- openldap-bugs - openldap.org

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by ghenry＠suretecsystems.com 01 Feb '08

01 Feb '08

<quote who="Pierangelo Masarati"> > Gavin Henry wrote: >> <quote who="ando(a)sys-net.it"> >>> hachi(a)kuiki.net wrote: >>>> Tested against both HEAD and OPENLDAP_REL_ENG_2_4, same error: >>>> >>>> slapadd: schema_init.c:3669: csnNormalize: Assertion `val->bv_len == >>>> (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. >>> That assert() was added to trap incorrect values, since they should >>> never happen run-time. Of course, this is not the case when >>> slapadd'ing, since bulk loading can (and must be able to) include >>> operational attrs like entryCSN. In any case, the value you're trying >>> to slapadd, "2003061105:33:44Z#0x0003#0#0000", is invalid, and >>> (probably, AFAIK) has never been in use with OpenLDAP software. When >>> bulk-adding data, you should make sure it is reasonably acceptable. >>> >> >> But isn't this a slapcat from 2.3.38? > > But that CSN was not CREATED by 2.3.38, only merely stored by it > (probably via slapadd). Ah, yes.

1 0

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by h.b.furuseth＠usit.uio.no 01 Feb '08

01 Feb '08

Pierangelo Masarati writes: > Well, AFAIR, normalize should be called AFTER validate; and validate > should reject that CSN. The assert() was to make sure that, during > development, normalize was not called with invalid data. I'm looking at > that. Sounds like we need a macro a la #ifdef LDAP_DEVEL /* for tested non-release versions */ #define ASSERT_DEVEL assert #else #define ASSERT_DEVEL(expr) ((void)0) #endif -- Hallvard

1 0

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by ando＠sys-net.it 01 Feb '08

01 Feb '08

Gavin Henry wrote: > <quote who="ando(a)sys-net.it"> >> hachi(a)kuiki.net wrote: >>> Tested against both HEAD and OPENLDAP_REL_ENG_2_4, same error: >>> >>> slapadd: schema_init.c:3669: csnNormalize: Assertion `val->bv_len == >>> (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. >> That assert() was added to trap incorrect values, since they should >> never happen run-time. Of course, this is not the case when >> slapadd'ing, since bulk loading can (and must be able to) include >> operational attrs like entryCSN. In any case, the value you're trying >> to slapadd, "2003061105:33:44Z#0x0003#0#0000", is invalid, and >> (probably, AFAIK) has never been in use with OpenLDAP software. When >> bulk-adding data, you should make sure it is reasonably acceptable. >> > > But isn't this a slapcat from 2.3.38? But that CSN was not CREATED by 2.3.38, only merely stored by it (probably via slapadd). p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by ando＠sys-net.it 01 Feb '08

01 Feb '08

h.b.furuseth(a)usit.uio.no wrote: > ando(a)sys-net.it writes: >>> slapadd: schema_init.c:3669: csnNormalize: Assertion `val->bv_len == >>> (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. >> That assert() was added to trap incorrect values, since they should >> never happen run-time. > > Bad idea. slapd crashes if you search for "(entryCSN=the csn below)". Well, AFAIR, normalize should be called AFTER validate; and validate should reject that CSN. The assert() was to make sure that, during development, normalize was not called with invalid data. I'm looking at that. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by h.b.furuseth＠usit.uio.no 01 Feb '08

01 Feb '08

ando(a)sys-net.it writes: >> slapadd: schema_init.c:3669: csnNormalize: Assertion `val->bv_len == >> (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. > > That assert() was added to trap incorrect values, since they should > never happen run-time. Bad idea. slapd crashes if you search for "(entryCSN=the csn below)". > Of course, this is not the case when > slapadd'ing, since bulk loading can (and must be able to) include > operational attrs like entryCSN. In any case, the value you're trying > to slapadd, "2003061105:33:44Z#0x0003#0#0000", is invalid, and -- Hallvard

1 0

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by ghenry＠OpenLDAP.org 01 Feb '08

01 Feb '08

<quote who="ando(a)sys-net.it"> > hachi(a)kuiki.net wrote: >> Tested against both HEAD and OPENLDAP_REL_ENG_2_4, same error: >> >> slapadd: schema_init.c:3669: csnNormalize: Assertion `val->bv_len == >> (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. > > That assert() was added to trap incorrect values, since they should > never happen run-time. Of course, this is not the case when > slapadd'ing, since bulk loading can (and must be able to) include > operational attrs like entryCSN. In any case, the value you're trying > to slapadd, "2003061105:33:44Z#0x0003#0#0000", is invalid, and > (probably, AFAIK) has never been in use with OpenLDAP software. When > bulk-adding data, you should make sure it is reasonably acceptable. > But isn't this a slapcat from 2.3.38?

1 0

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by ando＠sys-net.it 01 Feb '08

01 Feb '08

hachi(a)kuiki.net wrote: > Tested against both HEAD and OPENLDAP_REL_ENG_2_4, same error: > > slapadd: schema_init.c:3669: csnNormalize: Assertion `val->bv_len == > (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. That assert() was added to trap incorrect values, since they should never happen run-time. Of course, this is not the case when slapadd'ing, since bulk loading can (and must be able to) include operational attrs like entryCSN. In any case, the value you're trying to slapadd, "2003061105:33:44Z#0x0003#0#0000", is invalid, and (probably, AFAIK) has never been in use with OpenLDAP software. When bulk-adding data, you should make sure it is reasonably acceptable. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5346) overlay and config backend
by h.b.furuseth＠usit.uio.no 01 Feb '08

01 Feb '08

Well, it's not your overlay's fault. The same happens with overlay unique: It works, but does not show up in ldapsearch. Nor in the config directory written with slapd -f ... -F ... $cat slapd.conf include servers/slapd/schema/core.schema database config rootdn cn=config rootpw secret overlay unique unique_uri ldap:///?olcAccess?sub access to * by * read $ ldapmodify -xHldap://:3890 -D cn=config -w secret dn: olcDatabase={-1}frontend,cn=config changetype: modify add: olcAccess olcAccess: to * by * read - modifying entry "olcDatabase={-1}frontend,cn=config" ldap_modify: Constraint violation (19) additional info: some attributes not unique On the other hand, this is strange: > cn=config > - cn= schema > - cn={0}core > - olcDatabase={-1}frontend > - olcDatabase={0}config > - olcDatabase={-1}ndb_pl > + olcoverlay={0}ndbover Two different databases should not have the same number. ndb_pl should get {1}. Possibly your backend or overlay messes up something in that regard. -- Hallvard

1 0

(ITS#5350) Request: ITS links in mailinglist archives
by h.b.furuseth＠usit.uio.no 01 Feb '08

01 Feb '08

Full_Name: Hallvard B Furuseth Version: OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard Could the mailinglist->web archiver put <a href="/its/?findid=(number)"></a> around "ITS#(number)" in the messages? Links for RFCs would be useful too.

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by h.b.furuseth＠usit.uio.no 01 Feb '08

01 Feb '08

Aaron Richton writes: > In the meantime, thanks for the db_dump idea; I can now show that the bad > commits are definitely (a) 2.3.40 and (b) increasing. Can db->set_flags(db, DB_CHKSUM) help narrow it down? It's not a database environment flag, for some reason. http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/db_set_… Not relevant for this ITS, but if it's made a slapd.conf option instead of just a hack for this occasion it would likely be useful to offer a way to say "turn it on if DB page size differs from filesystem block size", since that's one case when Berkeley DB can't guarantee that data remains correct: http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/… -- Hallvard

1 0

Re: (ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by hachi＠kuiki.net 01 Feb '08

01 Feb '08

Tested against both HEAD and OPENLDAP_REL_ENG_2_4, same error: slapadd: schema_init.c:3669: csnNormalize: Assertion `val->bv_len == (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. Aborted

1 0

(ITS#5348) slapcat on 2.3.38 to slapadd on 2.4.7 causes abort.
by hachi＠kuiki.net 01 Feb '08

01 Feb '08

Full_Name: Jonathan Steinert Version: 2.4.7 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2002:4c0e:3610:b00b:213:ceff:fe56:4659) slapadd: /build/buildd/openldap2.3-2.4.7/servers/slapd/schema_init.c:3669: csnNormalize: Assertion `val->bv_len == (sizeof("YYYYmmddHHMMSS.uuuuuuZ#SSSSSS#SID#ssssss")-1)' failed. Aborted an example of ldif that causes this case is: dn: dc=kuiki,dc=net objectClass: dcObject objectClass: organization dc: kuiki o: kuiki.net structuralObjectClass: organization entryUUID: 03182abc-301a-1027-968b-e97431722845 creatorsName: cn=anonymous createTimestamp: 20030611053344Z entryCSN: 20060925002534Z#000000#00#000000 modifiersName: cn=admin,dc=kuiki,dc=net modifyTimestamp: 20060925002534Z contextCSN: 20071231014551Z#000000#00#000000 dn: ou=People,dc=kuiki,dc=net objectClass: organizationalUnit ou: People structuralObjectClass: organizationalUnit entryUUID: 031994e2-301a-1027-968d-e97431722845 creatorsName: cn=anonymous modifiersName: cn=anonymous createTimestamp: 20030611053344Z modifyTimestamp: 20030611053344Z entryCSN: 2003061105:33:44Z#0x0003#0#0000 dn: ou=Groups,dc=kuiki,dc=net objectClass: organizationalUnit ou: Groups structuralObjectClass: organizationalUnit entryUUID: a783ec90-5521-1027-8709-a9468010d3e8 creatorsName: cn=admin,dc=kuiki,dc=net createTimestamp: 20030728083139Z entryCSN: 2003072808:31:39Z#0x0001#0#0000 modifiersName: cn=admin,dc=kuiki,dc=net modifyTimestamp: 20030728083139Z

1 0

(ITS#5346) overlay and config backend
by jorge.nevado＠ericsson.com 01 Feb '08

01 Feb '08

Full_Name: Jorge Nevado Version: 2.4.7 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.44.184.7) Hello I have seen an extrange behaviour when an overlay is used with the config backend. I developed an overlay and use it over the config backend and over another developed backedend (this last just for testing). (I need to update some backend data when the schema controlled by the config backend changes, so I used an overlay for that purpose) In such situations, the overlay is not added to the config backend in the ldap tree, which look as follows: cn=config - cn= schema - cn={0}core - olcDatabase={-1}frontend - olcDatabase={0}config - olcDatabase={-1}ndb_pl + olcoverlay={0}ndbover But when I run traffic on the config suffix (i.e. LDAP operations on the schema) I see that the overlay is really working, although it is not added to the ldap tree (the overlay is added through the .conf file) Is this a bug? is it the normal behaviour (in file bconfig.c, function config_back_db_open it expects the config backend as the first backend, without overlay)?, but in normal traffic the overlay is invoked, which seems extrange to me. Thanks in advance, Jorge.

1 0

Re: (ITS#5343) cn=config crash when deleting attrs
by rhafer＠suse.de 31 Jan '08

31 Jan '08

On Donnerstag, 31. Januar 2008, rhafer(a)suse.de wrote: > On Mittwoch, 30. Januar 2008, h.b.furuseth(a)usit.uio.no wrote: > > Ralf Haferkamp writes: > > > There are multiple ways to fix this, I guess. I am not sure which > > > one to take: > > > 1. Make slap_mods_opattrs() create a LDAP_MOD_ADD operation, when > > > the attributes don't exist in the entry. > > > > It'd be better to fix bconfig's LDAP_MOD_REPLACE. That should work > > like LDAP_MOD_ADD when the attribute is absent. Haven't looked at > > how easy that would(n't) be though. > > > > > 2. Do not try to modify the attributes (not even add) in > > > slap_mods_opattrs() if they do not exist. > > > > No idea... > > > > I like the consistency it gives as far as it goes - keep the > > presence of the attrs independent of whether they were created over > > the protocol or with slapd -f -F. Except fix #2 doesn't do that > > since it won't know whether to add them when creating an entry. So > > in summary, no opinion:-) > > I am currently testing the 3rd approach, the attributes will be > created even when starting with -f only. I'll commit it as soon as > make test finishes. Done. Please test. -- Ralf

1 0

Re: (ITS#5341) Invalid TLSCipherSuite causes hang
by kyle＠moffetthome.net 31 Jan '08

31 Jan '08

On Jan 31, 2008 7:43 AM, Kyle Moffett <kyle(a)moffetthome.net> wrote: > On Jan 31, 2008 12:29 AM, Kyle Moffett <kyle(a)moffetthome.net> wrote: > > I ran into this problem a little while ago and scribbled up the > > attached patch to fix it. It's trivial enough and it works in my > > testing here. > > Sorry, the patch seems to have gone out MIME-encoded and mostly > useless to people who want to download it from the bug-tracker. Let > me try again... (Sorry, still getting used to a new email client) Well damn, it still didn't work. Hopefully gmail won't mangle a pasted patch. Again, my apologies for the mess. Cheers, Kyle Moffett --- openldap-2.4.7/libraries/libldap/tls.c.orig 2007-12-21 19:24:08.000000000 -0500 +++ openldap-2.4.7/libraries/libldap/tls.c 2007-12-21 19:36:02.000000000 -0500 @@ -300,6 +300,7 @@ for (i=0; i<n_ciphers; i++) { if ( !strncasecmp( ciphers[i].name, ptr, len )) { num++; + ptr = end + 1; break; } } @@ -330,6 +331,7 @@ * only appear once in each list. */ if ( !strncasecmp( ciphers[i].name, ptr, len )) { + ptr = end + 1; for (j=0; j<nkx; j++) if ( kx[j] == ciphers[i].kx ) break;

1 0

Re: (ITS#5341) Invalid TLSCipherSuite causes hang
by kyle＠moffetthome.net 31 Jan '08

31 Jan '08

------=_Part_21408_16591909.1201783413748 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Content-Disposition: inline On Jan 31, 2008 12:29 AM, Kyle Moffett <kyle(a)moffetthome.net> wrote: > I ran into this problem a little while ago and scribbled up the > attached patch to fix it. It's trivial enough and it works in my > testing here. Sorry, the patch seems to have gone out MIME-encoded and mostly useless to people who want to download it from the bug-tracker. Let me try again... (Sorry, still getting used to a new email client) Cheers, Kyle Moffett ------=_Part_21408_16591909.1201783413748 Content-Type: text/plain; name=tls.patch.txt Content-Transfer-Encoding: base64 X-Attachment-Id: f_fc3apr6s1 Content-Disposition: attachment; filename=tls.patch.txt LS0tIG9wZW5sZGFwLTIuNC43L2xpYnJhcmllcy9saWJsZGFwL3Rscy5jLm9yaWcJMjAwNy0xMi0y MSAxOToyNDowOC4wMDAwMDAwMDAgLTA1MDAKKysrIG9wZW5sZGFwLTIuNC43L2xpYnJhcmllcy9s aWJsZGFwL3Rscy5jCTIwMDctMTItMjEgMTk6MzY6MDIuMDAwMDAwMDAwIC0wNTAwCkBAIC0zMDAs NiArMzAwLDcgQEAKIAkJZm9yIChpPTA7IGk8bl9jaXBoZXJzOyBpKyspIHsKIAkJCWlmICggIXN0 cm5jYXNlY21wKCBjaXBoZXJzW2ldLm5hbWUsIHB0ciwgbGVuICkpIHsKIAkJCQludW0rKzsKKwkJ CQlwdHIgPSBlbmQgKyAxOwogCQkJCWJyZWFrOwogCQkJfQogCQl9CkBAIC0zMzAsNiArMzMxLDcg QEAKIAkJCSAqIG9ubHkgYXBwZWFyIG9uY2UgaW4gZWFjaCBsaXN0LgogCQkJICovCiAJCQlpZiAo ICFzdHJuY2FzZWNtcCggY2lwaGVyc1tpXS5uYW1lLCBwdHIsIGxlbiApKSB7CisJCQkJcHRyID0g ZW5kICsgMTsKIAkJCQlmb3IgKGo9MDsgajxua3g7IGorKykKIAkJCQkJaWYgKCBreFtqXSA9PSBj aXBoZXJzW2ldLmt4ICkKIAkJCQkJCWJyZWFrOwo= ------=_Part_21408_16591909.1201783413748--

1 0

Re: (ITS#5343) cn=config crash when deleting attrs
by rhafer＠suse.de 31 Jan '08

31 Jan '08

On Mittwoch, 30. Januar 2008, h.b.furuseth(a)usit.uio.no wrote: > Ralf Haferkamp writes: > > There are multiple ways to fix this, I guess. I am not sure which > > one to take: > > 1. Make slap_mods_opattrs() create a LDAP_MOD_ADD operation, when > > the attributes don't exist in the entry. > > It'd be better to fix bconfig's LDAP_MOD_REPLACE. That should work > like LDAP_MOD_ADD when the attribute is absent. Haven't looked at > how easy that would(n't) be though. > > > 2. Do not try to modify the attributes (not even add) in > > slap_mods_opattrs() if they do not exist. > > No idea... > > I like the consistency it gives as far as it goes - keep the presence > of the attrs independent of whether they were created over the > protocol or with slapd -f -F. Except fix #2 doesn't do that since it > won't know whether to add them when creating an entry. So in > summary, no opinion:-) I am currently testing the 3rd approach, the attributes will be created even when starting with -f only. I'll commit it as soon as make test finishes. > > 3. Create the opattrs, when reading from slapd.conf > > Doesn't help preexisting cn=config directories. They didn't have the problem. The opattr were only absent, when slapd is started with -f. When started with -f -F the attrs were created during the conversion to back-config. They were at least present on disk. -- Ralf

1 0

Re: (ITS#5341) Invalid TLSCipherSuite causes hang
by kyle＠moffetthome.net 31 Jan '08

31 Jan '08

------=_Part_20332_23395431.1201757372670 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Content-Disposition: inline I ran into this problem a little while ago and scribbled up the attached patch to fix it. It's trivial enough and it works in my testing here. Cheers, Kyle Moffett ------=_Part_20332_23395431.1201757372670 Content-Type: application/octet-stream; name=tls.patch Content-Transfer-Encoding: base64 X-Attachment-Id: f_fc2v9vtn0 Content-Disposition: attachment; filename=tls.patch LS0tIG9wZW5sZGFwLTIuNC43L2xpYnJhcmllcy9saWJsZGFwL3Rscy5jLm9yaWcJMjAwNy0xMi0y MSAxOToyNDowOC4wMDAwMDAwMDAgLTA1MDAKKysrIG9wZW5sZGFwLTIuNC43L2xpYnJhcmllcy9s aWJsZGFwL3Rscy5jCTIwMDctMTItMjEgMTk6MzY6MDIuMDAwMDAwMDAwIC0wNTAwCkBAIC0zMDAs NiArMzAwLDcgQEAKIAkJZm9yIChpPTA7IGk8bl9jaXBoZXJzOyBpKyspIHsKIAkJCWlmICggIXN0 cm5jYXNlY21wKCBjaXBoZXJzW2ldLm5hbWUsIHB0ciwgbGVuICkpIHsKIAkJCQludW0rKzsKKwkJ CQlwdHIgPSBlbmQgKyAxOwogCQkJCWJyZWFrOwogCQkJfQogCQl9CkBAIC0zMzAsNiArMzMxLDcg QEAKIAkJCSAqIG9ubHkgYXBwZWFyIG9uY2UgaW4gZWFjaCBsaXN0LgogCQkJICovCiAJCQlpZiAo ICFzdHJuY2FzZWNtcCggY2lwaGVyc1tpXS5uYW1lLCBwdHIsIGxlbiApKSB7CisJCQkJcHRyID0g ZW5kICsgMTsKIAkJCQlmb3IgKGo9MDsgajxua3g7IGorKykKIAkJCQkJaWYgKCBreFtqXSA9PSBj aXBoZXJzW2ldLmt4ICkKIAkJCQkJCWJyZWFrOwo= ------=_Part_20332_23395431.1201757372670--

1 0

Re: (ITS#5343) cn=config crash when deleting attrs
by h.b.furuseth＠usit.uio.no 30 Jan '08

30 Jan '08

Ralf Haferkamp writes: > There are multiple ways to fix this, I guess. I am not sure which one > to take: > 1. Make slap_mods_opattrs() create a LDAP_MOD_ADD operation, when the > attributes don't exist in the entry. It'd be better to fix bconfig's LDAP_MOD_REPLACE. That should work like LDAP_MOD_ADD when the attribute is absent. Haven't looked at how easy that would(n't) be though. > 2. Do not try to modify the attributes (not even add) in > slap_mods_opattrs() if they do not exist. No idea... I like the consistency it gives as far as it goes - keep the presence of the attrs independent of whether they were created over the protocol or with slapd -f -F. Except fix #2 doesn't do that since it won't know whether to add them when creating an entry. So in summary, no opinion:-) > 3. Create the opattrs, when reading from slapd.conf Doesn't help preexisting cn=config directories. -- Hallvard

1 0

Re: (ITS#5343) cn=config crash when deleting attrs
by rhafer＠suse.de 30 Jan '08

30 Jan '08

On Mittwoch, 30. Januar 2008, h.b.furuseth(a)usit.uio.no wrote: > Ralf Haferkamp writes: > > This should be fixed in HEAD now. > > Yes. Instead test034-translucent fails: > >>>>> Starting test034-translucent ... > > ... > Dynamically configuring local slapd without translucent_no_glue... > ldap_modify: No such attribute (16) > additional info: modify/delete: entryCSN: no such attribute > modifying entry > "olcOverlay={0}translucent,olcDatabase={2}bdb,cn=config" > > ldapmodify of dynamic config failed (16) > > >>>>> scripts/test034-translucent with bdb failed (exit 1) Hm, the config entries do not contain the usual operational Attributes like entrycsn, modifytimestamp, and so on when the config was loaded from slapd.conf, but during modification slapd tries to update them using slap_mods_opattrs(). This function always creates a LDAP_MOD_REPLACE modifcation, even if the attributes do not exist in the original entry. There are multiple ways to fix this, I guess. I am not sure which one to take: 1. Make slap_mods_opattrs() create a LDAP_MOD_ADD operation, when the attributes don't exist in the entry. 2. Do not try to modify the attributes (not even add) in slap_mods_opattrs() if they do not exist. 3. Create the opattrs, when reading from slapd.conf 4. Fix the original Bug differently. Even though I am pretty sure that my fix is correct. 5. ? Any suggestions? -- Ralf

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by richton＠nbcs.rutgers.edu 30 Jan '08

30 Jan '08

> Have you got any servers running 2.3.39, or all 2.3.37? Everything went from 2.3.37 -> 2.3.40. Since I get hosed w/err=80, the slaves don't have corrupt data. I'm thinking about moving the master down to 2.3.39 as a data point. In the meantime, thanks for the db_dump idea; I can now show that the bad commits are definitely (a) 2.3.40 and (b) increasing. Consider: # grep 172.23.93.232 dbdump* dbdump.Jan291845: \80\10cn=172.23.93.232\00cn=172.23.93.232\00\00\00\00\00\00\01\d3\8d dbdump.Jan291845: \00\10cn=172.23.93.232\00cn=172.23.93.232\00\00\00\00\00\00\00\01> dbdump.Jan301043: \80\10cn=172.23.93.232\00cn=1\b72.23.93.232\00\00\00\00\00\00\01\d3\8d dbdump.Jan301043: \00\10cn=172.23.93.232\00cn=172.23.93.232\00\00\00\00\00\00\00\01>

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by hyc＠symas.com 30 Jan '08

30 Jan '08

Aaron Richton wrote: >> after it. ("Last" is obviously imprecise. But the point is you would have had >> to have created some new entries after the upgrade whose DNs would cause >> their records to fall on the same DB page as this record, meaning they're >> close in the sort order and such.) > > As for "close pagewise," there's a lot of churn here since it's the > beginning of the semester. It's not uncommon to see the same DN DEL/ADD > within ~30-60 minutes. > >> And for most err=80 situations, there ought to be BerkeleyDB error messages >> in the log as well. > > Agreed. On that end, I pulled out two weeks of logs overnight, and grep > for "bdb(" found precisely zero hits. > > > While I had the logs out, I looked back, and it turns out the first time I > ever saw a problem with 2.3.40 actually WASN'T err=80: > > Jan 24 19:03:31 op=4 DEL dn="cn=172.23.132.58,cn..." > Jan 24 19:03:31 conn=3252 op=4 RESULT tag=107 err=32 text= > > > > This was added under 2.3.37: > > Jan 22 18:33:28 op=4 ADD dn="cn=172.23.132.58,cn=..." > > Now of course you can blame stuff between Jan 22-24 as moving that entry. > But I've got nightly slapcat's showing: > > dn: cn=172.23.132.58,cn=Clients,cn=ResNet Service Config,ou=Host Config,o=Rutg > entryCSN: 20080122233328Z#000004#00#000000 > > As a matter of fact, I can even run that right this second. > > # date;slapcat -b "o=Rutgers CCF,c=US" | /usr/sfw/bin/ggrep -A12 cn=172.23.132.58 | egrep '^cn|^entryCSN' > Wed Jan 30 09:29:03 EST 2008 > cn: 172.23.132.58 > entryCSN: 20080122233328Z#000004#00#000000 > > So notfound is.....dubious. (And no, I'm not manually tweaking it, and I > don't even know how to spell managedSAit. ;) That's the first time I saw > 2.3.40 go weird. Well, one of the big patches in 2.3.40 (relative to 2.3.39) was a fix for some caching bugs which showed up if an entry was being deleted and added in rapid succession, and being searched for. In that case, it was possible for the old dn2id value to be read back into the cache from disk before it got deleted off the disk. So it's conceivable that this patch caused your err=32 problem somehow. But nothing explains the errant bit getting set in the DN. Have you got any servers running 2.3.39, or all 2.3.37? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5343) cn=config crash when deleting attrs
by h.b.furuseth＠usit.uio.no 30 Jan '08

30 Jan '08

Ralf Haferkamp writes: > This should be fixed in HEAD now. Yes. Instead test034-translucent fails: >>>>> Starting test034-translucent ... ... Dynamically configuring local slapd without translucent_no_glue... ldap_modify: No such attribute (16) additional info: modify/delete: entryCSN: no such attribute modifying entry "olcOverlay={0}translucent,olcDatabase={2}bdb,cn=config" ldapmodify of dynamic config failed (16) >>>>> scripts/test034-translucent with bdb failed (exit 1) -- Hallvard

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by richton＠nbcs.rutgers.edu 30 Jan '08

30 Jan '08

> after it. ("Last" is obviously imprecise. But the point is you would have had > to have created some new entries after the upgrade whose DNs would cause > their records to fall on the same DB page as this record, meaning they're > close in the sort order and such.) As for "close pagewise," there's a lot of churn here since it's the beginning of the semester. It's not uncommon to see the same DN DEL/ADD within ~30-60 minutes. > And for most err=80 situations, there ought to be BerkeleyDB error messages > in the log as well. Agreed. On that end, I pulled out two weeks of logs overnight, and grep for "bdb(" found precisely zero hits. While I had the logs out, I looked back, and it turns out the first time I ever saw a problem with 2.3.40 actually WASN'T err=80: Jan 24 19:03:31 op=4 DEL dn="cn=172.23.132.58,cn..." Jan 24 19:03:31 conn=3252 op=4 RESULT tag=107 err=32 text= This was added under 2.3.37: Jan 22 18:33:28 op=4 ADD dn="cn=172.23.132.58,cn=..." Now of course you can blame stuff between Jan 22-24 as moving that entry. But I've got nightly slapcat's showing: dn: cn=172.23.132.58,cn=Clients,cn=ResNet Service Config,ou=Host Config,o=Rutg entryCSN: 20080122233328Z#000004#00#000000 As a matter of fact, I can even run that right this second. # date;slapcat -b "o=Rutgers CCF,c=US" | /usr/sfw/bin/ggrep -A12 cn=172.23.132.58 | egrep '^cn|^entryCSN' Wed Jan 30 09:29:03 EST 2008 cn: 172.23.132.58 entryCSN: 20080122233328Z#000004#00#000000 So notfound is.....dubious. (And no, I'm not manually tweaking it, and I don't even know how to spell managedSAit. ;) That's the first time I saw 2.3.40 go weird.

1 0

Re: (ITS#5343) cn=config crash when deleting attrs
by rhafer＠suse.de 30 Jan '08

30 Jan '08

On Mittwoch, 30. Januar 2008, h.b.furuseth(a)usit.uio.no wrote: [..] > > back-config crashes if I delete some attribute, even some which > does not exist, and then olcAttributeOptions: > > bash$ cat slapd.conf > include servers/slapd/schema/core.schema > database config > rootdn cn=config > rootpw secret > > bash$ ldapmodify -xh:3890 -Dcn=config -wsecret > dn: cn=config > changetype: modify > # or use "delete: o" > delete: olcAllows > - > delete: olcAttributeOptions > olcAttributeOptions: foo > - > > Crash in bconfig.c:config_modify_internal line 4843 because d == > NULL: 4842 if ( ml->sml_values ) { > 4843 d = d->next; > 4844 ch_free( dels ); > 4845 dels = d; > 4846 } [..] This should be fixed in HEAD now. The code did not check the return code of modify_delete_vindex() for failures. > Also the error message from deleting just olcAttributeOptions is bad: > > bash$ ldapmodify -xh:3890 -Dcn=config -wsecret > dn: cn=config > changetype: modify > replace: olcAttributeOptions > olcAttributeOptions: foo > > ldap_modify: Internal (implementation specific) error (80) > additional info: modify/delete: modifyTimestamp: no such attribute > modifying entry "cn=config" > > Finally "replace:" only needs to fail if there are options to delete, > not if one adds a line with just "attributeOptions" to slapd.conf. > That removes the default, "lang-". Haven't looked into this yet. -- Ralf

1 0

Re: (ITS#5344) Wrong check for bad Modify DN
by h.b.furuseth＠usit.uio.no 30 Jan '08

30 Jan '08

hyc(a)symas.com writes: > Probably should look at adding the dest_dn to the op struct, so each > backend doesn't have to rebuild it. Third-party overlays which modify newrdn or newSuperior would become incorrect, so maybe this change should wait for OpenLDAP 2.5. -- Hallvard

1 0

Re: (ITS#5344) Wrong check for bad Modify DN
by h.b.furuseth＠usit.uio.no 30 Jan '08

30 Jan '08

hyc(a)symas.com writes: >> The slapd/modrdn.c check for affectsMultipleDSAs is insufficient, it >> requires newSuperior to be in the same backend. That does not catch >> moving "cn=x,cn=y" to another database's suffix "cn=z,cn=y". > > I don't see how it can miss this. It checks if newSuperior is in another backend, but that move doesn't need a newSuperior. It keeps the same parent: database 1: suffix cn=y database 2: suffix cn=z,cn=y modify rdn: dn "cn=x,cn=y"; newrdn cn=z; newSuperior (if any) cn=y. > Probably should look at adding the dest_dn to the op struct, so each > backend doesn't have to rebuild it. Indeed. And dest_ndn. -- Hallvard

1 0

Re: (ITS#5344) Wrong check for bad Modify DN
by hyc＠symas.com 30 Jan '08

30 Jan '08

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: HEAD > OS: > URL: http://folk.uio.no/hbf/OpenLDAP/modrdn.diff > Submission from: (NULL) (129.240.6.233) > Submitted by: hallvard > > > The slapd/modrdn.c check for affectsMultipleDSAs is insufficient, it > requires newSuperior to be in the same backend. That does not catch > moving "cn=x,cn=y" to another database's suffix "cn=z,cn=y". I don't see how it can miss this. > Also > if a database has multiple suffixes it prevents moving an entry > to one of the suffixes. OK, I see that. > slapd/modrdn.c can catch attempts to place an entry above/below itself. > It doesn't need to send those to the database and hope that catches it. > This patch puts it in the frontend (fe_op_modrdn); that needed to > generate the destination DN anyway for the affectsMultipleDSAs check. > Not sure if that's right or if it should go in do_modrdn() instead. > (I'm thinking of DN rewriting in rwm, vs. global overlays.) Probably should look at adding the dest_dn to the op struct, so each backend doesn't have to rebuild it. > In test005-modrdn, the "modrdn with newSuperior as child of target" check > would not catch anything: It expects failure, but the newSuperior did > not exist and would fail with noSuchObject in any case. This patch uses > newSuperior=target instead, and expects unwillingToPerform. > I'll apply the patch later, unless someone thinks it should be done > differently. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5344) Wrong check for bad Modify DN
by h.b.furuseth＠usit.uio.no 30 Jan '08

30 Jan '08

Full_Name: Hallvard B Furuseth Version: HEAD OS: URL: http://folk.uio.no/hbf/OpenLDAP/modrdn.diff Submission from: (NULL) (129.240.6.233) Submitted by: hallvard The slapd/modrdn.c check for affectsMultipleDSAs is insufficient, it requires newSuperior to be in the same backend. That does not catch moving "cn=x,cn=y" to another database's suffix "cn=z,cn=y". Also if a database has multiple suffixes it prevents moving an entry to one of the suffixes. slapd/modrdn.c can catch attempts to place an entry above/below itself. It doesn't need to send those to the database and hope that catches it. This patch puts it in the frontend (fe_op_modrdn); that needed to generate the destination DN anyway for the affectsMultipleDSAs check. Not sure if that's right or if it should go in do_modrdn() instead. (I'm thinking of DN rewriting in rwm, vs. global overlays.) In test005-modrdn, the "modrdn with newSuperior as child of target" check would not catch anything: It expects failure, but the newSuperior did not exist and would fail with noSuchObject in any case. This patch uses newSuperior=target instead, and expects unwillingToPerform. I'll apply the patch later, unless someone thinks it should be done differently.

1 0

Re: (ITS#5330) back-null upgrade
by h.b.furuseth＠usit.uio.no 30 Jan '08

30 Jan '08

hyc(a)symas.com writes: > h.b.furuseth(a)usit.uio.no wrote: >> I'll be upgrading back-null a bit. At the moment just support for >> Back-config, Modify-Increment Extension and empty rootpw. > >> Maybe grow it to a useful template of a nontrivial backend later >> (after I learn how to write that), with access control, referrals, >> various extensions... Might be almost-unused and thus subject to >> code rot, but less so than documentation of the backend API. >> (...) > > I don't believe back-null should ever handle access controls or > referrals. OK. However it shouldn't need to _handle_ referrals, since it can have no referral objects. I think the complete implementation would be to set SLAP_BFLAG_REFERRALS and LDAP_CONTROL_MANAGEDSAIT in the init function. Assuming the default_referral code in BDB which neither of us understand (ITS#5339) is unnecessary. SLAP_BFLAG_INCREMENT and (I think) LDAP_CONTROL_X_PERMISSIVE_MODIFY can be set without needing any extra code, and LDAP_CONTROL_NOOP will need one line for the update functions. > It shouldn't have any config options at all, really. Does that mean I shouldn't add back-config support either? I do find "bind on" useful. And it would be convenient to accept and ignore the "directory" option, so it can be used as a drop-in replacement for a minimal back-bdb/back-ldif config. My current motivation is nothing major, just to push back-null through "cd tests/ && ./run -b null all". > Create some other backend if you want a dummy template that shows how > all the other APIs are tied in. OK. Just need to think of something for it to do... -- Hallvard

1 0

(ITS#5343) cn=config crash when deleting attrs
by h.b.furuseth＠usit.uio.no 30 Jan '08

30 Jan '08

Full_Name: Hallvard B Furuseth Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (129.240.203.232) Submitted by: hallvard back-config crashes if I delete some attribute, even some which does not exist, and then olcAttributeOptions: bash$ cat slapd.conf include servers/slapd/schema/core.schema database config rootdn cn=config rootpw secret bash$ ldapmodify -xh:3890 -Dcn=config -wsecret dn: cn=config changetype: modify # or use "delete: o" delete: olcAllows - delete: olcAttributeOptions olcAttributeOptions: foo - Crash in bconfig.c:config_modify_internal line 4843 because d == NULL: 4842 if ( ml->sml_values ) { 4843 d = d->next; 4844 ch_free( dels ); 4845 dels = d; 4846 } Backtrace: #0 0x000000000042db19 in config_modify_internal (ce=0x9cb710, op=0x9d7330, rs=0x41801cb0, ca=0x417ff750) at bconfig.c:4843 #1 0x000000000042e34a in config_back_modify (op=0x9d7330, rs=0x41801cb0) at bconfig.c:4991 #2 0x0000000000461107 in fe_op_modify (op=0x9d7330, rs=0x41801cb0) at modify.c:300 #3 0x00000000004609b0 in do_modify (op=0x9d7330, rs=0x41801cb0) at modify.c:175 #4 0x0000000000440dd8 in connection_operation (ctx=0x41801e00, arg_v=0x9d7330) at connection.c:1087 #5 0x0000000000441306 in connection_read_thread (ctx=0x41801e00, argv=0x9) at connection.c:1214 #6 0x00002b100d4c354f in ldap_int_thread_pool_wrapper (xpool=0x927a10) at tpool.c:625 #7 0x00002b100e1e6317 in start_thread () from /lib/libpthread.so.0 #8 0x00002b100f935d5d in clone () from /lib/libc.so.6 #9 0x0000000000000000 in ?? () Also the error message from deleting just olcAttributeOptions is bad: bash$ ldapmodify -xh:3890 -Dcn=config -wsecret dn: cn=config changetype: modify replace: olcAttributeOptions olcAttributeOptions: foo ldap_modify: Internal (implementation specific) error (80) additional info: modify/delete: modifyTimestamp: no such attribute modifying entry "cn=config" Finally "replace:" only needs to fail if there are options to delete, not if one adds a line with just "attributeOptions" to slapd.conf. That removes the default, "lang-".

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by hyc＠symas.com 30 Jan '08

30 Jan '08

Aaron Richton wrote: > Backend is hdb. The add was done under 2.3.37, the server has since been > upgraded to 2.3.40 (last Thursday). > > db_dump -p does show a high character... > > \80\10cn=172.23.58.210\00cn=1\b72.23.58.210\00\00\00\00\00\00\01\e4e > > which I suppose you're theorizing is off-by-one on the disk. BTW, slapcat > doesn't agree with ldapsearch here, which might be construed as a bug? > (Although it's tough to call something a bug in an impossible situation, I > admit.) > I dunno. I suppose if the hardware is bad then I might be seeing all sorts > of crazy stuff. But we're talking modern sparc/solaris hardware: all my > other boxes are pretty good about screaming during their death. And they > also don't have the amazingly-coincidental upgrade to 2.3.40 from last > Thursday, either. (Which I started seeing err=80 returns within 24 hours > of, after not seeing them...well, almost ever in production.) It's all > just a bit too perfect a storm for my taste...but I'd obviously defer to > you when it comes to bdb internals. Well, if the entry was created a while ago and hasn't ever been modrdn'd then this DB record would never have been touched since then. (Or more to the point, not modrdn'd since the 2.3.40 upgrade.) It's possible that a software bug might have caused a stray bitwise OR to toggle that bit in an in-memory cached page, but seems unlikely that a page corrupted in that manner would have been written back to disk. Unless of course this record is one of the last ones in the DB before the upgrade, and new entries were added right after it. ("Last" is obviously imprecise. But the point is you would have had to have created some new entries after the upgrade whose DNs would cause their records to fall on the same DB page as this record, meaning they're close in the sort order and such.) > With that in mind, I might as well see through your theory. I'll play with > a second box tomorrow and see if I can reproduce fresh. And for most err=80 situations, there ought to be BerkeleyDB error messages in the log as well. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by richton＠nbcs.rutgers.edu 30 Jan '08

30 Jan '08

Backend is hdb. The add was done under 2.3.37, the server has since been upgraded to 2.3.40 (last Thursday). db_dump -p does show a high character... \80\10cn=172.23.58.210\00cn=1\b72.23.58.210\00\00\00\00\00\00\01\e4e which I suppose you're theorizing is off-by-one on the disk. BTW, slapcat doesn't agree with ldapsearch here, which might be construed as a bug? (Although it's tough to call something a bug in an impossible situation, I admit.) I dunno. I suppose if the hardware is bad then I might be seeing all sorts of crazy stuff. But we're talking modern sparc/solaris hardware: all my other boxes are pretty good about screaming during their death. And they also don't have the amazingly-coincidental upgrade to 2.3.40 from last Thursday, either. (Which I started seeing err=80 returns within 24 hours of, after not seeing them...well, almost ever in production.) It's all just a bit too perfect a storm for my taste...but I'd obviously defer to you when it comes to bdb internals. With that in mind, I might as well see through your theory. I'll play with a second box tomorrow and see if I can reproduce fresh.

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by hyc＠symas.com 30 Jan '08

30 Jan '08

richton(a)nbcs.rutgers.edu wrote: > Full_Name: Aaron Richton > Version: 2.3.40 > OS: Solaris 9 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (128.6.31.135) > > > $ ldapsearch -LLL '(cn=172.23.58.210)' > dn:: Y249MbcyLjIzLjU4LjIxMCxjbj1DbGllbnRzLGNuPVJlc05ldCBTZXJ2aWNlIENvbmZpZyxvd > T1Ib3N0IENvbmZpZyxvPVJ1dGdlcnMgQ0NGLGM9VVM= > objectClass: top > objectClass: dhcpHost > cn: 172.23.58.210 > dhcpStatements: fixed-address 172.23.58.210 > dhcpHWAddress: ethernet 00:17:3f:bf:c2:04 > > > Is it just me, or does my cn attribute not match the cn in the dn? Uhhh...now > what? > (and no, I wasn't using an editor on the bdb files, or whatever other conspiracy > theory is out there.) Also, if it helps, you can see on openldap-software my > other misadventures with 2.3.40...this is just one that's really easy to prove. You didn't mention what backend you're using. I'd examine the dn2id.bdb file (use db_dump -p) and see if this DN is corrupted there. Also, was this entry created using 2.3.40, or using an earlier version? Interesting that the byte differs from the expected value by a single bit (it has its high bit set). Personally I suspect the hardware is flaking out. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by richton＠nbcs.rutgers.edu 30 Jan '08

30 Jan '08

> does this help? the "7" in 172 is something else (octal 267, I believe). Precisely. How did that get in my database? It MUST match the dn per spec, right? And it doesn't. (The character almost certainly should be '7.' If I go back in my logs far enough, I'll bet I can even find an ADD log showing it as such...)

1 0

Re: (ITS#5342) DN and naming attribute mismatch
by ando＠sys-net.it 30 Jan '08

30 Jan '08

richton(a)nbcs.rutgers.edu wrote: > Full_Name: Aaron Richton > Version: 2.3.40 > OS: Solaris 9 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (128.6.31.135) > > > $ ldapsearch -LLL '(cn=172.23.58.210)' > dn:: Y249MbcyLjIzLjU4LjIxMCxjbj1DbGllbnRzLGNuPVJlc05ldCBTZXJ2aWNlIENvbmZpZyxvd > T1Ib3N0IENvbmZpZyxvPVJ1dGdlcnMgQ0NGLGM9VVM= > objectClass: top > objectClass: dhcpHost > cn: 172.23.58.210 > dhcpStatements: fixed-address 172.23.58.210 > dhcpHWAddress: ethernet 00:17:3f:bf:c2:04 > > > Is it just me, or does my cn attribute not match the cn in the dn? Uhhh...now > what? > (and no, I wasn't using an editor on the bdb files, or whatever other conspiracy > theory is out there.) Also, if it helps, you can see on openldap-software my > other misadventures with 2.3.40...this is just one that's really easy to prove. bash-3.00$ echo -n "Y249MbcyLjIzLjU4LjIxMCxjbj1DbGllbnRzLGNuPVJlc05ldCBTZXJ2aWNlIENvbmZpZyxvdT1Ib3N0IENvbmZpZyxvPVJ1dGdlcnMgQ0NGLGM9VVM=" | base64 -d | od -c 0000000 c n = 1 267 2 . 2 3 . 5 8 . 2 1 0 0000020 , c n = C l i e n t s , c n = R 0000040 e s N e t S e r v i c e C o 0000060 n f i g , o u = H o s t C o n 0000100 f i g , o = R u t g e r s C C 0000120 F , c = U S 0000126 does this help? the "7" in 172 is something else (octal 267, I believe). p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#5342) DN and naming attribute mismatch
by richton＠nbcs.rutgers.edu 30 Jan '08

30 Jan '08

Full_Name: Aaron Richton Version: 2.3.40 OS: Solaris 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (128.6.31.135) $ ldapsearch -LLL '(cn=172.23.58.210)' dn:: Y249MbcyLjIzLjU4LjIxMCxjbj1DbGllbnRzLGNuPVJlc05ldCBTZXJ2aWNlIENvbmZpZyxvd T1Ib3N0IENvbmZpZyxvPVJ1dGdlcnMgQ0NGLGM9VVM= objectClass: top objectClass: dhcpHost cn: 172.23.58.210 dhcpStatements: fixed-address 172.23.58.210 dhcpHWAddress: ethernet 00:17:3f:bf:c2:04 Is it just me, or does my cn attribute not match the cn in the dn? Uhhh...now what? (and no, I wasn't using an editor on the bdb files, or whatever other conspiracy theory is out there.) Also, if it helps, you can see on openldap-software my other misadventures with 2.3.40...this is just one that's really easy to prove.

1 0

Re: (ITS#5341) Invalid TLSCipherSuite causes hang
by vorlon＠debian.org 29 Jan '08

29 Jan '08

On Tue, Jan 29, 2008 at 11:31:43AM -0800, Quanah Gibson-Mount wrote: > --On Tuesday, January 29, 2008 11:09 AM -0800 Steve Langasek > <vorlon(a)debian.org> wrote: > > Anyway, the documented syntax for TLSCipherSuite is "$cipher1:$cipher2", > > not "$cipher1 $cipher2"; but setting such values gives me a hang on > > startup (which should be investigated). > Filed upstream: > <http://www.OpenLDAP.org/its/index.cgi?findid=5341> Sorry, the description of this ITS is inverted. It's *valid* ciphersuite values (i.e., "cipher1:cipher2") that cause the hang; invalid space-separated values are merely truncated after the first cipher in the list, which doesn't cause a hang, it just prevents the cipher list from being useful. -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer http://www.debian.org/ slangasek(a)ubuntu.com vorlon(a)debian.org

1 0

(ITS#5341) Invalid TLSCipherSuite causes hang
by quanah＠OpenLDAP.org 29 Jan '08

29 Jan '08

Full_Name: Quanah Gibson-Mount Version: 2.4.7 OS: NA URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (24.23.156.219) Setting TLSCipherSuite to "cipher1 cipher2" rather than "cipher1:cipher2" causes slapd to hang on startup (at least when using GnuTLS). It appears to be hanging indefinitely in ldap_pvt_tls_set_option() --Quanah

1 0

Re: (ITS#5328) backends sending/setting results
by h.b.furuseth＠usit.uio.no 29 Jan '08

29 Jan '08

Other bugs: * be->be_chk_referrals: back-bdb and back-ldif can send errors from be->be_chk_referrals. As far as I can tell that is wrong: It should return an LDAP result code, but only send it if it is LDAP_REFERRAL. backend_check_referrals() will send other errors, and success means it'll proceed to the be->be_<operation>() call. * be->be_fetch() (bi->bi_entry_get_rw()): The LDAP result code matters to at least aci.c:dynacl_aci_mask() and frontendDB->be_compare() (compare.c:fe_op_compare()). These use it via backend_attribute(), using frontendDB->be_attribute() (fe_acl_attribute()), using backend.c:be_entry_get_rw(). It can return just a boolean in back-null, back-ldif, back-relay and back-config. back-null usually pretends the entries are present, so maybe it should do "return oc ? LDAP_NO_SUCH_ATTRIBUTE : LDAP_BUSY;". * Internal slapd errors. back-ldap:ldap_back_entry_get() can return LDAP_NO_MEMORY. Maybe that's OK and instead send_ldap_response() should change negative negative result codes to LDAP_OTHER? -- Hallvard

1 0

(ITS#5340) REP_ENTRY_MODIFIABLE bug in dynlist
by h.b.furuseth＠usit.uio.no 29 Jan '08

29 Jan '08

Full_Name: Hallvard B Furuseth Version: OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard overlays/dynlist.c lines 371-376 sets REP_ENTRY_MUSTBEFREED in rs->sr_flags without duplicating the entry, if REP_ENTRY_MODIFIABLE was set. Thus the entry gets freed twice. Breaks test044-dynlist with back-ldif. This code snippet fixes it for test044, but it may be the wrong fix: e = rs->sr_entry; e_flags = rs->sr_flags; if ( !( e_flags & REP_ENTRY_MODIFIABLE ) ) { e = entry_dup( e ); if ( e_flags & REP_ENTRY_MUSTBEFREED ) entry_free( rs->sr_entry ); e_flags |= REP_ENTRY_MODIFIABLE | REP_ENTRY_MUSTBEFREED; } First, can something have references into the old sr_entry at this point? Second, there is also a REP_ENTRY_MUSTRELEASE flag which means to call be_entry_release_rw(), maybe that must be handled. Also overlays collect, pcache & valsort ignore REP_ENTRY_MUSTRELEASE. A common function to handle this might be useful - pass it a SlapResponse, BackendDB and flags to set and flags to unset, and let it free, release or dup what is needed.

1 0

Re: (ITS#5339) wrong referral from back-bdb
by h.b.furuseth＠usit.uio.no 29 Jan '08

29 Jan '08

I wrote: > !be_issuffix( op->o_bd,&op->o_req_ndn ) > which looks to me like a test for whether this function is _not_ to be > called for this database. No, that's a test if the DN is the exact suffix, not if it has the suffix. Anyway, for what it's worth "make test" succeeds with an "assert(0)" after the !be_issuffix test. -- Hallvard

1 0

ldap_result error
by Fabio Ubaldi 29 Jan '08

29 Jan '08

Hi all, I have two processes running on the same PC that receive data from an LDAP server. Each process opens a connection with a different "slapd" server (i.e each server runs on a different PC) and launches "search" requests at a fixed rate (about 100 searches/s). Each process creates a thread that polls the server responses using the API "ldap_result" the used macro are LDAP_RES_ANY and LDAP_MSG_ONE. When the two processes send the requestes one of the two "ldap_result" return with error (-1) and the error is "Can't contact the LDAP server". I tried to launch one processes and it works fine (the maximum measured rate is 800 searches/s). Also I launch the two processes alternating the search requestes and it works fine. It seems that the error happens only if the two process runs simultaneously (I use a dual core PC). Thinking of a race condition error , I used the libldap_r library to build process, but the error still remains. The openldap version is 2.3.27 both for slapd servers and the libraries. Have anyone encountered a similar error ? Thanks in advance for the reply

1 0

Re: (ITS#5339) wrong referral from back-bdb
by h.b.furuseth＠usit.uio.no 29 Jan '08

29 Jan '08

hyc(a)symas.com writes: > Can you try testing with be_chk_referrals NULL'd out? That breaks test032-chain. -- Hallvard

1 0

Re: (ITS#5339) wrong referral from back-bdb
by hyc＠symas.com 29 Jan '08

29 Jan '08

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: HEAD > OS: > URL: > Submission from: (NULL) (129.240.6.233) > Submitted by: hallvard > > > If a referral object's "ref" DN differs from the entry DN, and > you update a subordinate of the referral object, the DN part > of the referral from back-bdb is wrong. > > bash$ cat ref.ldif > dn: o=we > o: we > ref: ldap://elsewhere/o=they > objectClass: referral > objectClass: extensibleObject > > dn: cn=me,o=we > cn: me > objectClass: organizationalRole > > bash$ ldapadd ...< ref.ldif > adding new entry "o=we" > > adding new entry "cn=me,o=we" > ldap_add: Referral (10) > matched DN: o=we > referrals: > ldap://elsewhere/cn=me,o=we > > It works if NULL is changed to&e->e_name at back-bdb/referral.c line 96: > > rs->sr_ref = referral_rewrite( ref, NULL, > &op->o_req_dn, LDAP_SCOPE_DEFAULT ); > > I don't quite understand that function though: > Why does it use default_referral (slapd.conf 'referral')? That is for > use when no local backend database handles the operation, which I would > think means no database's be_chk_referrals() gets be called. And indeed > the function uses it if > !be_issuffix( op->o_bd,&op->o_req_ndn ) > which looks to me like a test for whether this function is _not_ to be > called for this database. I've never understood that function either. ;) It seems completely unnecessary, since the individual operations' code also does referral checks. Can you try testing with be_chk_referrals NULL'd out? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5339) wrong referral from back-bdb
by h.b.furuseth＠usit.uio.no 29 Jan '08

29 Jan '08

Full_Name: Hallvard B Furuseth Version: HEAD OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard If a referral object's "ref" DN differs from the entry DN, and you update a subordinate of the referral object, the DN part of the referral from back-bdb is wrong. bash$ cat ref.ldif dn: o=we o: we ref: ldap://elsewhere/o=they objectClass: referral objectClass: extensibleObject dn: cn=me,o=we cn: me objectClass: organizationalRole bash$ ldapadd ... < ref.ldif adding new entry "o=we" adding new entry "cn=me,o=we" ldap_add: Referral (10) matched DN: o=we referrals: ldap://elsewhere/cn=me,o=we It works if NULL is changed to &e->e_name at back-bdb/referral.c line 96: rs->sr_ref = referral_rewrite( ref, NULL, &op->o_req_dn, LDAP_SCOPE_DEFAULT ); I don't quite understand that function though: Why does it use default_referral (slapd.conf 'referral')? That is for use when no local backend database handles the operation, which I would think means no database's be_chk_referrals() gets be called. And indeed the function uses it if !be_issuffix( op->o_bd, &op->o_req_ndn ) which looks to me like a test for whether this function is _not_ to be called for this database.

1 0

Re: (ITS#5280) JLDAP waits for response for request which hasn't been sent because of connection shutdown
by Rastogi Arpit 25 Jan '08

25 Jan '08

Hi Marcin , I will be out of the city for a couple of weeks . I am copying my manager and back up owner for the issue. However I would like to know which server you are using as I tried replicating the issue but was not able to using edirectory server. the debug messages suggest that it is in search but those are not of much help till we replicate the issue . If you require any help back up owner will try to provide you the help based on his priorities. And also in the forum if any body is interested he can take the bug forward working with you . regards Arpit

1 0

Re: (ITS#5280) JLDAP waits for response for request which hasn't been sent because of connection shutdown
by rarpit＠novell.com 25 Jan '08

25 Jan '08

Hi Marcin , I will be out of the city for a couple of weeks . I am copying my manager and back up owner for the issue. However I would like to know which server you are using as I tried replicating the issue but was not able to using edirectory server. the debug messages suggest that it is in search but those are not of much help till we replicate the issue . If you require any help back up owner will try to provide you the help based on his priorities. And also in the forum if any body is interested he can take the bug forward working with you . regards Arpit

1 0

(ITS#5338) Wrong debug message in ldap_open
by ma＠sernet.de 24 Jan '08

24 Jan '08

Full_Name: Michael Adam Version: 2.3 and current CVS OS: Linux URL: http://samba.org/~obnox/openldap/openldap.ldap_open.diff Submission from: (NULL) (77.181.84.116) I know, ldap_open() is deprecated, but anyhow: The final debug message in ldap_open() is wrong. Success and failure are confused. A patch to fix this debug message is available at the URL mentioned below.

1 0

Re: (ITS#5337) Start Slapd failure!!!
by ando＠sys-net.it 24 Jan '08

24 Jan '08

dugangfeng(a)163.com wrote: > hi all: > I start slapd by -d -1 command,'slapd -d -1',but print this: > > > @(#) $OpenLDAP: slapd 2.2.13 (Aug 19 2004 21:22:15) $ ^^^ you're actully running OpenLDAP 2.2.13 with more recent schema files. > root@porky.build.redhat.com:/usr/src/build/440386-i386/BUILD/openldap-2.2.13/openldap-2.2.13/build-servers/servers/slapd > daemon_init: <null> > daemon_init: listen on ldap:/// > daemon_init: 1 listeners to open... > ldap_url_parse_ext(ldap:///) > daemon: initialized ldap:/// > daemon_init: 2 listeners opened > slapd init: initiated server. > slap_sasl_init: initialized! > bdb_initialize: initialize BDB backend > bdb_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) > bdb_initialize: initialize BDB backend > bdb_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) > reading config file /etc/openldap/slapd.conf > line 5 (include /etc/openldap/schema/core.schema) > reading config file /etc/openldap/schema/core.schema > line 78 (attributetype ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: > knowledge information' EQUALITY caseIgnoreMatch SYNTAX > 1.3.6.1.4.1.1466.115.121.1.15{32768} )) > line 87 (attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last > (family) name(s) for which the entity is known by' SUP name )) > line 93 (attributetype ( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial > number of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} )) > line 100 (attributetype ( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC4519: > two-letter ISO-3166 country code' SUP name SYNTAX 1.3.6.1.4.1.1466.115.121.1.11 > SINGLE-VALUE )) > /etc/openldap/schema/core.schema: line 100: AttributeType inappropriate > SUPerior: "c" > slapd shutdown: freeing system resources. > slapd stopped. > connections_destroy: nothing to destroy. > > > please help me ,thanks. You need to use consistent code/configuration. As there is no evidence of a bug, this ITS will be closed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs