented by a call to >> X509_free(). Simply adding the call there might not be safe, depending on >> whether the berval that tls_get_cert_dn() sets up relies on the underlying >> X509 to stay valid for longer than this chain of calls, as the X509 may be >> invalidated by a rehandshake. > > Calling X509_free(x) before the return statement in tls_get_cert_dn() > does fix the memory leak, though I do not know if this is proper, as > Philip noted. My apologies for not checking the ITS before sending that message. The fix in HEAD works.

1 0

Re: (ITS#5849) memory leak when using client certificates
by dhawes＠vt.edu 05 Dec '08

05 Dec '08

dhawes(a)vt.edu wrote: > Full_Name: David Hawes > Version: 2.4.13 > OS: Debian GNU/Linux 4.0 > URL: > Submission from: (NULL) (98.117.88.57) > > > As outlined at: > > http://www.openldap.org/lists/openldap-software/200811/msg00136.html > > OpenLDAP 2.4 leaks memory when TLS client certificates are used. Running slapd > under valgrind yields the following: > > ==13311== 4,906 (92 direct, 4,814 indirect) bytes in 1 blocks are > definitely lost in loss record 19 of 23 > ==13311== at 0x401D898: malloc (vg_replace_malloc.c:207) > ==13311== by 0x41FCCC4: default_malloc_ex (mem.c:79) > ==13311== by 0x41FD33F: CRYPTO_malloc (mem.c:304) > ==13311== by 0x428CA65: asn1_item_ex_combine_new (tasn_new.c:191) > ==13311== by 0x428C79C: ASN1_item_ex_new (tasn_new.c:85) > ==13311== by 0x428ECAA: ASN1_item_ex_d2i (tasn_dec.c:399) > ==13311== by 0x428E5F9: ASN1_item_d2i (tasn_dec.c:134) > ==13311== by 0x4286A57: d2i_X509 (x_x509.c:136) > ==13311== by 0x4194F26: ssl3_get_client_certificate (s3_srvr.c:2521) > ==13311== by 0x4191897: ssl3_accept (s3_srvr.c:462) > ==13311== by 0x41AD930: SSL_accept (ssl_lib.c:867) > ==13311== by 0x815D00E: ldap_pvt_tls_accept (tls.c:1594) > ==13311== by 0x8076926: connection_read_thread (connection.c:1286) > ==13311== by 0x813CEE5: ldap_int_thread_pool_wrapper (tpool.c:663) > ==13311== by 0x415823F: start_thread (in > /lib/tls/i686/cmov/libpthread-2.3.6.so) > ==13311== by 0x43ED49D: clone (in /lib/tls/i686/cmov/libc-2.3.6.so) > > Philip Guenther notes: > > In 2.4.x, tls_get_cert_dn() leaks a reference to the client's X509 cert: > the call to SSL_get_peer_certificate() in tls_get_cert() increments the > reference count on the cert and it never gets decremented by a call to > X509_free(). Simply adding the call there might not be safe, depending on > whether the berval that tls_get_cert_dn() sets up relies on the underlying > X509 to stay valid for longer than this chain of calls, as the X509 may be > invalidated by a rehandshake. Calling X509_free(x) before the return statement in tls_get_cert_dn() does fix the memory leak, though I do not know if this is proper, as Philip noted.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs