- openldap-bugs - openldap.org

Re: ITS#5724 (Re: commit: ldap/servers/slapd backover.c)
by ando＠sys-net.it 06 Oct '08

06 Oct '08

Howard Chu wrote: > ando(a)sys-net.it wrote: >> ando(a)OpenLDAP.org wrote: >> >>> Log Message: >>> open database using the real structure (partial fix to ITS#5724) >> >> We need a virtual database to inherit controls from the real database. >> Sharing the array of known controls could be a solution, but it wouldn't >> allow the virtual database to have specific controls, e.g. registered by >> an overlay. A solution would be to let the real database know it's >> related to virtual ones, so that modifications to the real database via >> back-config can be propagated to the virtual ones. This, of course, >> poses the problem that if a virtual database is deleted, any reference >> to it must be removed from the list of related databases. I wonder if >> all of this is worth the effort of exposing real controls by the virtual >> database. > > Since a single relay database may be configured to multiplex to many > other databases, and they may not all support the same set of controls, > this seems to be an exercise in futility. I guess it may be OK to just > advertise a union of all the real database controls, and perform an > extra restriction check before handing off processing. Sharing the pointer to the supported controls would allow to use the actual set. Something along the line struct BackendDB { char be_ctrlsbuf[SLAP_MAX_CIDS + 1]; char *be_ctrls; }; All backends would have be_ctrls = be_ctrlsbuf, but back-relay would set it to NULL, and temporarily set it to the relayed database's be_ctrlsbuf for the duration of an operation. Modules wouldn't be able to register new controls because the pointer is null otherwise. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: ITS#5724 (Re: commit: ldap/servers/slapd backover.c)
by hyc＠symas.com 06 Oct '08

06 Oct '08

ando(a)sys-net.it wrote: > ando(a)OpenLDAP.org wrote: > >> Log Message: >> open database using the real structure (partial fix to ITS#5724) > > We need a virtual database to inherit controls from the real database. > Sharing the array of known controls could be a solution, but it wouldn't > allow the virtual database to have specific controls, e.g. registered by > an overlay. A solution would be to let the real database know it's > related to virtual ones, so that modifications to the real database via > back-config can be propagated to the virtual ones. This, of course, > poses the problem that if a virtual database is deleted, any reference > to it must be removed from the list of related databases. I wonder if > all of this is worth the effort of exposing real controls by the virtual > database. Since a single relay database may be configured to multiplex to many other databases, and they may not all support the same set of controls, this seems to be an exercise in futility. I guess it may be OK to just advertise a union of all the real database controls, and perform an extra restriction check before handing off processing. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5726) syncrepl must look at runqueue also after successful connection
by rein＠OpenLDAP.org 05 Oct '08

05 Oct '08

Full_Name: Rein Tollevik Version: CVS head OS: linux, solaris URL: Submission from: (NULL) (84.215.36.97) Submitted by: rein The first fix to ITS#5454 in revision 1.392 appear to be wrong under curtain situations, runqueue manipulation must be done after a paused syncrepl connection is rescheduled. Ref: http://www.openldap.org/lists/openldap-devel/200810/msg00014.html It looks as if switching from trylock to lock at the start of do_syncrepl() should be the only fix for ITS#5454, and that the optimization this revision introduces should be reverted. I'll commit that shortly. Rein Tollevik Basefarm AS

1 0

Re: (ITS#5723) test046-dds failed
by ando＠sys-net.it 05 Oct '08

05 Oct '08

dieter(a)dkluenter.de wrote: > test046 fails due to insufficient access. Fixed in HEAD. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

ITS#5724 (Re: commit: ldap/servers/slapd backover.c)
by ando＠sys-net.it 05 Oct '08

05 Oct '08

ando(a)OpenLDAP.org wrote: > Log Message: > open database using the real structure (partial fix to ITS#5724) We need a virtual database to inherit controls from the real database. Sharing the array of known controls could be a solution, but it wouldn't allow the virtual database to have specific controls, e.g. registered by an overlay. A solution would be to let the real database know it's related to virtual ones, so that modifications to the real database via back-config can be propagated to the virtual ones. This, of course, poses the problem that if a virtual database is deleted, any reference to it must be removed from the list of related databases. I wonder if all of this is worth the effort of exposing real controls by the virtual database. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5724) back-relay doesn't expose underlying database controls correctly
by ando＠sys-net.it 05 Oct '08

05 Oct '08

I have a fix for this issue when the relay database is configured *after* the relayed one. I'll commit it in a moment. However, this fix does not cure your case, where the virtual database needs to appear *before* the real one, and also does not cure similar issues related, for example, to run-time configuring modules that register controls on a real database (e.g. an overlay), which would not be echoed by the virtual database. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5723) test046-dds failed
by ando＠sys-net.it 05 Oct '08

05 Oct '08

dieter(a)dkluenter.de wrote: > Full_Name: Dieter > Version: HEAD > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (84.142.238.55) > > > Hello, > test046 fails due to insufficient access. > > slapd.1.log: > > ==> bdb_add: cn=Meeting,ou=Groups,dc=example,dc=com > oc_check_required entry (cn=Meeting,ou=Groups,dc=example,dc=com), objectClass > "g > roupOfNames" > oc_check_required entry (cn=Meeting,ou=Groups,dc=example,dc=com), objectClass > "d > ynamicObject" > oc_check_allowed type "objectClass" > oc_check_allowed type "cn" > oc_check_allowed type "member" > oc_check_allowed type "entryTtl" > oc_check_allowed type "entryExpireTimestamp" > oc_check_allowed type "structuralObjectClass" > bdb_dn2entry("cn=meeting,ou=groups,dc=example,dc=com") > => bdb_dn2id("cn=meeting,ou=groups,dc=example,dc=com") > <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) > dnMatch 0 > "cn=bjorn jensen,ou=information technology > division,ou=people,dc=example > ,dc=com" > "cn=bjorn jensen,ou=information technology > division,ou=people,dc=example > ,dc=com" > bdb_add: no write access to attribute > send_ldap_result: conn=21 op=1 p=3 > send_ldap_result: err=50 matched="" text="no write access to attribute" > send_ldap_response: msgid=2 tag=105 err=50 > ber_flush2: 42 bytes to sd 13 > conn=21 op=1 RESULT tag=105 err=50 text=no write access to attribute > connection_get(13) Looks like another side effect of checking write permission on attributes during add. At this point, I suspect we'd better add a configure switch that allows restore the old behavior. The switch could be removed as soon as obsolete, much like what occurred to schemacheck. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5725) Connection enabled for events twice
by rein＠OpenLDAP.org 05 Oct '08

05 Oct '08

Full_Name: Rein Tollevik Version: CVS head OS: Linux 2.6 URL: Submission from: (NULL) (84.215.36.97) Submitted by: rein connection_client_setup() enables the connection for events twice, causing race conditions that can create deadlock situations. Ref: http://www.openldap.org/lists/openldap-devel/200810/msg00014.html A fix that removes the unnecessary call to slapd_set_read() will be committed soon. Rein Tollevik Basefarm AS

1 0

(ITS#5724) back-relay doesn't expose underlying database controls correctly
by Guillaume.Rousse＠inria.fr 05 Oct '08

05 Oct '08

Full_Name: Guillaume Rousse Version: 2.4.11 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (82.224.237.5) Here is a simple relay configuration: database relay suffix ou=telephony,dc=msr-inria,dc=inria,dc=fr overlay rwm rwm-suffixmassage ou=users,dc=msr-inria,dc=inria,dc=fr rwm-map attribute telephoneNumber homePhone rwm-map attribute telephoneNumber database bdb suffix "dc=msr-inria,dc=inria,dc=fr" rootdn "cn=root,dc=msr-inria,dc=inria,dc=fr" However, queries with critical pagedResult control fails: Oct 2 14:07:29 etoile slapd[30006]: conn=118 op=1 SRCH base="ou=telephony,dc=msr-inria,dc=inria,dc=fr" scope=2 deref=3 filter="(objectClass=inetOrgPerson)" Oct 2 14:07:29 etoile slapd[30006]: conn=118 op=1 SRCH attr=uid givenname initials sn manager departmentnumber telephonenumber mail title homephone mobile pager Oct 2 14:07:29 etoile slapd[30006]: conn=118 op=1 SEARCH RESULT tag=101 err=12 nentries=0 text=critical control unavailable in context Oct 2 14:16:15 etoile slapd[6002]: => get_ctrls Oct 2 14:16:15 etoile slapd[6002]: => get_ctrls: oid="1.2.840.113556.1.4.319" (critical) Oct 2 14:16:15 etoile slapd[6002]: <= get_ctrls: n=1 rc=0 err=""

1 0

(ITS#5723) test046-dds failed
by dieter＠dkluenter.de 05 Oct '08

05 Oct '08

Full_Name: Dieter Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.142.238.55) Hello, test046 fails due to insufficient access. slapd.1.log: ==> bdb_add: cn=Meeting,ou=Groups,dc=example,dc=com oc_check_required entry (cn=Meeting,ou=Groups,dc=example,dc=com), objectClass "g roupOfNames" oc_check_required entry (cn=Meeting,ou=Groups,dc=example,dc=com), objectClass "d ynamicObject" oc_check_allowed type "objectClass" oc_check_allowed type "cn" oc_check_allowed type "member" oc_check_allowed type "entryTtl" oc_check_allowed type "entryExpireTimestamp" oc_check_allowed type "structuralObjectClass" bdb_dn2entry("cn=meeting,ou=groups,dc=example,dc=com") => bdb_dn2id("cn=meeting,ou=groups,dc=example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) dnMatch 0 "cn=bjorn jensen,ou=information technology division,ou=people,dc=example ,dc=com" "cn=bjorn jensen,ou=information technology division,ou=people,dc=example ,dc=com" bdb_add: no write access to attribute send_ldap_result: conn=21 op=1 p=3 send_ldap_result: err=50 matched="" text="no write access to attribute" send_ldap_response: msgid=2 tag=105 err=50 ber_flush2: 42 bytes to sd 13 conn=21 op=1 RESULT tag=105 err=50 text=no write access to attribute connection_get(13) -Dieter

1 0

Re: (ITS#5709) slapd sync provider skips some objects
by quanah＠zimbra.com 03 Oct '08

03 Oct '08

--On Tuesday, September 23, 2008 2:32 PM +0000 sylvain.thomas(a)gmail.com wrote: > I can provide a detailed log (loglevel -1) and any other information > required. The environment and the configuration files are the same as for > ITS 5661, but I do not use the mirror mode. > Thanks for your help Can you: (a) reproduce with the current RE24 source? (b) Can you provide your slapd.conf files? Thanks, Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: ITS#5707 [Fwd: Re: 4.7.25 deadlock]
by quanah＠zimbra.com 02 Oct '08

02 Oct '08

--On Friday, September 26, 2008 4:13 PM +0000 quanah(a)zimbra.com wrote: The patch to fix this issue is now in OpenLDAP cvs: <http://www.openldap.org/devel/cvsweb.cgi/build/db.4.7.25.patch?hideattic=1&…> --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5722) dn cache size exceeds the limits
by p_pavlos＠freemail.gr 02 Oct '08

02 Oct '08

Full_Name: Pavlos Parissis Version: 2.4.11 OS: Linux 2.6 RH AE 4.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (77.250.22.95) Hi, During performance testing with SLAMD we noticed the dncache exceeds the limit. As a result the system starts to swap a lot and the responses of slapd are very slow. Here are the facts: slapd.conf monitoring on tool-threads 4 cachesize 450000 dncachesize 450000 idlcachesize 450000 cachefree 90000 # ldapsearch -x -D "cn=xxxx" -w xx -b 'cn=database 2,cn=databases,cn=monitor' -s sub '(objectclass=*)' '*' '+' | grep -i Cache olmBDBEntryCache: 398306 olmBDBDNCache: 482001 <<========== olmBDBIDLCache: 449999 # slapd -V @(#) $OpenLDAP: slapd 2.4.11 (Sep 11 2008 10:58:58) $ root@node3:/usr/src/redhat/BUILD/openldap-2.4.11/servers/slapd #db_stat -V Berkeley DB 4.6.21: (September 27, 2007) # uname -r 2.6.9-67.ELsmp # cat /etc/redhat-release Red Hat Enterprise Linux AS release 4 (Nahant Update 6) Cheers, Pavlos

1 0

(ITS#5721) Expansion on dncachesize behavior
by quanah＠zimbra.com 02 Oct '08

02 Oct '08

Full_Name: Quanah Gibson-Mount Version: 24/HEAD OS: NA URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.29.239) The behavior of the dncachesize setting when it is not ideal (2x) is not documented. Howard notes: The DN cache is allowed to temporarily grow beyond the configured size. It does this if many entries are locked when it tries to do a purge, because that means they're legitimately in use. Also the dn cache never purges entries that have cached children, so depending on the shape of the DIT, it could have lots over the defined limit. This would be useful to note in the slapd-bdb & slapd-hdb man pages.

1 0

Re: ITS#5713
by ando＠sys-net.it 30 Sep '08

30 Sep '08

Gavin Henry wrote: > ----- ando(a)sys-net.it wrote: > >> Probably, the right fix consists in changing that attr's syntax to >> DirectoryString, and allow all syntaxes, from "--w-------" to passing >> >> the value to strtol(value, NULL, 0) etc. > > Shall we mention the new syntax support in that section of the guide? I'll the man page too. Well, probably yes. Thanks, p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: ITS#5713
by ghenry＠OpenLDAP.org 30 Sep '08

30 Sep '08

----- ando(a)sys-net.it wrote: > Probably, the right fix consists in changing that attr's syntax to > DirectoryString, and allow all syntaxes, from "--w-------" to passing > > the value to strtol(value, NULL, 0) etc. Shall we mention the new syntax support in that section of the guide? I'll the man page too. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by h.b.furuseth＠usit.uio.no 30 Sep '08

30 Sep '08

h.b.furuseth(a)usit.uio.no writes: > Replace ldap_utf8_strchr with ldap_utf8_strpbrk and it should work. ..and come to think of, it, the *s non-null test in the for loop should be unnecessary. -- Hallvard

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by hyc＠symas.com 30 Sep '08

30 Sep '08

h.b.furuseth(a)usit.uio.no wrote: > quanah(a)OpenLDAP.org writes: >> utf-8.c:char * (ldap_utf8_strchr)( const char *str, const char *chr ) >> >> I.e., string, character, as normal libc functions. >> >> However, at line 125 in charray.c, it is called as: >> if ( ldap_utf8_strchr( brkstr, s ) != NULL ) { >> This order appears to be incorrect. > No. That code counts the number of delimiters characters in the > string being split. Since brkstr can contain several characters, > the loop checks each "utf-8 character" in str against brkstr. The code was certainly broken, regardless. If the input string uses any UTF8 characters beyond 0x7f then the simple increment of "s++" would yield invalid characters for most of the iterations of the loop. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by h.b.furuseth＠usit.uio.no 30 Sep '08

30 Sep '08

Duh, perhaps I should have paid attention to the committed patch instead of your description of the problem... The patch breaks in a different way than I said. Replace ldap_utf8_strchr with ldap_utf8_strpbrk and it should work. I probably can't test it today. -- Hallvard

1 0

ITS#5695
by tamburo＠studenti.unina.it 30 Sep '08

30 Sep '08

This is the rights statement for my patch. This is the link http://www.studenti.unina.it/~tamburo/tesi/openldap/Luca-Tamburo-AC-08-09-1… to my patch with the following rights statement. This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Luca Tamburo at ICAR, Branch of Naples, Italy. Luca Tamburo has not assigned rights and/or interest in this work to any party. I, Luca Tamburo am authorized by Giovanni Schmid, project manager at ICAR, my employer, to release this work under the following terms. Copyright 2008 Luca Tamburo tamburo(a)studenti.unina.it Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License. Regards, Luca ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by quanah＠zimbra.com 30 Sep '08

30 Sep '08

--On September 30, 2008 6:20:58 PM +0000 h.b.furuseth(a)usit.uio.no wrote: > quanah(a)zimbra.com writes: >> Yes. The calling order was incorrect. It is supposed to be >> ldap_utf8_strchr(s, brkstr). > > No. Try this with the new code: > env LDAPHOST='host1 host2' valgrind clients/tools/ldapwhoami -x > It returns writes past malloced areas in ldap_str2charray(). > > options.c calls ldap_charray("host1 host2", ", ") to parse that. > It counted the number of commas and spaces in the host string. > With the new code, it instead sums up: > > number of commas in "host1 host2" > + number of commas in "ost1 host2" > + number of commas in "st1 host2" > > etc and you never count spaces. So, the solution is to revert the order of the call, but leave the loop the way it is now? --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: ITS#5707 [Fwd: Re: 4.7.25 deadlock]
by quanah＠zimbra.com 30 Sep '08

30 Sep '08

--On September 30, 2008 6:13:05 PM +0000 quanah(a)zimbra.com wrote: > I think their patch is broken. I rebuilt BDB 4.7 with it, and now > test008 fails on me: Never mind, test008 fails without the patch to BDB 4.7 as well, so it's not related. test008 simply no longer works for me with current RE24. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by h.b.furuseth＠usit.uio.no 30 Sep '08

30 Sep '08

quanah(a)zimbra.com writes: > Yes. The calling order was incorrect. It is supposed to be > ldap_utf8_strchr(s, brkstr). No. Try this with the new code: env LDAPHOST='host1 host2' valgrind clients/tools/ldapwhoami -x It returns writes past malloced areas in ldap_str2charray(). options.c calls ldap_charray("host1 host2", ", ") to parse that. It counted the number of commas and spaces in the host string. With the new code, it instead sums up: number of commas in "host1 host2" + number of commas in "ost1 host2" + number of commas in "st1 host2" etc and you never count spaces. > Also the outside loop was incorrect. True. -- Hallvard

1 0

Re: ITS#5707 [Fwd: Re: 4.7.25 deadlock]
by quanah＠zimbra.com 30 Sep '08

30 Sep '08

I think their patch is broken. I rebuilt BDB 4.7 with it, and now test008 fails on me: bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") => bdb_dn2id("cn=james a jones 4,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_LOCK_NOTGRANTED: Lock not granted (-30993) bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") => bdb_dn2id("cn=james a jones 4,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_LOCK_NOTGRANTED: Lock not granted (-30993) bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") => bdb_dn2id("cn=james a jones 4,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_LOCK_NOTGRANTED: Lock not granted (-30993) bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") => bdb_dn2id("cn=james a jones 4,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_LOCK_NOTGRANTED: Lock not granted (-30993) bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") => bdb_dn2id("cn=james a jones 4,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_LOCK_NOTGRANTED: Lock not granted (-30993) bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") => bdb_dn2id("cn=james a jones 4,ou=people,dc=example,dc=com") --Quanah > --On September 26, 2008 6:27:45 AM +0000 hyc(a)symas.com wrote: > >> So I guess we have to warn people about this one ourselves for a while. >> >> -------- Original Message -------- >> Subject: Re: 4.7.25 deadlock >> Date: Thu, 25 Sep 2008 23:15:31 -0700 >> From: Michael Ubell <@oracle.com> >> To: Howard Chu <hyc(a)symas.com> >> >> Howard, >> >> Generally we only post critical patches (data corruption, etc) to the >> web site. Since this one only effects those using user defined locks >> and does no damage, I don't think it will be posted. >> >> Mike >> >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ >> >> > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by quanah＠zimbra.com 30 Sep '08

30 Sep '08

--On September 30, 2008 11:18:04 AM +0000 h.b.furuseth(a)usit.uio.no wrote: > quanah(a)OpenLDAP.org writes: >> utf-8.c:char * (ldap_utf8_strchr)( const char *str, const char *chr ) >> >> I.e., string, character, as normal libc functions. >> >> However, at line 125 in charray.c, it is called as: >> if ( ldap_utf8_strchr( brkstr, s ) != NULL ) { >> This order appears to be incorrect. > > No. That code counts the number of delimiters characters in the > string being split. Since brkstr can contain several characters, > the loop checks each "utf-8 character" in str against brkstr. Yes. The calling order was incorrect. It is supposed to be ldap_utf8_strchr(s, brkstr). Also the outside loop was incorrect. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by h.b.furuseth＠usit.uio.no 30 Sep '08

30 Sep '08

quanah(a)OpenLDAP.org writes: > utf-8.c:char * (ldap_utf8_strchr)( const char *str, const char *chr ) > > I.e., string, character, as normal libc functions. > > However, at line 125 in charray.c, it is called as: > if ( ldap_utf8_strchr( brkstr, s ) != NULL ) { > This order appears to be incorrect. No. That code counts the number of delimiters characters in the string being split. Since brkstr can contain several characters, the loop checks each "utf-8 character" in str against brkstr. -- Hallvard

1 0

Re: (ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by quanah＠OpenLDAP.org 30 Sep '08

30 Sep '08

Err, line 195. --Quanah --On September 30, 2008 2:52:30 AM +0000 quanah(a)OpenLDAP.org wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3, 2.4, HEAD > OS: NA > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (98.207.132.222) > > > The definition for ldap_utf8_strchr is: > > utf-8.c:char * (ldap_utf8_strchr)( const char *str, const char *chr ) > > I.e., string, character, as normal libc functions. > > However, at line 125 in charray.c, it is called as: > > if ( ldap_utf8_strchr( brkstr, s ) != NULL ) { > > This order appears to be incorrect. > > --Quanah > >

1 0

(ITS#5720) ldap_str2charray calls ldap_utf8_strchr incorrectly
by quanah＠OpenLDAP.org 30 Sep '08

30 Sep '08

Full_Name: Quanah Gibson-Mount Version: 2.3, 2.4, HEAD OS: NA URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (98.207.132.222) The definition for ldap_utf8_strchr is: utf-8.c:char * (ldap_utf8_strchr)( const char *str, const char *chr ) I.e., string, character, as normal libc functions. However, at line 125 in charray.c, it is called as: if ( ldap_utf8_strchr( brkstr, s ) != NULL ) { This order appears to be incorrect. --Quanah

1 0

Re: ITS#5717
by ando＠sys-net.it 29 Sep '08

29 Sep '08

Fixed in HEAD; test044 updated as well. Please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Bug- Enforcing validation when validator is NULL
by Prashant kulkarni 29 Sep '08

29 Sep '08

Hi When I am trying to add/edit the value to the attribute "protocol information" which is required in our schema I am getting the error Invalid syntax :protocol information: no validator for syntax 1.3.6.1.4.1.1466.115.121.1.42 from the earlier mailing list I have found The problem seems to be lack of validations in the schema_init.c source code for attribure 'Protocol Information' this attribute protocolInformation is defined in core.schema {"( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )", 0, NULL, NULL, NULL}, including values like dnPretty ,UTF8StringValidate..etc in the code instead of NULL values will resolve my problem, but then that require the custom build and I have to do for all the attributes where validation is defined as NULL. I personally feel that for those attributes where validation are NULL in schema_init.c and other schema files, the openLDAP should not force the validation and give this error message, as all these attributes in which validation are not defined becomes unusable . In Tivoli/Sun and Microsoft Active directory LDAP validation is not enforced where validation is defined as NULL hence I am not getting these kind of error in Tivoli/Sun and Microsoft Active directory for editing of this attribute . So any idea how to resolve this ? there is any way to modify any of the config file in openldap to disable this validation for protocol information ? do I have to raise bug request for the same and is this going to be fixed in next openLDAP release. ? Any help and suggestions in this direction is highly appreciated. thanks and regards Prashant

3 2

Re: (ITS#5715) segfault in libdb
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: > >> I'm experiencing seg faults when using SASL/EXTERNAL bind when >> connected over >> ldapi://. I will try to examine this further. >> >> segfault at 0 ip b7f21d4c sp b370fd10 error 6 in >> libdb-4.6.so[b7ef9000+14f000] > > This bug is typical of loading a libsasl2 module (libsasldb) built with > a Berkeley DB version different from the one slapd was built with, or > loading a libsasl2 module built with a different version of libsasl2 > than the one slapd was built with. Can you check? Now I've rebuilt with the pre-installed BDB 4.5 (openSUSE 11.0) packages and it works. Hmm... Ciao, Michael.

1 0

(ITS#5719) Reset syncrepl interval after resceduling paused task
by rein＠OpenLDAP.org 29 Sep '08

29 Sep '08

Full_Name: Rein Tollevik Version: RE_24 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.93.160.250) Submitted by: rein When a syncrepl task is paused after the thread pool is pauses (due to dynamic configuration updates) it is rescheduled to run immediately. But the interval is not put back again, which causes the slapd_daemon_task() to exercise the CPU rescheduling the syncrepl task until the next clock second ticks off. I'll commit a fix shortly. Rein Tollevik Basefarm AS

1 0

(ITS#5718) [documentation] Mention dontusecopy control in conjunction with slapo-chain(5)
by ando＠sys-net.it 29 Sep '08

29 Sep '08

Full_Name: Pierangelo Masarati Version: irrelevant OS: irrelevant URL: ftp://ftp.openldap.org/incoming/dontusecopy-chain-2008-09-29-pierangelo-mas… Submission from: (NULL) (81.72.89.40) Submitted by: ando I'm not too familiar with sdl; moreover, I'm not sure whether this is the right place to mention the dontusecopy control first. In any case, it seems worth mentioning here this good practice for clients that might write to shadow DSAs and immediately read back. See patch at URL. Cheers, p.

1 0

Re: (ITS#5715) segfault in libdb
by ando＠sys-net.it 29 Sep '08

29 Sep '08

michael(a)stroeder.com wrote: > I will check this right now. Anyway find below the tail of the server's > log when invoking > > ldapwhoami -H > ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1 -Y > EXTERNAL OK, at a first glance, I see two things: 1) your search finds nothing, probably because anonymous cannot read the "entry" pseudo-attribute of "ou=schulung,dc=stroeder,dc=local" (see [1]) 2) this causes a sigsegv, which Is Bad (TM). You should check whether the result of those ACLs is correct, and in the meanwhile provide a core dump, to fix the sigsegv issue. p. > --------------------------------- snip -------------------------------- > ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 > SASL Canonicalize [conn=0]: > authcid="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" > slap_sasl_getdn: conn 0 > id=gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth [len=59] > ==>slap_sasl2dn: converting SASL name > gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth to a DN > ==> rewrite_context_apply [depth=1] > string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' > ==> rewrite_rule_apply > rule='gidnumber=([0-9]+)\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth' > string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' [1 > pass(es)] > ==> rewrite_context_apply [depth=1] > res={0,'ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))'} > [rw] authid: > "gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" -> > "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" > slap_parseURI: parsing > ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)) > ldap_url_parse_ext(ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))) > put_filter: "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" > put_filter: AND > put_filter_list "(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)" > put_filter: "(objectClass=posixAccount)" > put_filter: simple > put_simple_filter: "objectClass=posixAccount" > put_filter: "(uidNumber=500)" > put_filter: simple > put_simple_filter: "uidNumber=500" > put_filter: "(gidNumber=100)" > put_filter: simple > put_simple_filter: "gidNumber=100" > ber_scanf fmt ({mm}) ber: > ber_scanf fmt ({mm}) ber: > ber_scanf fmt ({mm}) ber: >>>> dnNormalize: <ou=schulung,dc=stroeder,dc=local> > => ldap_bv2dn(ou=schulung,dc=stroeder,dc=local,0) > <= ldap_bv2dn(ou=schulung,dc=stroeder,dc=local)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(ou=schulung,dc=stroeder,dc=local)=0 > <<< dnNormalize: <ou=schulung,dc=stroeder,dc=local> > slap_sasl2dn: performing internal search > (base=ou=schulung,dc=stroeder,dc=local, scope=2) > => hdb_search > bdb_dn2entry("ou=schulung,dc=stroeder,dc=local") > => access_allowed: auth access to "ou=schulung,dc=stroeder,dc=local" > "entry" requested > => dn: [4] ou=users,ou=schulung,dc=stroeder,dc=local > => dn: [5] ou=groups,ou=schulung,dc=stroeder,dc=local > => dn: [6] ou=schulung,dc=stroeder,dc=local > => acl_get: [6] matched > => acl_get: [6] attr entry > => acl_mask: access to entry "ou=schulung,dc=stroeder,dc=local", attr > "entry" requested > => acl_mask: to all values by "", (=0) > <= check a_dn_pat: * > <= acl_mask: [2] applying none(=0) (stop) > <= acl_mask: [2] mask: none(=0) > => slap_access_allowed: auth access denied by none(=0) [1] > => access_allowed: no more rules > send_ldap_result: conn=0 op=0 p=3 > send_ldap_result: err=32 matched="" text="" > <==slap_sasl2dn: Converted SASL name to <nothing> > SASL Canonicalize [conn=0]: > slapAuthcDN="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" > ./start-slapd1.sh: line 14: 20820 Segmentation fault > ${OPENLDAP_PREFIX}/libexec/slapd -d stats,acl,args,trace,sync -h > "ldap://0.0.0.0:2071 > ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1" -n > slapd-schulung-1 -u michael -f ${LOCALCONFIG}/slapd-1.conf -F > ${LOCALCONFIG}/slapd-1.conf.d > michael@nb2:~/temp/openldap-testbed-RE24> > > Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5715) segfault in libdb
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: >> I'm experiencing seg faults when using SASL/EXTERNAL bind when >> connected over >> ldapi://. I will try to examine this further. >> >> segfault at 0 ip b7f21d4c sp b370fd10 error 6 in >> libdb-4.6.so[b7ef9000+14f000] > > This bug is typical of loading a libsasl2 module (libsasldb) built with > a Berkeley DB version different from the one slapd was built with, or > loading a libsasl2 module built with a different version of libsasl2 > than the one slapd was built with. Can you check? I will check this right now. Anyway find below the tail of the server's log when invoking ldapwhoami -H ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1 -Y EXTERNAL Ciao, Michael. --------------------------------- snip -------------------------------- ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 SASL Canonicalize [conn=0]: authcid="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" slap_sasl_getdn: conn 0 id=gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth [len=59] ==>slap_sasl2dn: converting SASL name gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth to a DN ==> rewrite_context_apply [depth=1] string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' ==> rewrite_rule_apply rule='gidnumber=([0-9]+)\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth' string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))'} [rw] authid: "gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" -> "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" slap_parseURI: parsing ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)) ldap_url_parse_ext(ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))) put_filter: "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" put_filter: AND put_filter_list "(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)" put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" put_filter: "(uidNumber=500)" put_filter: simple put_simple_filter: "uidNumber=500" put_filter: "(gidNumber=100)" put_filter: simple put_simple_filter: "gidNumber=100" ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: >>> dnNormalize: <ou=schulung,dc=stroeder,dc=local> => ldap_bv2dn(ou=schulung,dc=stroeder,dc=local,0) <= ldap_bv2dn(ou=schulung,dc=stroeder,dc=local)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=schulung,dc=stroeder,dc=local)=0 <<< dnNormalize: <ou=schulung,dc=stroeder,dc=local> slap_sasl2dn: performing internal search (base=ou=schulung,dc=stroeder,dc=local, scope=2) => hdb_search bdb_dn2entry("ou=schulung,dc=stroeder,dc=local") => access_allowed: auth access to "ou=schulung,dc=stroeder,dc=local" "entry" requested => dn: [4] ou=users,ou=schulung,dc=stroeder,dc=local => dn: [5] ou=groups,ou=schulung,dc=stroeder,dc=local => dn: [6] ou=schulung,dc=stroeder,dc=local => acl_get: [6] matched => acl_get: [6] attr entry => acl_mask: access to entry "ou=schulung,dc=stroeder,dc=local", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [2] applying none(=0) (stop) <= acl_mask: [2] mask: none(=0) => slap_access_allowed: auth access denied by none(=0) => access_allowed: no more rules send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=32 matched="" text="" <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=0]: slapAuthcDN="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" ./start-slapd1.sh: line 14: 20820 Segmentation fault ${OPENLDAP_PREFIX}/libexec/slapd -d stats,acl,args,trace,sync -h "ldap://0.0.0.0:2071 ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1" -n slapd-schulung-1 -u michael -f ${LOCALCONFIG}/slapd-1.conf -F ${LOCALCONFIG}/slapd-1.conf.d michael@nb2:~/temp/openldap-testbed-RE24>

1 0

Re: (ITS#5715) segfault in libdb
by ando＠sys-net.it 29 Sep '08

29 Sep '08

michael(a)stroeder.com wrote: > I'm experiencing seg faults when using SASL/EXTERNAL bind when connected over > ldapi://. I will try to examine this further. > > segfault at 0 ip b7f21d4c sp b370fd10 error 6 in libdb-4.6.so[b7ef9000+14f000] This bug is typical of loading a libsasl2 module (libsasldb) built with a Berkeley DB version different from the one slapd was built with, or loading a libsasl2 module built with a different version of libsasl2 than the one slapd was built with. Can you check? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5716) test046-dds failed (exit 127): invalid ELF header
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Hallvard B Furuseth wrote: > michael(a)stroeder.com writes: >> error while loading shared libraries: >> /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/libraries/libldap_r/.libs/libldap_r-2.4-releng.so.2: >> invalid ELF header > > Hopefully a PEBKAC. Loading libraries built for another architecture, > or something like that. I re-ran all the tests and it worked. Maybe it was caused by invoking 'make install' as root while still running 'make test' as normal user. Ciao, Michael.

1 0

wrong ITS (ITS#5715)
by manu＠netbsd.org 29 Sep '08

29 Sep '08

Please disregard my previous mail, I appended to the wrong ITS. -- Emmanuel Dreyfus manu(a)netbsd.org

1 0

fix (ITS#5717)
by manu＠netbsd.org 29 Sep '08

29 Sep '08

--E13BgyNx05feLLmH Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Attached is a fix for the problem: 1) if the member attribute is not part of the requested attribute set, but the mapped attributeis, then we still need to generate the dynlist 2) in this cas, we must add the member attribute to the searched attributes. -- Emmanuel Dreyfus manu(a)netbsd.org --E13BgyNx05feLLmH Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="dynlist.patch" --- servers/slapd/overlays/dynlist.c.orig 2008-07-10 02:43:03.000000000 +0200 +++ servers/slapd/overlays/dynlist.c 2008-09-29 17:43:07.000000000 +0200 @@ -369,9 +369,12 @@ /* Don't generate member list if it wasn't requested */ for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) { if ( userattrs || - ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + break; + if ( dlm->dlm_mapped_ad && + ad_inlist( dlm->dlm_mapped_ad, rs->sr_attrs ) ) break; } if ( dli->dli_dlm && !dlm ) return SLAP_CB_CONTINUE; @@ -477,8 +480,11 @@ } else { for ( i = 0; lud->lud_attrs[i]; i++) /* just count */ ; + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + i++; + o.ors_attrs = op->o_tmpcalloc( i + 1, sizeof( AttributeName ), op->o_tmpmemctx ); for ( i = 0, j = 0; lud->lud_attrs[i]; i++) { const char *text = NULL; @@ -515,8 +521,14 @@ j++; } + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) { + o.ors_attrs[j].an_name = dlm->dlm_member_ad->ad_cname; + o.ors_attrs[j].an_desc = dlm->dlm_member_ad; + j++; + } + if ( j == 0 ) { goto cleanup; } --E13BgyNx05feLLmH--

1 0

fix (ITS#5715)
by manu＠netbsd.org 29 Sep '08

29 Sep '08

--3V7upXqbjpZ4EhLz Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Attached is a fix for the problem: 1) if the member attribute is not part of the requested attribute set, but the mapped attributeis, then we still need to generate the dynlist 2) in this cas, we must add the member attribute to the searched attributes. -- Emmanuel Dreyfus manu(a)netbsd.org --3V7upXqbjpZ4EhLz Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="dynlist.patch" --- servers/slapd/overlays/dynlist.c.orig 2008-07-10 02:43:03.000000000 +0200 +++ servers/slapd/overlays/dynlist.c 2008-09-29 17:43:07.000000000 +0200 @@ -369,9 +369,12 @@ /* Don't generate member list if it wasn't requested */ for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) { if ( userattrs || - ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + break; + if ( dlm->dlm_mapped_ad && + ad_inlist( dlm->dlm_mapped_ad, rs->sr_attrs ) ) break; } if ( dli->dli_dlm && !dlm ) return SLAP_CB_CONTINUE; @@ -477,8 +480,11 @@ } else { for ( i = 0; lud->lud_attrs[i]; i++) /* just count */ ; + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + i++; + o.ors_attrs = op->o_tmpcalloc( i + 1, sizeof( AttributeName ), op->o_tmpmemctx ); for ( i = 0, j = 0; lud->lud_attrs[i]; i++) { const char *text = NULL; @@ -515,8 +521,14 @@ j++; } + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) { + o.ors_attrs[j].an_name = dlm->dlm_member_ad->ad_cname; + o.ors_attrs[j].an_desc = dlm->dlm_member_ad; + j++; + } + if ( j == 0 ) { goto cleanup; } --3V7upXqbjpZ4EhLz--

1 0

ITS#5717
by ando＠sys-net.it 29 Sep '08

29 Sep '08

Emmanuel, I have a fix, should I go and commit it? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5717) slapo-dynlist expantion failed for mapped attributes
by menu＠netbsd.org 29 Sep '08

29 Sep '08

Full_Name: Emmanuel Dreyfus Version: OpenLDAP-2.4.11 OS: NetBSD-4.0 URL: Submission from: (NULL) (193.54.82.42) If slapo-dynlist is configured with attribute mapping, dynlist expantion will only work if the member attribute in included in the searched attriute set. Here is an example: Config: overlay dynlist dynlist-attrset ExMailAddress memberURL mailbox:revalias Searched entry: dn: mailAddress=foo-employee(a)example.net,o=ex objectClass: exMailAddress mailAddress: foo-employee(a)example.net memberURL: ldap:///o=ex,revalias?sub?(&(objectClass=exPerson)(employer=foo)) Expantion looks up objects like this: dn: uid=jdoe,o=ex objectClass: exPerson uid: jdoe revalias: john.doe(a)example.net employer: foo With the member attribute in the searched attribute set: $ ldapsearch mailAddress=foo-employee@example mailbox revalias dn: mailAddress=foo-employee(a)example.net,o=ex mailbox: john.doe(a)example.net mailbox: joe.luser(a)example.net mailbox: emmanuel.dreyfus(a)example.net Without it: $ ldapsearch mailAddress=foo-employee@example mailbox dn: mailAddress=foo-employee(a)example.net,o=ex Note that if no attribute set is provided, it works: $ ldapsearch mailAddress=foo-employee@example dn: mailAddress=foo-employee(a)example.net,o=ex objectClass: exMailAddress mailAddress: foo-employee(a)example.net mailbox: john.doe(a)example.net mailbox: joe.luser(a)example.net mailbox: emmanuel.dreyfus(a)example.net memberURL: ldap:///o=ex,revalias?sub?(&(objectClass=exPerson)(employer=foo)) I should provide a fix for that soon.

1 0

Re: (ITS#5716) test046-dds failed (exit 127): invalid ELF header
by h.b.furuseth＠usit.uio.no 29 Sep '08

29 Sep '08

michael(a)stroeder.com writes: > error while loading shared libraries: > /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/libraries/libldap_r/.libs/libldap_r-2.4-releng.so.2: > invalid ELF header Hopefully a PEBKAC. Loading libraries built for another architecture, or something like that. -- Hallvard

1 0

(ITS#5716) test046-dds failed (exit 127): invalid ELF header
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Full_Name: Michael Ströder Version: RE24 OS: openSUSE Linux 11.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.103.245) I will examine why this fails. >>>>> Starting test046-dds ... running defines.sh Running slapadd to build slapd database... /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers/slapd/.libs/lt-slapd: error while loading shared libraries: /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/libraries/libldap_r/.libs/libldap_r-2.4-releng.so.2: invalid ELF header slapadd failed (127)! >>>>> ./scripts/test046-dds failed (exit 127) make[2]: *** [bdb-yes] Error 127 make[2]: Leaving directory `/home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests' make: *** [test] Error 2

1 0

(ITS#5715) segfault in libdb
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Full_Name: Michael Ströder Version: RE24 OS: openSUSE Linux 11.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.103.245) HI! I'm experiencing seg faults when using SASL/EXTERNAL bind when connected over ldapi://. I will try to examine this further. segfault at 0 ip b7f21d4c sp b370fd10 error 6 in libdb-4.6.so[b7ef9000+14f000] Ciao, Michael.

1 0

Re: (ITS#5709) slapd sync provider skips some objects
by sylvain.thomas＠gmail.com 29 Sep '08

29 Sep '08

This is not a patch suggestion but may be it helps to better see the problem's origin : I applied the following patch to syncprov.c and I got good results. The concerned objects are sent with a NULL cookie but they are replicated well. The contextCSN is made up by the subsequent objects. Thanks and best regards Sylvain Thomas. ============================================ --- syncprov.c.orig 2008-09-29 11:08:36.000000000 +0200 +++ syncprov.c 2008-09-29 11:10:33.000000000 +0200 @@ -1642,8 +1642,6 @@ } } else { /* internal ops that aren't meant to be replicated */ - ldap_pvt_thread_rdwr_wunlock( &si->si_csn_rwlock ); - return SLAP_CB_CONTINUE; } /* Don't do any processing for consumer contextCSN updates */

1 0

(ITS#5714) [feature request] operational attrs defined via configuration
by ando＠sys-net.it 27 Sep '08

27 Sep '08

Full_Name: Pierangelo Masarati Version: HEAD OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (151.30.78.88) Currently, the attributeType statement does not allow to define operational attributes. The rationale was that operational attributes are somehow application-maintained, so configuration-defined attrs would be essentially unmaintainable. At the same time, modules that are able to maintain operational attributes can register them bypassing some of the checks attributes defined via configuration must pass. However, the availability of the "relax" control could make this restriction too strict. In fact, there are works in progress (e.g. draft-wahl-ldap-adminaddr) that define operational attrs which could easily be defined via configuration and maintained via the relax control. This is a feature request to suggest the possibility to define operational attrs via configuration. p.

1 0

Re: (ITS#5712) Could not set the connection timeout
by ando＠sys-net.it 27 Sep '08

27 Sep '08

essiambl(a)gmail.com wrote: > Full_Name: Luc-André Essiambre > Version: 2.4.11 > OS: Solaris 10 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (216.95.235.3) > > > I'm using openldap to authenticate users for our subversion repositories hosted > on apache httpd. Immediately after a server startup, I get these strange errors > saying "LDAP: Could not set the connection timeout" This message does not come from anything distributed with OpenLDAP software, so it does not help isolate your issue. > when I try to authenticate > myself. The weird thing is, after a couple of attempts at accessing the > subversion content (5 or 6 times), I'm eventually authenticated without error. > Then it will work for a while, then those same errors will come back. You don't specify in what sense you're using OpenLDAP: do you use the client libraries as part of a third-party clien to do a bind to a third-party server, or do you use OpenLDAP as the LDAP server, or both? If you use the client libraries with a third-party client, did you build it with -DLDAP_DEPRECATED=1 ? This is required to expose deprecated API to clients that make use of them. > openldap was compiled using the gcc compiler included in solaris (version 3.4.3) > without slapd, with cyrus-sasl-2.1.21. Solaris runs as a virtual server on sparc > hardware. In any case, I don't see (yet) an OpenLDAP bug, so you should direct further communications to openldap-technical(a)openldap.org, since your problem mainly addresses interoperation with other software. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

ITS#5713
by ando＠sys-net.it 27 Sep '08

27 Sep '08

Probably, the right fix consists in changing that attr's syntax to DirectoryString, and allow all syntaxes, from "--w-------" to passing the value to strtol(value, NULL, 0) etc. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5711) Password Modify Exop don't return ppolicy control in case of error
by ando＠sys-net.it 27 Sep '08

27 Sep '08

Guillaume.Rousse(a)inria.fr wrote: > When Password Modify ExOp fails, due to ppolicy restrictions, it doesn't return > any ppolicy control. Fixed in HEAD, please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs