- openldap-bugs - openldap.org

Re: (ITS#4903) dynlist issues with memory allocation
by quanah＠stanford.edu 02 Apr '07

02 Apr '07

--On Monday, April 02, 2007 7:44 PM +0000 quanah(a)stanford.edu wrote: > > > --On Monday, April 02, 2007 9:42 PM +0200 Pierangelo Masarati > <ando(a)sys-net.it> wrote: > >> quanah(a)stanford.edu wrote: >> >>> database hdb >>> suffix "dc=stanford,dc=edu" >>> rootdn "cn=manager,dc=stanford,dc=edu" >>> >>> overlay valsort >>> valsort-attr suOrgContactStanford cn=orgs,dc=stanford,dc=edu weighted >>> valsort-attr suOrgContactWorld cn=orgs,dc=stanford,dc=edu weighted >>> >>> overlay dynlist >>> dynlist-attrset groupOfURLS memberURL member >>> >>> limits group="cn=ldapadmin,cn=applications,dc=stanford,dc=edu" >>> time.soft=unlimited time.hard=unlimited size.soft=unlimited >>> size.hard=unlimited >> >> There it is: "limits" is a database specific directive appearing >> __after__ overlay instantiation. Try moving all database-specific >> directives __before__ any overlay instantiation. > > Ah, I see... So its not just global/db. > > So all overlay bits should be listed last? And I assume this only > happens when you have more than one overlay in use? Because it only > happens once both valsort and dynlist are enabled. In any case, reordering the slapd.conf files so the overlay stuff all appears last has definitely fixed it. Yeah, and thanks. :) There's a lot I'm looking forward to in 2.4. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4903) dynlist issues with memory allocation
by quanah＠stanford.edu 02 Apr '07

02 Apr '07

--On Monday, April 02, 2007 12:42 PM -0700 Quanah Gibson-Mount <quanah(a)stanford.edu> wrote: > Ah, I see... So its not just global/db. > > So all overlay bits should be listed last? And I assume this only > happens when you have more than one overlay in use? Because it only > happens once both valsort and dynlist are enabled. That doesn't seem to be it either. For example, on my master, I have: database hdb suffix "dc=stanford,dc=edu" rootdn "cn=manager,dc=stanford,dc=edu" # Syncrepl Provider overlay syncprov syncprov-checkpoint 1000 60 # Dynamic Group Overlay overlay dyngroup # Uniqueness Overlay overlay unique unique_base cn=people,dc=stanford,dc=edu unique_attributes suunivid suproxycardnumber sucardnumber suuniqueidentifier # Valsort Overlay overlay valsort valsort-attr suOrgContactStanford cn=orgs,dc=stanford,dc=edu weighted valsort-attr suOrgContactWorld cn=orgs,dc=stanford,dc=edu weighted #valsort-attr ou cn=people,dc=stanford,dc=edu weighted #valsort-attr suAffiliation cn=people,dc=stanford,dc=edu weighted #valsort-attr suDisplayAffiliation cn=people,dc=stanford,dc=edu weighted overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 # Let ldapadmin have limitless searches limits group="cn=ldapadmin,cn=applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits group="cn=ldapreplica,cn=applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # Save the time that the entry gets modified lastmod on # Set the location of where the database storage files go. directory /var/lib/ldap dbconfig set_cachesize 3 536870912 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 dbconfig set_lg_dir /var/log/bdb dbconfig set_lk_max_locks 3000 # # Automatically remove log files that are no longer needed. dbconfig set_flags DB_LOG_AUTOREMOVE # # Setting set_tas_spins reduces resource contention from multiple clients on systems with multiple CPU's. dbconfig set_tas_spins 1 # Checkpoint the database to prevent transaction loss in unclean shutdowns, and speed up slapd shutdowns. checkpoint 1024 5 # Indices to maintain index default eq index cn index dc index entryCSN index entryUUID index objectClass index krb5PrincipalName index suCardNumber index suGeneralID index suProxyCardNumber index suRegID index suUniqueIdentifier index suUnivID index uid ####################################################################### # back-monitor database definitions ####################################################################### database monitor As you can see, *multiple* overlay statements and directives, prior to the "limits" command. It does not exhibit the problems I see on my replica. The issue only arises once dynlist is enabled. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4903) dynlist issues with memory allocation
by ando＠sys-net.it 02 Apr '07

02 Apr '07

Quanah Gibson-Mount wrote: > Ah, I see... So its not just global/db. > > So all overlay bits should be listed last? And I assume this only > happens when you have more than one overlay in use? Because it only > happens once both valsort and dynlist are enabled. Well, the issue is subtle. You risk inconsistency whenever an overlay supports back-config __and__ the out-of-order directive uses some special back-config feature, like the possibility to directly write a value to the database/overlay structure. The way back-config statement/data structure resolution is designed in re23, the out-of-order directive will use the wrong data structure, thus resulting at least in breaking the configuration but, in some cases, in breaking the consistency of the process, by randomly writing, for example, on the stack or on the heap. This should be now fixed in HEAD, but the fix was not so easy to backport because back-config significantly changed in the meanwhile. So, since usually there is no need to write out-of-order statements (back-meta could be an exception, but fortunately enough it doesn't support back-config yet :), there is no pressure for fixing this issue in re23. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4903) dynlist issues with memory allocation
by quanah＠stanford.edu 02 Apr '07

02 Apr '07

--On Monday, April 02, 2007 9:42 PM +0200 Pierangelo Masarati <ando(a)sys-net.it> wrote: > quanah(a)stanford.edu wrote: > >> database hdb >> suffix "dc=stanford,dc=edu" >> rootdn "cn=manager,dc=stanford,dc=edu" >> >> overlay valsort >> valsort-attr suOrgContactStanford cn=orgs,dc=stanford,dc=edu weighted >> valsort-attr suOrgContactWorld cn=orgs,dc=stanford,dc=edu weighted >> >> overlay dynlist >> dynlist-attrset groupOfURLS memberURL member >> >> limits group="cn=ldapadmin,cn=applications,dc=stanford,dc=edu" >> time.soft=unlimited time.hard=unlimited size.soft=unlimited >> size.hard=unlimited > > There it is: "limits" is a database specific directive appearing > __after__ overlay instantiation. Try moving all database-specific > directives __before__ any overlay instantiation. Ah, I see... So its not just global/db. So all overlay bits should be listed last? And I assume this only happens when you have more than one overlay in use? Because it only happens once both valsort and dynlist are enabled. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4903) dynlist issues with memory allocation
by ando＠sys-net.it 02 Apr '07

02 Apr '07

quanah(a)stanford.edu wrote: > database hdb > suffix "dc=stanford,dc=edu" > rootdn "cn=manager,dc=stanford,dc=edu" > > overlay valsort > valsort-attr suOrgContactStanford cn=orgs,dc=stanford,dc=edu weighted > valsort-attr suOrgContactWorld cn=orgs,dc=stanford,dc=edu weighted > > overlay dynlist > dynlist-attrset groupOfURLS memberURL member > > limits group="cn=ldapadmin,cn=applications,dc=stanford,dc=edu" > time.soft=unlimited time.hard=unlimited size.soft=unlimited > size.hard=unlimited There it is: "limits" is a database specific directive appearing __after__ overlay instantiation. Try moving all database-specific directives __before__ any overlay instantiation. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4902) ManPage in 2.3.19 RPM is completely screwed up
by ando＠sys-net.it 02 Apr '07

02 Apr '07

Please keep replies on the ITS: the "T" stands for "tracking". Wei Weng wrote: > I just installed 2.3.34 version that was found to be the latest > "Release" from openLDAP. Not only there isn't any mention of > LDAP_DEPRECATED, in OpenLDAP 2.3 source tree: bash-3.00$ grep LDAP_DEPRECATED -rI include/ include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED include/ldap.h:#if LDAP_DEPRECATED > but there isn't manpage for the new ldap_initialize > function either. You're right, it's only been released starting with 2.4. > I am just very surprised that a quite mature openLDAP open source > projects can be this careless about the documentation. I already explained the reason in my previous posting. It's not lack of care, it's optimization of resources. The code works fine also without documentation, which eventually will converge (and it __is__ converging, in OpenLDAP 2.4). > There is (only > place) mention of ldap_initialize function in ldap.3: "A session handle > is created using ldap_initialize(3)". Naturally you want to do a man > ldap_initialize but there is nothing. ITS#3947 addresses this issue. > I was reporting this bug so that the "newbies" (new to openLDAP APIs) > won't be stuck like I was for a few hours. Then you probably should have entitled your posting "some C API man pages seem to be missing from OpenLDAP 2.3 code", or even better "this is a duplicate of ITS#2240". > Isn't the "Documentation" > supposed to help you to understand the APIs? This is not a bug. This is missing documentation, which is different. It is a known issue (ITS#2240), so your post is only adding noise. A non-noisy posting would have been accompanied by a patch fixing the issue, which is however already fixed in re24 (that's why ITS#2240 is now closed). > By the way, if you guys ask me to supply patch for the ldap_initialize, > sorry, I was just maintaining the old code to try to compile it on a > Fedora 5 box. The details about ldap APIs is above my ability. > > PS: ldap_initialize is just an example, there are also a bunch of other > functions that seemed to have been deprecated. Please check OpenLDAP 2.4. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4902) ManPage in 2.3.19 RPM is completely screwed up
by quanah＠stanford.edu 02 Apr '07

02 Apr '07

--On Monday, April 02, 2007 10:59 AM -0700 Quanah Gibson-Mount <quanah(a)stanford.edu> wrote: > > I.e., ldap_init is a deprecated function, and ldap_initialize should be > used instead. However, there are many programs out there that still use > the old API, so the old functions are maintained for backwards > compatibility purposes. Hence the man page. I will also note that ldap_initialize has a man page in the 2.4 release: <http://www.openldap.org/software/man.cgi?query=ldap_initialize&apropos=0&se…> --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4903) dynlist issues with memory allocation
by quanah＠stanford.edu 02 Apr '07

02 Apr '07

--On Monday, April 02, 2007 9:09 PM +0200 Pierangelo Masarati <ando(a)sys-net.it> wrote: >> It looks like there's soemthing incorrect in the way it is allocating >> memory on startup. > > Apparently, there's nothing directly related to dynlist; can you post > the entire slapd.conf? I suspect something like ITS#4848, which is NOT > fixed in re23 (and likely won't). I've looked at the ITS, and I don't think it is related. As far as I know, everything in it is specifically located where it should be (global bits in the global area, database specific bits in the database areas): My slapd.conf is: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/dyngroup.schema include /usr/local/etc/openldap/schema/krb5-kdc.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/eduperson.schema include /usr/local/etc/openldap/schema/stanford-oids.schema include /usr/local/etc/openldap/schema/suacct.schema include /usr/local/etc/openldap/schema/superson.schema include /usr/local/etc/openldap/schema/suapplication.schema include /usr/local/etc/openldap/schema/suorg.schema include /usr/local/etc/openldap/schema/eduorg.schema include /usr/local/etc/openldap/schema/suworkgroup.schema allow bind_v2 TLSCertificateFile /usr/local/etc/openldap/stardomain.crt TLSCertificateKeyFile /usr/local/etc/openldap/stardomain.key TLSCACertificateFile /usr/local/etc/openldap/comodo.pem include /usr/local/etc/openldap/slapd.acl pidfile /var/run/slapd.pid argsfile /var/run/slapd.args defaultsearchbase "dc=stanford,dc=edu" gentlehup off loglevel 256 threads 8 tool-threads 2 sasl-realm stanford.edu sasl-authz-policy both sasl-regexp uid=(.*)/cgi,cn=stanford.edu,cn=gssapi,cn=auth ldap:///cn=cgi,cn=applications,dc=stanford,dc=edu??sub?krb5PrincipalName=$1/cgi@stanford.edu sasl-regexp uid=service/(.*),cn=stanford.edu,cn=gssapi,cn=auth ldap:///cn=Service,cn=Applications,dc=stanford,dc=edu??sub?krb5PrincipalName=service/$1@stanford.edu sasl-regexp uid=webauth/(.*),cn=stanford.edu,cn=gssapi,cn=auth ldap:///cn=Webauth,cn=Applications,dc=stanford,dc=edu??sub?krb5PrincipalName=webauth/$1@stanford.edu sasl-regexp uid=(.*),cn=stanford.edu,cn=gssapi,cn=auth ldap:///uid=$1,cn=Accounts,dc=stanford,dc=edu??sub?suSeasStatus=active reverse-lookup on modulepath /usr/local/lib/openldap moduleload back_hdb.la moduleload back_monitor.la moduleload valsort.la moduleload dynlist.la database hdb suffix "dc=stanford,dc=edu" rootdn "cn=manager,dc=stanford,dc=edu" overlay valsort valsort-attr suOrgContactStanford cn=orgs,dc=stanford,dc=edu weighted valsort-attr suOrgContactWorld cn=orgs,dc=stanford,dc=edu weighted overlay dynlist dynlist-attrset groupOfURLS memberURL member limits group="cn=ldapadmin,cn=applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=athletics,cn=service,cn=applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=workgroup-audit,cn=service,cn=applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=RegistryDataAuditor,cn=Service,cn=Applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=ispace,cn=Service,cn=Applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=5000 size.hard=5000 limits dn.exact="cn=gsb-person,cn=service,cn=applications,dc=stanford,dc=edu" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited lastmod on syncrepl rid=0 provider=ldap://ldap-devmaster.stanford.edu:389 bindmethod=sasl saslmech=gssapi realm=stanford.edu searchbase="dc=stanford,dc=edu" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Replica Directives updateref ldap://ldap-devmaster.stanford.edu directory /var/lib/ldap dbconfig set_cachesize 3 536870912 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 dbconfig set_lg_dir /var/log/bdb dbconfig set_lk_max_locks 3000 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_lockers 1500 dbconfig set_flags DB_LOG_AUTOREMOVE dbconfig set_tas_spins 1 checkpoint 1024 5 cachesize 50000 idlcachesize 50000 cachefree 1000 index_substr_any_len 3 index default eq (Long list of indices) database monitor -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

(ITS#4904) delta-sync can free modlist redundantly
by hyc＠OpenLDAP.org 02 Apr '07

02 Apr '07

Full_Name: Howard Chu Version: 2.3/HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.168.84.21) Submitted by: hyc In syncrepl_message_to_op the modlist is copied to op->orm_modlist and then freed after op->o_bd->be_modify. But the modify can alter the modlist (e.g., ppolicy overlay) causing a redundant free later on.

1 0

Re: (ITS#4903) dynlist issues with memory allocation
by ando＠sys-net.it 02 Apr '07

02 Apr '07

quanah(a)stanford.edu wrote: > Full_Name: Quanah Gibson-Mount > Version: RE_23 > OS: Linux 2.6 (64-bit) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (171.64.19.81) > > > In testing the RE_23 tree, I put it under hoard after everything passed using > glibc as the memory allocator. I found that if I enable dynlist: > > moduleload dynlist.la > > then in my database section add: > > # Dynlist Overlay > overlay dynlist > dynlist-attrset groupOfURLS memberURL member > > > slapd will core dump on startup with: > > Loaded symbols for /usr/local/lib/openldap/dynlist-2.3-releng.so.0 > #0 0x00002ab7651490c9 in malloc () from /usr/local/lib/libhoard.so > (gdb) bt > #0 0x00002ab7651490c9 in malloc () from /usr/local/lib/libhoard.so > #1 0x00002ab765149e38 in realloc () from /usr/local/lib/libhoard.so > #2 0x00002ab76554f890 in ber_memrealloc_x (p=Variable "p" is not available. > ) at memory.c:354 > #3 0x00002ab76542bf88 in ldap_charray_add (a=0x7fff45a7eec0, s=0x2ab7667c2518 > "olcConnMaxPending") at charray.c:49 > #4 0x000000000045e9f9 in matching_rule_use_init () at mr.c:364 > #5 0x0000000000459f62 in slap_schema_check () at schema_prep.c:1368 > #6 0x0000000000415f1b in main (argc=3, argv=0x7fff45a7f0b8) at main.c:711 > > > It looks like there's soemthing incorrect in the way it is allocating memory on > startup. Apparently, there's nothing directly related to dynlist; can you post the entire slapd.conf? I suspect something like ITS#4848, which is NOT fixed in re23 (and likely won't). p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

(ITS#4903) dynlist issues with memory allocation
by quanah＠stanford.edu 02 Apr '07

02 Apr '07

Full_Name: Quanah Gibson-Mount Version: RE_23 OS: Linux 2.6 (64-bit) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (171.64.19.81) In testing the RE_23 tree, I put it under hoard after everything passed using glibc as the memory allocator. I found that if I enable dynlist: moduleload dynlist.la then in my database section add: # Dynlist Overlay overlay dynlist dynlist-attrset groupOfURLS memberURL member slapd will core dump on startup with: Loaded symbols for /usr/local/lib/openldap/dynlist-2.3-releng.so.0 #0 0x00002ab7651490c9 in malloc () from /usr/local/lib/libhoard.so (gdb) bt #0 0x00002ab7651490c9 in malloc () from /usr/local/lib/libhoard.so #1 0x00002ab765149e38 in realloc () from /usr/local/lib/libhoard.so #2 0x00002ab76554f890 in ber_memrealloc_x (p=Variable "p" is not available. ) at memory.c:354 #3 0x00002ab76542bf88 in ldap_charray_add (a=0x7fff45a7eec0, s=0x2ab7667c2518 "olcConnMaxPending") at charray.c:49 #4 0x000000000045e9f9 in matching_rule_use_init () at mr.c:364 #5 0x0000000000459f62 in slap_schema_check () at schema_prep.c:1368 #6 0x0000000000415f1b in main (argc=3, argv=0x7fff45a7f0b8) at main.c:711 It looks like there's soemthing incorrect in the way it is allocating memory on startup. --Quanah

1 0

Re: (ITS#4902) ManPage in 2.3.19 RPM is completely screwed up
by ando＠sys-net.it 02 Apr '07

02 Apr '07

quanah(a)stanford.edu wrote: >> I don't know if the people who are in charge to build a RPM are paying >> attention to what they are doing or not. >> >> You can do a man ldap_init, and then look at /usr/include/ldap.h for the >> function definition. >> >> I am not a LDAP expert or anything close to that. But it seems to me that >> function called ldap_init has already been replaced by the function called >> ldap_initialize, and they take even different set of parameters. >> >> And yet the manpage not only didn't reflect that change, but enforce the >> wrong idea of using ldap_init function by having ldap_init in manpages. >> >> An extremely poor job done by the package maintainer. > > Hi, > > I suggest you complain to RedHat if you don't like the way they've packaged > something. The OpenLDAP foundation is not responsible for the way in which > RedHat packages its releases. In any case, if you are taking the time to > read the header file, then pay close attention to the following: > > #if LDAP_DEPRECATED > LDAP_F( LDAP * ) > ldap_init LDAP_P(( /* deprecated, use ldap_create or ldap_initialize */ > LDAP_CONST char *host, > int port )); > > > I.e., ldap_init is a deprecated function, and ldap_initialize should be > used instead. However, there are many programs out there that still use > the old API, so the old functions are maintained for backwards > compatibility purposes. Hence the man page. I'd add that OpenLDAP is a voluntary based project, and volunteers devote their efforts to what they consider mostly important - typically writing good useful code that runs (fast). Man pages typically lag behind, but eventually they get updated/fixed (as they are in currently released code). If you cared so much about up-to-date code and man pages, you would be using the latest release, not a 15 months old one. And if you were able to infer the really useful API from ldap.h, you could have more proficiently spent your time by writing and submitting a useful man page, instead of just complaining quite unpolitely. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4902) ManPage in 2.3.19 RPM is completely screwed up
by quanah＠stanford.edu 02 Apr '07

02 Apr '07

--On Monday, April 02, 2007 5:23 PM +0000 wweng(a)kencast.com wrote: > Full_Name: Wei Weng > Version: 2.3.19 > OS: Linux(Fedora 5) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (69.120.101.108) > > > I don't know if the people who are in charge to build a RPM are paying > attention to what they are doing or not. > > You can do a man ldap_init, and then look at /usr/include/ldap.h for the > function definition. > > I am not a LDAP expert or anything close to that. But it seems to me that > function called ldap_init has already been replaced by the function called > ldap_initialize, and they take even different set of parameters. > > And yet the manpage not only didn't reflect that change, but enforce the > wrong idea of using ldap_init function by having ldap_init in manpages. > > An extremely poor job done by the package maintainer. Hi, I suggest you complain to RedHat if you don't like the way they've packaged something. The OpenLDAP foundation is not responsible for the way in which RedHat packages its releases. In any case, if you are taking the time to read the header file, then pay close attention to the following: #if LDAP_DEPRECATED LDAP_F( LDAP * ) ldap_init LDAP_P(( /* deprecated, use ldap_create or ldap_initialize */ LDAP_CONST char *host, int port )); I.e., ldap_init is a deprecated function, and ldap_initialize should be used instead. However, there are many programs out there that still use the old API, so the old functions are maintained for backwards compatibility purposes. Hence the man page. This ITS will be closed. Regards, Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

(ITS#4902) ManPage in 2.3.19 RPM is completely screwed up
by wweng＠kencast.com 02 Apr '07

02 Apr '07

Full_Name: Wei Weng Version: 2.3.19 OS: Linux(Fedora 5) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (69.120.101.108) I don't know if the people who are in charge to build a RPM are paying attention to what they are doing or not. You can do a man ldap_init, and then look at /usr/include/ldap.h for the function definition. I am not a LDAP expert or anything close to that. But it seems to me that function called ldap_init has already been replaced by the function called ldap_initialize, and they take even different set of parameters. And yet the manpage not only didn't reflect that change, but enforce the wrong idea of using ldap_init function by having ldap_init in manpages. An extremely poor job done by the package maintainer.

1 0

Re: (ITS#4901) malloc/free mismatches in ldapadd
by quanah＠stanford.edu 31 Mar '07

31 Mar '07

--On Saturday, March 31, 2007 12:54 AM +0000 quanah(a)stanford.edu wrote: > --On Friday, March 30, 2007 2:25 PM +0000 chris.ridd(a)isode.com wrote: > >> Full_Name: Chris Ridd >> Version: 2.3.34 >> OS: Windows >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (62.3.217.250) >> >> >> On Windows, it is important that mallocs done in one DLL are balanced by >> frees done from the same DLL. Failure to do this consistently leads to >> heap corruption. >> >> This was observed to occur in several places in ldapadd - several buffers >> allocated by ber_memfree() were freed using free(). >> >> Our customer has successfully used a version of ldapadd on Windows >> containing this patch (and the one in ITS 4900.) > > Thanks, testing. --- openldap-2.3.34/clients/tools/common.c.orig Fri Mar 30 15:17:32 2007 +++ openldap-2.3.34/clients/tools/common.c Fri Mar 30 15:21:42 2007 @@ -1244,7 +1244,7 @@ crit ? "critical " : "" ); } - free( ctrls ); + ldap_controls_free( ctrls ); if ( crit ) { exit( EXIT_FAILURE ); } Just to note, this part of the patch is bad. ctrls is a pointer to an array of controls, not an array of controls itself. Therefore, the use of "free" here is appropriate. Using ldap_controls_free results in segfaults. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4901) malloc/free mismatches in ldapadd
by quanah＠stanford.edu 31 Mar '07

31 Mar '07

--On Friday, March 30, 2007 2:25 PM +0000 chris.ridd(a)isode.com wrote: > Full_Name: Chris Ridd > Version: 2.3.34 > OS: Windows > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (62.3.217.250) > > > On Windows, it is important that mallocs done in one DLL are balanced by > frees done from the same DLL. Failure to do this consistently leads to > heap corruption. > > This was observed to occur in several places in ldapadd - several buffers > allocated by ber_memfree() were freed using free(). > > Our customer has successfully used a version of ldapadd on Windows > containing this patch (and the one in ITS 4900.) Thanks, testing. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4900) command-line utils crash
by quanah＠stanford.edu 31 Mar '07

31 Mar '07

--On Friday, March 30, 2007 2:09 PM +0000 chris.ridd(a)isode.com wrote: > Full_Name: Chris Ridd > Version: 2.3.34 > OS: Windows > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (62.3.217.250) > > > On Windows, the ldapadd tool often crashes while parsing the command-line > arguments. Hi Chris, We formally dropped support for MSVC a long time ago. That being said, working build of OpenLDAP was accomplished with MSVCC a few months ago without hitting this issue. Which version of MSVC is being used, and please doublecheck the conditions spelled out in the comments in <ldap_cdefs.h>, where it starts with "Support for Windows DLLs". Also, instead of declaring things as extern, does changing LDAP_LIBC_V to LDAP_LUTIL_V resolve your issue? --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

(ITS#4901) malloc/free mismatches in ldapadd
by chris.ridd＠isode.com 30 Mar '07

30 Mar '07

Full_Name: Chris Ridd Version: 2.3.34 OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (62.3.217.250) On Windows, it is important that mallocs done in one DLL are balanced by frees done from the same DLL. Failure to do this consistently leads to heap corruption. This was observed to occur in several places in ldapadd - several buffers allocated by ber_memfree() were freed using free(). Our customer has successfully used a version of ldapadd on Windows containing this patch (and the one in ITS 4900.) Patch follows: --- openldap-2.3.34/clients/tools/common.c.orig Fri Mar 30 15:17:32 2007 +++ openldap-2.3.34/clients/tools/common.c Fri Mar 30 15:21:42 2007 @@ -163,7 +163,7 @@ N_(" -n show what would be done but don't actually do it\n"), N_(" -O props SASL security properties\n"), N_(" -p port port on LDAP server\n"), -N_(" -P version procotol version (default: 3)\n"), +N_(" -P version protocol version (default: 3)\n"), N_(" -Q use SASL Quiet mode\n"), N_(" -R realm SASL realm\n"), N_(" -U authcid SASL authentication identity\n"), @@ -1244,7 +1244,7 @@ crit ? "critical " : "" ); } - free( ctrls ); + ldap_controls_free( ctrls ); if ( crit ) { exit( EXIT_FAILURE ); } --- openldap-2.3.34/clients/tools/ldapmodify.c.orig Fri Mar 30 15:19:34 2007 +++ openldap-2.3.34/clients/tools/ldapmodify.c Fri Mar 30 15:21:07 2007 @@ -389,8 +389,8 @@ fprintf( rejfp, "\n%s\n", rejbuf ); } - if (rejfp) free( rejbuf ); - free( rbuf ); + if (rejfp) ber_memfree( rejbuf ); + ber_memfree( rbuf ); } #ifdef LDAP_GROUP_TRANSACTION @@ -519,7 +519,7 @@ printf(_("%s: skipping change record for entry: %s\n"), prog, dn); printf(_("\t(LDAP host/port does not match replica: lines)\n")); - free( dn ); + ber_memfree( dn ); ber_memfree( type ); ber_memfree( val.bv_val ); return( 0 ); @@ -727,13 +727,13 @@ } if ( dn != NULL ) { - free( dn ); + ber_memfree( dn ); } if ( newrdn != NULL ) { - free( newrdn ); + ber_memfree( newrdn ); } if ( newsup != NULL ) { - free( newsup ); + ber_memfree( newsup ); } if ( pmods != NULL ) { ldap_mods_free( pmods, 1 );

1 0

(ITS#4900) command-line utils crash
by chris.ridd＠isode.com 30 Mar '07

30 Mar '07

Full_Name: Chris Ridd Version: 2.3.34 OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (62.3.217.250) On Windows, the ldapadd tool often crashes while parsing the command-line arguments. This is due to a defect in the way the optarg (et al) variables are declared in ac/unistd.h. When tools/common.c includes that file, the 4 variables end up being declared as being "imported" from a DLL. However they're *actually* present in a static archive that's linked into the ldapadd executable, which is apparently not the same sort of thing. (Visual Studio's compiler warns about inconsistent linkage :-) As a result, the code in getopt.c thinks that optarg is a variable at one address, and the code calling getopt() think that optarg is a variable at a *different* address (NULL in my test rig). Clearly that's not right, and it causes a variety of issues: -D <dn> copies optarg using strdup(NULL), which returns NULL. -w <passwd> scribbles over the passwd string, which crashes doing a *optarg because optarg is NULL. A simple fix is to redeclare the 4 variables as just "extern" instead of LDAP_LIBC_V. Diff follows... --- openldap-2.3.34/include/ac/unistd.h.orig Fri Mar 30 15:05:49 2007 +++ openldap-2.3.34/include/ac/unistd.h Fri Mar 30 15:06:10 2007 @@ -54,8 +54,8 @@ #else /* assume we need to declare these externs */ - LDAP_LIBC_V (char *) optarg; - LDAP_LIBC_V (int) optind, opterr, optopt; + extern char * optarg; + extern int optind, opterr, optopt; #endif /* use lutil file locking */

1 0

Re: (ITS#4890) Enhancement: Default Values overlay (patch)
by quanah＠stanford.edu 29 Mar '07

29 Mar '07

--On Thursday, March 22, 2007 5:25 PM +0000 docelic(a)mail.inet.hr wrote: > Full_Name: Davor Ocelic > Version: CVS-HEAD > OS: Linux > URL: http://www.hcoop.net/~docelic/openldap-slapd.overlays.defvals.patch > Submission from: (NULL) (213.147.110.16) > > > > Hello, > > Attached is a patch which adds a "Default Attribute Values" functionality > to OpenLDAP. It is implemented as an overlay named "defvals", and the > patch is done against cvs-head of today. > > Complete documentation is included in the slapo-defvals(5) manual page. > The overlay code itself is commented as well, as a help for others writing > overlays. > > Feel free to trim comments or improve code as you see fit. Hi Davor, I believe you'll need to complete the attribution bit detailed here: <http://www.openldap.org/devel/contributing.html> for this to be included. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4898) slapd crashes when no structural object class provided
by BLentz＠channing-bete.com 29 Mar '07

29 Mar '07

> --On Wednesday, March 28, 2007 8:45 PM +0000 blentz(a)channing-bete.com > wrote: > > ldbm is deprecated, and it is highly advised that it not be used. > Bugs with LDBM are unlikely to be fixed, and it has already been > removed from the 2.4 release. If you can reproduce this issue with > back-bdb, please follow up. > I've removed ldbm support, replacing it with bdb. Everything seems nice and stable now, and I can't reproduce the crashing with back-bdb.

1 0

Re: (ITS#4899) ITS4855 fix breaks 2.3.34
by quanah＠stanford.edu 29 Mar '07

29 Mar '07

--On Wednesday, March 28, 2007 11:43 PM +0000 hyc(a)symas.com wrote: > quanah(a)stanford.edu wrote: >> Full_Name: Quanah Gibson-Mount >> Version: 2.3.34 >> OS: Linux 2.6 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (171.66.35.82) >> >> >> I patched 2.3.34 with the patch in RE_23 for fixing the thread pool issue >> (ITS#4855) > > So really this is a bug in RE23, not 2.3.34, yes? True. :/ I was using my laptop, which is a bit more annoying to type, cut, and paste with than my normal system ;) --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4899) ITS4855 fix breaks 2.3.34
by hyc＠symas.com 29 Mar '07

29 Mar '07

quanah(a)stanford.edu wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3.34 > OS: Linux 2.6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (171.66.35.82) > > > I patched 2.3.34 with the patch in RE_23 for fixing the thread pool issue > (ITS#4855) So really this is a bug in RE23, not 2.3.34, yes? > <http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap_r/tpool.c.diff?r…> > > My patch being: > > ldap-uat00:/usr/local/build/PATCHES/openldap# cat ITS4855 > --- openldap-2.3.34/libraries/libldap_r/tpool.c.orig 2007-03-26 > 15:19:56.000000000 -0700 > +++ openldap-2.3.34/libraries/libldap_r/tpool.c 2007-03-26 15:20:20.000000000 > -0700 > @@ -664,7 +664,7 @@ > int i; > > for ( i=MAXKEYS-1; i>=0; i--) { > - if ( ctx[i].ltk_key ) > + if ( ctx[i].ltk_key == NULL ) > continue; > if ( ctx[i].ltk_free ) > ctx[i].ltk_free( ctx[i].ltk_key, ctx[i].ltk_data ); -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#4899) ITS4855 fix breaks 2.3.34
by quanah＠stanford.edu 29 Mar '07

29 Mar '07

Full_Name: Quanah Gibson-Mount Version: 2.3.34 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (171.66.35.82) I patched 2.3.34 with the patch in RE_23 for fixing the thread pool issue (ITS#4855) <http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap_r/tpool.c.diff?r…> My patch being: ldap-uat00:/usr/local/build/PATCHES/openldap# cat ITS4855 --- openldap-2.3.34/libraries/libldap_r/tpool.c.orig 2007-03-26 15:19:56.000000000 -0700 +++ openldap-2.3.34/libraries/libldap_r/tpool.c 2007-03-26 15:20:20.000000000 -0700 @@ -664,7 +664,7 @@ int i; for ( i=MAXKEYS-1; i>=0; i--) { - if ( ctx[i].ltk_key ) + if ( ctx[i].ltk_key == NULL ) continue; if ( ctx[i].ltk_free ) ctx[i].ltk_free( ctx[i].ltk_key, ctx[i].ltk_data ); Now when I shut down slapd, it core dumps: 1282 cache.c: No such file or directory. in cache.c (gdb) bt #0 bdb_locker_id_free (key=0x2aad2fe00628, data=0x39) at cache.c:1282 #1 0x00002aad2d0bef21 in ldap_pvt_thread_pool_context_reset (vctx=0x2aad2d1f2260) at tpool.c:670 #2 0x000000000044e07c in slap_destroy () at init.c:304 #3 0x00000000004159f9 in main (argc=3, argv=0x7fff7de07438) at main.c:874 If I remove the patch, there is no core dump. I see no additional related commits for this change. --Quanah

1 0

Re: (ITS#4898) slapd crashes when no structural object class provided
by quanah＠stanford.edu 28 Mar '07

28 Mar '07

--On Wednesday, March 28, 2007 8:45 PM +0000 blentz(a)channing-bete.com wrote: > Full_Name: Ben Lentz > Version: 2.3.34 > OS: Fedora Core 3 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (12.169.82.130) > > > Background: > This is a heavily modified RPM build of the 2.2.17 release which came > standard with Fedora Core 3. ldbm is deprecated, and it is highly advised that it not be used. Bugs with LDBM are unlikely to be fixed, and it has already been removed from the 2.4 release. If you can reproduce this issue with back-bdb, please follow up. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

(ITS#4898) slapd crashes when no structural object class provided
by blentz＠channing-bete.com 28 Mar '07

28 Mar '07

Full_Name: Ben Lentz Version: 2.3.34 OS: Fedora Core 3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (12.169.82.130) Background: This is a heavily modified RPM build of the 2.2.17 release which came standard with Fedora Core 3. Versions: OpenLDAP 2.3.34, gcc-3.4.4, glibc-2.3.6, db4-4.2.52 Build: ./configure --enable-ldbm -with-ldbm-api=berkeley --enable-bdb --enable-ldap --enable-meta --enable-monitor --enable-null --enable-rewrite --disable-shared --with-kerberos=k5only --with-cyrus-sasl Configuration: /etc/openldap/slapd.conf: database ldbm /usr/sbin/slapd -u ldap -h "ldap:///" -d 1 & Issue: Client executes something dumb, causing a "No structural object class" error: ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -w secret dn: dc=my-domain,dc=com objectClass: top objectClass: dcObject dc: my-domain ^D slapd output (crash): connection_get(10): got connid=0 connection_read(10): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 79 contents: ber_get_next do_add ber_scanf fmt ({m) ber: >>> dnPrettyNormal: <dc=my-domain,dc=com> <<< dnPrettyNormal: <dc=my-domain,dc=com>, <dc=my-domain,dc=com> ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: dn2entry_r: dn: "dc=my-domain,dc=com" => dn2id( "dc=my-domain,dc=com" ) => ldbm_cache_open( "dn2id.dbb", 73, 600 ) <= ldbm_cache_open (opened 0) <= dn2id NOID entry failed op attrs add: no structural object class provided (65) slapd: ../../../../servers/slapd/back-ldbm/cache.c:111: cache_return_entry_rw: Assertion `e->e_private != ((void *)0)' failed. [1]+ Aborted /usr/sbin/slapd -u ldap -h "ldap:///" -d 1 ldapadd output: adding new entry "dc=my-domain,dc=com" ldap_result: Can't contact LDAP server (-1) Is there something wrong with my build or runtime environment that would cause this? I am mostly concerned that this is a "minor security issue", e.g. server bugs which clients can use to deny services to others. I am looking to upgrade several production servers from 2.2.17 to 2.3.34 and need to ensure that things are as stable as possible beforehand. I can provide more detailed information (versions, straces, cores, etc.) upon request. Thanks for any insight you can provide.

1 0

(ITS#4897) admin-guide 11.3.3.2. Policy Configuration confuses "from" and "to"
by mb＠computer-leipzig.com 28 Mar '07

28 Mar '07

Full_Name: Michael Bunk Version: 2.3.30 OS: Linux URL: Submission from: (NULL) (84.185.166.80) Wrong: "This directive can be set to none for no rules (the default), from for source rules, to for destination rules, or both for both source and destination rules." Correct: "This directive can be set to none for no rules (the default), to for source rules, from for destination rules, or both for both source and destination rules." This bug is present in http://www.openldap.org/doc/admin23/sasl.html and in revision 1.34.2.2 (HEAD at this moment) of admin/sasl.sdf.

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by ando＠sys-net.it 27 Mar '07

27 Mar '07

Michael Ströder wrote: > Pierangelo Masarati wrote: >> michael(a)stroeder.com wrote: >> >>> bdb_idl_fetch_key: [5941c014] >>> <= bdb_index_read: failed (-30989) >> ^^^ >> >> $ grep 30989 dn.h >> #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ >> >> I guess something strange is going on with libdb run-time loading... > > Well, it seems you were right. Strange that make test did not reveal any > problems (AFAICS). You can close that for now. I guess it's mostly because make test never uses SASL (the only case I know of is test028 if you explicitly force it by setting SLAPD_USE_SASL). Cheers, p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 27 Mar '07

27 Mar '07

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: > >> bdb_idl_fetch_key: [5941c014] >> <= bdb_index_read: failed (-30989) > > ^^^ > > $ grep 30989 dn.h > #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ > > I guess something strange is going on with libdb run-time loading... Well, it seems you were right. Strange that make test did not reveal any problems (AFAICS). You can close that for now. Ciao, Michael.

1 0

Re: (ITS#4894) Connection refused
by bgmilne＠staff.telkomsa.net 27 Mar '07

27 Mar '07

--nextPart1606934.cSND5gyAuy Content-Type: text/plain; charset="iso-8859-6" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Monday 26 March 2007, mcar_bhim(a)rediffmail.com wrote: > Full_Name: Mukesh > Version: v 1.8.8.7 > OS: Microsoft Windows XP Profesional Version 2002 Service Pack 2 > URL: > Submission from: (NULL) (164.151.129.37) > > > When authenticating user through LDAP "Connection to LDAP could not be > opened. Login of user failed:" appears suddenly. This doesnot happen > regularly but suddenly slapd crash down. To avoid this we open 30 in a day > and at the end of the day we see that only 5 instances are only running. You need to provide a lot more information on this. We are doing millions of authentications per day without any problems. You should provide at least: 1)What software you are reporting this on (I am not aware of a version 1.8.= 8.7=20 of OpenLDAP) 2)Some configuration details, e.g. a sanitized slapd.conf 3)Some means of reproducing the problem with a generic (e.g. OpenLDAP=20 commandline) client =2D-=20 Buchan Milne ISP Systems Specialist - Monitoring/Authentication Team Leader B.Eng,RHCE(803004789010797),LPIC-2(LPI000074592) --nextPart1606934.cSND5gyAuy Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQBGCQ31rJK6UGDSBKcRAnZAAJ9YPnPpJewNa4xNZNWaFCbIExTB4ACfUSud +If/rn2ZlB9kj3nh7nEbE88= =HnKz -----END PGP SIGNATURE----- --nextPart1606934.cSND5gyAuy--

1 0

Re: (ITS#4896) overlay auditlog not working in 2.3.34
by bgmilne＠staff.telkomsa.net 27 Mar '07

27 Mar '07

--nextPart1454941.Kjy3Wla0Ym Content-Type: text/plain; charset="iso-8859-6" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Tuesday 27 March 2007, atmp(a)yandex.ru wrote: > Full_Name: Artyom > Version: 2.3.34 > OS: linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.234.190.5) > > > In 2.3.34 overlay auditlog command is not working. > Sample slapd.conf: > ------ > loglevel any > database dbd > suffix ... > overlay auditlog /tmp/audit.log > ------- > Log file records > ------- > line XX: <overlay> extra cruft after <overlay> ignored. > ------- > > No any records will be placed in /tmp/audit.log file in case of > append/modify operations. Please see the man page for slapo-auditlog. Then, correct your configuratio= n.=20 E.g.: database dbd suffix ... overlay auditlog auditlog /tmp/audit.log I am using auditlog in production with 2.3.34. I am sure someone with sufficient rights will close this ITS. Please use th= e=20 OpenLDAP-software mailing list for configuration finger-trouble. Regards, Buchan =2D-=20 Buchan Milne ISP Systems Specialist - Monitoring/Authentication Team Leader B.Eng,RHCE(803004789010797),LPIC-2(LPI000074592) --nextPart1454941.Kjy3Wla0Ym Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQBGCQCurJK6UGDSBKcRAiLHAKDIrC1WGqNud9iaeRgYy+iespmy5wCgqaN5 YdTAysCusHYIcCuPRzq2mWQ= =92Px -----END PGP SIGNATURE----- --nextPart1454941.Kjy3Wla0Ym--

1 0

(ITS#4896) overlay auditlog not working in 2.3.34
by atmp＠yandex.ru 27 Mar '07

27 Mar '07

Full_Name: Artyom Version: 2.3.34 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.234.190.5) In 2.3.34 overlay auditlog command is not working. Sample slapd.conf: ------ loglevel any database dbd suffix ... overlay auditlog /tmp/audit.log ------- Log file records ------- line XX: <overlay> extra cruft after <overlay> ignored. ------- No any records will be placed in /tmp/audit.log file in case of append/modify operations.

1 0

(ITS#4895) overlay auditlog not working in 2.3.34
by atmp＠yandex.ru 27 Mar '07

27 Mar '07

Full_Name: Version: 2.3.34 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.234.190.5) In 2.3.34 overlay auditlog command is not working. Sample slapd.conf: ------ loglevel any database dbd suffix ... overlay auditlog /tmp/audit.log ------- Log file records ------- line XX: <overlay> extra cruft after <overlay> ignored. ------- No any records will be placed in /tmp/audit.log file in case of append/modify operations.

1 0

(ITS#4894) Connection refused
by mcar_bhim＠rediffmail.com 26 Mar '07

26 Mar '07

Full_Name: Mukesh Version: v 1.8.8.7 OS: Microsoft Windows XP Profesional Version 2002 Service Pack 2 URL: Submission from: (NULL) (164.151.129.37) When authenticating user through LDAP "Connection to LDAP could not be opened. Login of user failed:" appears suddenly. This doesnot happen regularly but suddenly slapd crash down. To avoid this we open 30 in a day and at the end of the day we see that only 5 instances are only running.

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 23 Mar '07

23 Mar '07

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: > >> bdb_idl_fetch_key: [5941c014] >> <= bdb_index_read: failed (-30989) > > ^^^ > > $ grep 30989 dn.h > #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ > > I guess something strange is going on with libdb run-time loading... Hmm, could be because the SASL RPM is built against db 4.4.20 and OpenLDAP is built against BDB 4.5.20 in /opt/bdb-4.5. I'll check that. Ciao, Michael.

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by ando＠sys-net.it 23 Mar '07

23 Mar '07

michael(a)stroeder.com wrote: > bdb_idl_fetch_key: [5941c014] > <= bdb_index_read: failed (-30989) ^^^ $ grep 30989 dn.h #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ I guess something strange is going on with libdb run-time loading... p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: Tranlucent Overlay (ITS#4889)
by ghenry＠suretecsystems.com 23 Mar '07

23 Mar '07

<quote who="Howard Chu"> > Gavin Henry wrote: >> <quote who="Howard Chu"> >>> Gavin Henry wrote: >>>> <quote who="hyc(a)symas.com"> >>>>> Curious that your opening log says "No dynamic config support for >>>>> database bdb." Are you sure you have a clean install here? >>>> I thought that was weird to. This was setup on my laptop, no OpenLDAP >>>> from >>>> rpm or source ever installed. Fresh 2.3.34 and db-4.2.52 (5 patches). >>> Yeah, false alarm. The presence of the rwm overlay taints the entire >>> stack. >> >> Isn't this because translucent doesn't support dynamic config, so >> disables >> bdb dynamic config? >> >> Everything is now working, with no crashes without rwm. >> >> I've not had chance to test HEAD yet. > > Translucent does support dynamic config, but rwm doesn't. Not in 2.3.34 as I understand it. translucent.c doesn't have and olc* things anyway. > > -- > -- Howard Chu > Chief Architect, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

1 0

Re: Tranlucent Overlay (ITS#4889)
by hyc＠symas.com 23 Mar '07

23 Mar '07

Gavin Henry wrote: > <quote who="Howard Chu"> >> Gavin Henry wrote: >>> <quote who="hyc(a)symas.com"> >>>> Curious that your opening log says "No dynamic config support for >>>> database bdb." Are you sure you have a clean install here? >>> I thought that was weird to. This was setup on my laptop, no OpenLDAP >>> from >>> rpm or source ever installed. Fresh 2.3.34 and db-4.2.52 (5 patches). >> Yeah, false alarm. The presence of the rwm overlay taints the entire >> stack. > > Isn't this because translucent doesn't support dynamic config, so disables > bdb dynamic config? > > Everything is now working, with no crashes without rwm. > > I've not had chance to test HEAD yet. Translucent does support dynamic config, but rwm doesn't. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Tranlucent Overlay (ITS#4889)
by ghenry＠suretecsystems.com 23 Mar '07

23 Mar '07

<quote who="Howard Chu"> > Gavin Henry wrote: >> <quote who="hyc(a)symas.com"> > >>> Curious that your opening log says "No dynamic config support for >>> database bdb." Are you sure you have a clean install here? >> >> I thought that was weird to. This was setup on my laptop, no OpenLDAP >> from >> rpm or source ever installed. Fresh 2.3.34 and db-4.2.52 (5 patches). > > Yeah, false alarm. The presence of the rwm overlay taints the entire > stack. Isn't this because translucent doesn't support dynamic config, so disables bdb dynamic config? Everything is now working, with no crashes without rwm. I've not had chance to test HEAD yet. Gavin. > > -- > -- Howard Chu > Chief Architect, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 22 Mar '07

22 Mar '07

Debug output related to this: ---------------------------- `slapd -d 255` --------------------------- daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 busy >>> >>> slap_listener(ldapi://%2fhome%2fmichael%2fBizness%2fOpenLDAP%2fODD_2006%2fslapd-socket) daemon: listen=8, new connection on 15 daemon: added 15r (active) listener=(nil) daemon: activity on 2 descriptors daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=0 connection_read(15): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 18 02 01 01 60 13 02 0....`.. ldap_read: want=18, got=18 0000: 01 03 04 00 a3 0c 04 08 45 58 54 45 52 4e 41 4c ........EXTERNAL 0010: 04 00 .. ber_get_next: tag 0x30 len 24 contents: ber_dump: buf=0x08247cb0 ptr=0x08247cb0 end=0x08247cc8 len=24 0000: 02 01 01 60 13 02 01 03 04 00 a3 0c 04 08 45 58 ...`..........EX 0010: 54 45 52 4e 41 4c 04 00 TERNAL.. ber_get_next ldap_read: want=8 error=Resource temporarily unavailable do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cb3 end=0x08247cc8 len=21 0000: 60 13 02 01 03 04 00 a3 0c 04 08 45 58 54 45 52 `..........EXTER 0010: 4e 41 4c 04 00 NAL.. ber_scanf fmt ({m) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cba end=0x08247cc8 len=14 0000: 00 0c 04 08 45 58 54 45 52 4e 41 4c 04 00 ....EXTERNAL.. ber_scanf fmt (m) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cc6 end=0x08247cc8 len=2 0000: 00 00 .. ber_scanf fmt (}}) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cc8 end=0x08247cc8 len=0 >>> >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_sasl_bind: dn () mech EXTERNAL ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 SASL Canonicalize [conn=0]: authcid="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" slap_sasl_getdn: conn 0 id=gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth [len=59] ==>slap_sasl2dn: converting SASL name gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth to a DN ==> rewrite_context_apply [depth=1] string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' ==> rewrite_rule_apply rule='gidnumber=([0-9]+)\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth' string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))'} [rw] authid: "gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" -> "ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" slap_parseURI: parsing ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)) ldap_url_parse_ext(ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))) str2filter "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" put_filter: "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" put_filter: AND put_filter_list "(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)" put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" put_filter: "(uidNumber=500)" put_filter: simple put_simple_filter: "uidNumber=500" put_filter: "(gidNumber=100)" put_filter: simple put_simple_filter: "gidNumber=100" begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb1f76154 ptr=0xb1f76156 end=0xb1f76197 len=65 0000: a3 1b 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 ....objectClass. 0010: 0c 70 6f 73 69 78 41 63 63 6f 75 6e 74 a3 10 04 .posixAccount... 0020: 09 75 69 64 4e 75 6d 62 65 72 04 03 35 30 30 a3 .uidNumber..500. 0030: 10 04 09 67 69 64 4e 75 6d 62 65 72 04 03 31 30 ...gidNumber..10 0040: 30 0 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb1f76154 ptr=0xb1f76173 end=0xb1f76197 len=36 0000: 00 10 04 09 75 69 64 4e 75 6d 62 65 72 04 03 35 ....uidNumber..5 0010: 30 30 a3 10 04 09 67 69 64 4e 75 6d 62 65 72 04 00....gidNumber. 0020: 03 31 30 30 .100 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb1f76154 ptr=0xb1f76185 end=0xb1f76197 len=18 0000: 00 10 04 09 67 69 64 4e 75 6d 62 65 72 04 03 31 ....gidNumber..1 0010: 30 30 00 end get_filter 0 end get_filter_list end get_filter 0 >>> >>> dnNormalize: <ou=Users,ou=odd2006,dc=block-floete,dc=de> => ldap_bv2dn(ou=Users,ou=odd2006,dc=block-floete,dc=de,0) <= ldap_bv2dn(ou=Users,ou=odd2006,dc=block-floete,dc=de)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=users,ou=odd2006,dc=block-floete,dc=de)=0 <<< dnNormalize: <ou=users,ou=odd2006,dc=block-floete,dc=de> slap_sasl2dn: performing internal search (base=ou=users,ou=odd2006,dc=block-floete,dc=de, scope=2) => hdb_search bdb_dn2entry("ou=users,ou=odd2006,dc=block-floete,dc=de") entry_decode: "" <= entry_decode() => access_allowed: auth access to "ou=Users,ou=odd2006,dc=block-floete,dc=de" "entry" requested => dn: [4] ou=users,ou=odd2006,dc=block-floete,dc=de => acl_get: [4] matched => acl_get: [4] attr entry => acl_mask: access to entry "ou=Users,ou=odd2006,dc=block-floete,dc=de", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [2] applying read(=rscxd) (stop) <= acl_mask: [2] mask: read(=rscxd) => slap_access_allowed: auth access granted by read(=rscxd) => access_allowed: auth access granted by read(=rscxd) search_candidates: base="ou=users,ou=odd2006,dc=block-floete,dc=de" (0x00000002) scope=2 => hdb_dn2idl("ou=users,ou=odd2006,dc=block-floete,dc=de") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [5941c014] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=0 last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=0 last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=2 last=0 <= bdb_filter_candidates: id=0 first=2 last=0 bdb_search_candidates: id=0 first=2 last=0 hdb_search: no candidates send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=0 matched="" text="" <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=0]: slapAuthcDN="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" ./start-slapd.sh: line 12: 4310 Segmentation fault ${OPENLDAP_PREFIX}/libexec/slapd -d 255 -h "ldap://0.0.0.0:2006 ldapi://%2fhome%2fmichael%2fBizness%2fOpenLDAP%2fODD_2006%2fslapd-socket" -n slapd-odd2006 -u michael -o slp=off -f ${LOCALCONFIG}/slapd.conf

1 0

Re: Tranlucent Overlay (ITS#4889)
by hyc＠symas.com 22 Mar '07

22 Mar '07

ando(a)sys-net.it wrote: > ghenry(a)suretecsystems.com wrote: > >> That's strange though, as I merely followed the slapd-ldap(5) man page: > > Slapo-rwm(5) works just fine by itself; the point is that when it was > designed there was no cleanup hook in the callback structure, so it was > __permmently replacing__ the original values of request DN and DN-valued > attributes instead of __temporarily replace__ them and set the original > values back when done. So it interacts poorly with other, more recent > overlays. Given that this particular rwm invocation isn't doing anything, it should be easy enough to just comment it out and see if the problem still occurs. Curious that your opening log says "No dynamic config support for database bdb." Are you sure you have a clean install here? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Tranlucent Overlay (ITS#4889)
by ando＠sys-net.it 22 Mar '07

22 Mar '07

ghenry(a)suretecsystems.com wrote: > That's strange though, as I merely followed the slapd-ldap(5) man page: Slapo-rwm(5) works just fine by itself; the point is that when it was designed there was no cleanup hook in the callback structure, so it was __permmently replacing__ the original values of request DN and DN-valued attributes instead of __temporarily replace__ them and set the original values back when done. So it interacts poorly with other, more recent overlays. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4888) Enhance back-sql with paged results
by ando＠sys-net.it 22 Mar '07

22 Mar '07

adamson(a)andrew.cmu.edu wrote: > When I checked on the patch file in my Emacs window this morning I saw the > "modified buffer" flag was still on because I hadn't saved the final > version. Grrrr. It included the function declarations and one last fix. > Sorry about that. :) > When I extract the last ID number from the cookie, I > have to make sure we're in the same objectClass as when the ID number was > saved. > I've replaced the patch file on my web server. If it doesn't fix the > root entry bug you're seeing, could you show me the search you're > performing? I'll have to more closely follow what's happening in the > switch ( bsi.bsi_scope ) { > segment around line 2115 in backsql_search() to see if there is some > special case for the root entry. It works now, thanks. I'll commit the patch, but I think we should definitely move the cookie stuff to the frontend and generalize the cookie stuff to use bervals before we close this ITS. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: Tranlucent Overlay (ITS#4889)
by ghenry＠suretecsystems.com 22 Mar '07

22 Mar '07

<quote who="Pierangelo Masarati"> > In re23 slapo-rwm should not be used in conjunction with other overlays; > there > is a number of reports about interoperability issues, and only recently > Howard > fixed (I should say "reworked") it in HEAD/re24. Can you reproduce the > same > issue with HEAD? Will do later this week. That's strange though, as I merely followed the slapd-ldap(5) man page: suffixmassage, map, rewrite* These directives are no longer supported by back-ldap; their functionality is now delegated to the rwm overlay. Essentially, add a statement overlay rwm first, and prefix all rewrite/map statements with rwm- to obtain the original behavior. See slapo-rwm(5) for details. Maybe a man page patch is needed to stop others hitting this. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: (ITS#4876) Multiple levels of uniqueness
by hyc＠symas.com 22 Mar '07

22 Mar '07

quanah(a)stanford.edu wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3.33 > OS: NA > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (171.64.19.81) > > > In using the uniqueness overlay, I found there are times I want to apply > uniqueness rules differently based on (sub)tree. For example, I might like > something along these lines where the db starts at dc=stanford,dc=edu: The unique overlay in HEAD now supports this functionality. See the updated manpage. test024 has also been updated accordingly, if you need examples. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 22 Mar '07

22 Mar '07

Full_Name: Michael Ströder Version: HEAD OS: openSUSE 10.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.124.31.177) HI! slapd.conf contains (identiation and line-wrapping may be screwed up: # EXTERNAL over Unix Domain socket authz-regexp "gidnumber=([0-9]+)\\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth" "ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=$2)(gidNumber=$1))" Ciao, Michael. $ ldapwhoami -H ldapi://%2fhome%2fmichael%2fBizness%2fOpenLDAP%2fODD_2006%2fslapd-socket -Y EXTERNAL SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

1 0

(ITS#4891) OpenLDAP with dynlist crash
by socrtp-ldap＠soclab.eu.org 22 Mar '07

22 Mar '07

Full_Name: Piotr Stolc Version: 2.3.34 OS: Gentoo, NetBSD URL: http://lysergic.soclab.eu.org/dynlist-bug.ldif Submission from: (NULL) (195.8.99.234) I found this bug while trying to run OpenLDAP with dynlist overlay and my own schema. The functionality of dynlist overlay works ok, but when browsing LDAP tree with PHPLDAPAdmin the server dies. I spent a few hours debugging the problem (accesslog overlay is cool :)) and created simple sample entries using default schemas. Here is what I have found: OpenLDAP server dies on this query: $ ldapsearch -D cn=Manager,dc=test,dc=pl -W -x -h 10.1.1.15 -b dc=test,dc=pl -s one dn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=test,dc=pl> with scope oneLevel # filter: (objectclass=*) # requesting: dn # # Manager, test.pl dn: cn=Manager,dc=test,dc=pl # testGroup, test.pl dn: ou=testGroup,dc=test,dc=pl ldap_result: Can't contact LDAP server (-1) It has also problem with another query - one of the slapd processes locks up with nearly 100% CPU usage: $ ldapsearch -D cn=Manager,dc=test,dc=pl -W -x -h 10.1.1.15 -b cn=testList,dc=test,dc=pl -s one mail The following query works fine and shows that dynlist overlay is working: $ ldapsearch -D cn=Manager,dc=test,dc=pl -W -x -h 10.1.1.15 -b cn=testList,dc=test,dc=pl mail The problem shows up with the latest stable version of OpenLDAP 2.3.34 on Gentoo Linux and with OpenLDAP 2.3.32 on NetBSD. I've pasted into URL field link to the LDIF with the sample dc=test,dc=pl structure that shows the error. Here is the config for "dc=test,dc=pl" I've used: database bdb suffix "dc=test,dc=pl" rootdn "cn=Manager,dc=test,dc=pl" rootpw secret directory /var/lib/openldap-data-test index cn eq overlay dynlist dynlist-attrset groupOfURLs memberURL

1 0

(ITS#4890) Enhancement: Default Values overlay (patch)
by docelic＠mail.inet.hr 22 Mar '07

22 Mar '07

Full_Name: Davor Ocelic Version: CVS-HEAD OS: Linux URL: http://www.hcoop.net/~docelic/openldap-slapd.overlays.defvals.patch Submission from: (NULL) (213.147.110.16) Hello, Attached is a patch which adds a "Default Attribute Values" functionality to OpenLDAP. It is implemented as an overlay named "defvals", and the patch is done against cvs-head of today. Complete documentation is included in the slapo-defvals(5) manual page. The overlay code itself is commented as well, as a help for others writing overlays. Feel free to trim comments or improve code as you see fit. Davor Ocelic

1 0

Re: (ITS#4888) Enhance back-sql with paged results
by adamson＠andrew.cmu.edu 22 Mar '07

22 Mar '07

Hi Pierangelo > Let me note that the patch doesn't build fine (you need to declare in > advance the static functions you're only defining at the end), and it > seems to work incorrectly. By running the simple sql-test000 with mysql > (which fails because now the order has changed; my fault: should have > added -S "" to searches), if I search without the control, I correctly > get 6 entries and a referral; if I search with paged results and a page > size less than 6, I only get 5 entries. The root entry is missing, but > I have no idea of the reason, I couldn't infer anything from the code or > the logs. Can you check? When I checked on the patch file in my Emacs window this morning I saw the "modified buffer" flag was still on because I hadn't saved the final version. Grrrr. It included the function declarations and one last fix. Sorry about that. When I extract the last ID number from the cookie, I have to make sure we're in the same objectClass as when the ID number was saved. I've replaced the patch file on my web server. If it doesn't fix the root entry bug you're seeing, could you show me the search you're performing? I'll have to more closely follow what's happening in the switch ( bsi.bsi_scope ) { segment around line 2115 in backsql_search() to see if there is some special case for the root entry. -Mark Adamson Carnegie Mellon

1 0

(ITS#4889) Tranlucent Overlay
by ghenry＠suretecsystems.com 22 Mar '07

22 Mar '07

Full_Name: Gavin Henry Version: 2.3.34 OS: FC6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.229.93.1) Dear All, Just been playing iwth slapo-translucent, and ldapmodified an entry on the remote side successfully. However, when I search for that entry, after the first or second search, slapd aborts. I merely changed a birthday and title for my own ghenry entry Here my slapd.conf: ------------------------- include /usr/local/etc/openldap/schema/core.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb.la moduleload back_ldap.la moduleload translucent.la moduleload rwm.la database bdb directory /usr/local/var/openldap-data cachesize 10000 suffix "dc=suretecsystems,dc=com" rootdn "cn=manager,dc=suretecsystems,dc=com" rootpw secret index default eq index objectClass,uid,dc,o,ou overlay translucent overlay rwm uri ldap://192.168.10.103:389 lastmod off idassert-bind binddn="cn=manager,dc=suretecsystems,dc=com" credentials=secret rwm-map objectclass * * rwm-map attribute * * ------------------------- Using db-4.2.52 and the 5 patches. He's a gdb session: [Thread debugging using libthread_db enabled] [New Thread -1209051456 (LWP 4529)] @(#) $OpenLDAP: slapd 2.3.34 (Mar 20 2007 14:53:32) $ ghenry@suretec:/home/ghenry/openldap/openldap-2.3.34/servers/slapd WARNING: No dynamic config support for database bdb. WARNING: No dynamic config support for overlay rwm. WARNING: No dynamic config support for overlay translucent. bdb_db_open: unclean shutdown detected; attempting recovery. slapd starting [New Thread -1547441264 (LWP 4532)] conn=0 fd=15 ACCEPT from IP=127.0.0.1:33269 (IP=0.0.0.0:389) [New Thread -1557931120 (LWP 4534)] conn=0 op=0 BIND dn="" method=128 conn=0 op=0 RESULT tag=97 err=0 text= [New Thread -1569473648 (LWP 4535)] conn=0 op=1 SRCH base="dc=suretecsystems,dc=com" scope=2 deref=0 filter="(uid=ghenry)" request done: ld 0x8e0dd10 msgid 1 request done: ld 0x8e0dd10 msgid 2 conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=0 op=2 UNBIND conn=0 fd=15 closed *** glibc detected *** /usr/local/libexec/slapd: corrupted double-linked list: 0x08e19458 *** ======= Backtrace: ========= /lib/libc.so.6[0xb0448b] /lib/libc.so.6[0xb066f3] /lib/libc.so.6(__libc_calloc+0x8d)[0xb07bdd] /lib/libc.so.6(open_memstream+0x5d)[0xafce7d] /lib/libc.so.6(__vsyslog_chk+0x76)[0xb69656] /lib/libc.so.6(syslog+0x2a)[0xb69bfa] /usr/local/libexec/slapd[0x80687e5] /usr/local/libexec/slapd[0x8068c9c] /usr/local/lib/libldap_r-2.3.so.0[0x11b56d] /lib/libpthread.so.0[0xc133db] /lib/libc.so.6(clone+0x5e)[0xb6d26e] ======= Memory map: ======== 00110000-00148000 r-xp 00000000 fd:00 10953537 /usr/local/lib/libldap_r-2.3.so.0.2.22 00148000-0014a000 rwxp 00037000 fd:00 10953537 /usr/local/lib/libldap_r-2.3.so.0.2.22 0014a000-0014f000 rwxp 0014a000 00:00 0 0014f000-0015a000 r-xp 00000000 fd:00 10953351 /usr/local/lib/liblber-2.3.so.0.2.22 0015a000-0015b000 rwxp 0000a000 fd:00 10953351 /usr/local/lib/liblber-2.3.so.0.2.22 0015b000-0015f000 r-xp 00000000 fd:00 11025778 /usr/lib/sasl2/libcrammd5.so.2.0.22 0015f000-00160000 rwxp 00003000 fd:00 11025778 /usr/lib/sasl2/libcrammd5.so.2.0.22 00160000-0023b000 r-xp 00000000 fd:00 11031861 /usr/lib/sasl2/libsasldb.so.2.0.22 0023b000-0023d000 rwxp 000db000 fd:00 11031861 /usr/lib/sasl2/libsasldb.so.2.0.22 0023d000-00251000 r-xp 00000000 fd:00 820357 /usr/local/libexec/openldap/back_ldap-2.3.so.0.2.22 00251000-00253000 rwxp 00013000 fd:00 820357 /usr/local/libexec/openldap/back_ldap-2.3.so.0.2.22 00253000-0025e000 r-xp 00000000 fd:00 2290131 /lib/libgcc_s-4.1.1-20070105.so.1 0025e000-0025f000 rwxp 0000a000 fd:00 2290131 /lib/libgcc_s-4.1.1-20070105.so.1 0027c000-00282000 r-xp 00000000 fd:00 10928729 /usr/lib/libltdl.so.3.1.4 00282000-00283000 rwxp 00005000 fd:00 10928729 /usr/lib/libltdl.so.3.1.4 002e2000-002e9000 r-xp 00000000 fd:00 10929498 /usr/lib/libwrap.so.0.7.6 002e9000-002ea000 rwxp 00007000 fd:00 10929498 /usr/lib/libwrap.so.0.7.6 002ea000-003a5000 r-xp 00000000 fd:00 393521 /usr/local/BerkeleyDB.4.2/lib/libdb-4.2.so 003a5000-003a7000 rwxp 000bb000 fd:00 393521 /usr/local/BerkeleyDB.4.2/lib/libdb-4.2.so 003f3000-003fc000 r-xp 00000000 fd:00 2289320 /lib/libnss_files-2.5.so 003fc000-003fd000 r-xp 00008000 fd:00 2289320 /lib/libnss_files-2.5.so 003fd000-003fe000 rwxp 00009000 fd:00 2289320 /lib/libnss_files-2.5.so 004ca000-004ce000 r-xp 00000000 fd:00 11028143 /usr/lib/sasl2/liblogin.so.2.0.22 004ce000-004cf000 rwxp 00003000 fd:00 11028143 /usr/lib/sasl2/liblogin.so.2.0.22 00504000-00528000 r-xp 00000000 fd:00 820345 /usr/local/libexec/openldap/back_bdb-2.3.so.0.2.22 00528000-00529000 rwxp 00024000 fd:00 820345 /usr/local/libexec/openldap/back_bdb-2.3.so.0.2.22 00529000-00535000 rwxp 00529000 00:00 0 00695000-00696000 r-xp 00695000 00:00 0 [vdso] 0071d000-00721000 r-xp 00000000 fd:00 820437 /usr/local/libexec/openldap/translucent-2.3.so.0.2.22 00721000-00722000 rwxp 00003000 fd:00 820437 /usr/local/libexec/openldap/translucent-2.3.so.0.2.22 007fe000-00809000 r-xp 00000000 fd:00 11025782 /usr/lib/sasl2/libdigestmd5.so.2.0.22 00809000-0080a000 rwxp 0000b000 fd:00 11025782 /usr/lib/sasl2/libdigestmd5.so.2.0.22 00916000-00929000 r-xp 00000000 fd:00 2290139 /lib/libnsl-2.5.so 00929000-0092a000 r-xp 00012000 fd:00 2290139 /lib/libnsl-2.5.so 0092a000-0092b000 rwxp 00013000 fd:00 2290139 /lib/libnsl-2.5.so 0092b000-0092d000 rwxp 0092b000 00:00 0 0092f000-0093e000 r-xp 00000000 fd:00 2290132 /lib/libresolv-2.5.so 0093e000-0093f000 r-xp 0000e000 fd:00 2290132 /lib/libresolv-2.5.so 0093f000-00940000 rwxp 0000f000 fd:00 2290132 /lib/libresolv-2.5.so 00940000-00942000 rwxp 00940000 00:00 0 0099a000-0099e000 r-xp 00000000 fd:00 11021253 /usr/lib/sasl2/libanonymous.so.2.0.22 0099e000-0099f000 rwxp 00003000 fd:00 11021253 /usr/lib/sasl2/libanonymous.so.2.0.22 009a5000-009a7000 r-xp 00000000 fd:00 2290133 /lib/libcom_err.so.2.1 009a7000-009a8000 rwxp 00001000 fd:00 2290133 /lib/libcom_err.so.2.1 009aa000-00a2e000 r-xp 00000000 fd:00 10928447 /usr/lib/libkrb5.so.3.2 00a2e000-00a30000 rwxp 00084000 fd:00 10928447 /usr/lib/libkrb5.so.3.2 00a32000-00a39000 r-xp 00000000 fd:00 10928445 /usr/lib/libkrb5support.so.0.1 00a39000-00a3a000 rwxp 00006000 fd:00 10928445 /usr/lib/libkrb5support.so.0.1 00a3c000-00a61000 r-xp 00000000 fd:00 10928446 /usr/lib/libk5crypto.so.3.0 00a61000-00a62000 rwxp 00025000 fd:00 10928446 /usr/lib/libk5crypto.so.3.0 00a83000-00a9c000 r-xp 00000000 fd:00 2289282 /lib/ld-2.5.so 00a9c000-00a9d000 r-xp 00018000 fd:00 2289282 /lib/ld-2.5.so 00a9d000-00a9e000 rwxp 00019000 fd:00 2289282 /lib/ld-2.5.so 00aa0000-00bd7000 r-xp 00000000 fd:00 2289319 /lib/libc-2.5.so 00bd7000-00bd9000 r-xp 00137000 fd:00 2289319 /lib/libc-2.5.so 00bd9000-00bda000 rwxp 00139000 fd:00 2289319 /lib/libc-2.5.so 00bda000-00bdd000 rwxp 00bda000 00:00 0 00c08000-00c0a000 r-xp 00000000 fd:00 2289374 /lib/libdl-2.5.so 00c0a000-00c0b000 r-xp 00001000 fd:00 2289374 /lib/libdl-2.5.so 00c0b000-00c0c000 rwxp 00002000 fd:00 2289374 /lib/libdl-2.5.so 00c0e000-00c21000 r-xp 00000000 fd:00 2289321 /lib/libpthread-2.5.so 00c21000-00c22000 r-xp 00012000 fd:00 2289321 /lib/libpthread-2.5.so 00c22000-00c23000 rwxp 00013000 fd:00 2289321 /lib/libpthread-2.5.so 00c23000-00c25000 rwxp 00c23000 00:00 0 00c27000-00c39000 r-xp 00000000 fd:00 10928409 /usr/lib/libz.so.1.2.3 00c39000-00c3a000 rwxp 00011000 fd:00 10928409 /usr/lib/libz.so.1.2.3 00c49000-00c51000 r-xp 00000000 fd:00 820429 /usr/local/libexec/openldap/rwm-2.3.so.0.2.22 00c51000-00c52000 rwxp 00008000 fd:00 820429 /usr/local/libexec/openldap/rwm-2.3.so.0.2.22 00da4000-00da8000 r-xp 00000000 fd:00 11028147 /usr/lib/sasl2/libplain.so.2.0.22 00da8000-00da9000 rwxp 00003000 fd:00 11028147 /usr/lib/sasl2/libplain.so.2.0.22 06574000-06690000 r-xp 00000000 fd:00 2290134 /lib/libcrypto.so.0.9.8b 06690000-066a2000 rwxp 0011c000 fd:00 2290134 /lib/libcrypto.so.0.9.8b 066a2000-066a6000 rwxp 066a2000 00:00 0 066a8000-066d2000 r-xp 00000000 fd:00 10928450 /usr/lib/libgssapi_krb5.so.2.2 066d2000-066d3000 rwxp 00029000 fd:00 10928450 /usr/lib/libgssapi_krb5.so.2.2 066d5000-06716000 r-xp 00000000 fd:00 2290135 /lib/libssl.so.0.9.8b 06716000-0671a000 rwxp 00040000 fd:00 2290135 /lib/libssl.so.0.9.8b 06aeb000-06af0000 r-xp 00000000 fd:00 2290136 /lib/libcrypt-2.5.so 06af0000-06af1000 r-xp 00004000 fd:00 2290136 /lib/libcrypt-2.5.so 06af1000-06af2000 rwxp 00005000 fd:00 2290136 /lib/libcrypt-2.5.so 06af2000-06b19000 rwxp 06af2000 00:00 0 06dcb000-06de3000 r-xp 00000000 fd:00 10928451 /usr/lib/libsasl2.so.2.0.22 06de3000-06de4000 rwxp 00017000 fd:00 10928451 /usr/lib/libsasl2.so.2.0.22 08048000-0811d000 r-xp 00000000 fd:00 10953555 /usr/local/libexec/slapd 0811d000-08121000 rw-p 000d4000 fd:00 10953555 /usr/local/libexec/slapd 08121000-08124000 rw-p 08121000 00:00 0 08d12000-08e2d000 rw-p 08d12000 00:00 0 a1b00000-a1b21000 rw-p a1b00000 00:00 0 a1b21000-a1c00000 ---p a1b21000 00:00 0 a1c3a000-a1d3b000 rw-p a1c3a000 00:00 0 a1d3b000-a1d3c000 ---p a1d3b000 00:00 0 a1d3c000-a283d000 rw-p a1d3c000 00:00 0 a283d000-a283e000 ---p a283d000 00:00 0 a283e000-a323e000 rw-p a283e000 00:00 0 a323e000-a323f000 ---p a323e000 00:00 0 a323f000-a3c3f000 rw-p a323f000 00:00 0 a3c3f000-a3c45000 rw-s 00000000 fd:00 821479 /usr/local/var/openldap-data/__db.005 a3c45000-a3cb3000 rw-s 00000000 fd:00 821478 /usr/local/var/openldap-data/__db.004 a3cb3000-a3ef3000 rw-s 00000000 fd:00 821477 /usr/local/var/openldap-data/__db.003 a3ef3000-b7ef5000 rw-s 00000000 fd:00 820670 /usr/local/var/openldap-data/__db.002 b7ef5000-b7efa000 rw-p b7ef5000 00:00 0 b7f0e000-b7f12000 rw-s 00000000 fd:00 820669 /usr/local/var/openldap-data/__db.001 b7f12000-b7f13000 rw-p b7f12000 00:00 0 bfe20000-bfe36000 rw-p bfe20000 00:00 0 [stack] Program received signal SIGABRT, Aborted. [Switching to Thread -1569473648 (LWP 4535)] 0x00695402 in __kernel_vsyscall () (gdb) bt #0 0x00695402 in __kernel_vsyscall () #1 0x00ac8d40 in raise () from /lib/libc.so.6 #2 0x00aca591 in abort () from /lib/libc.so.6 #3 0x00afe33b in __libc_message () from /lib/libc.so.6 #4 0x00b0448b in malloc_consolidate () from /lib/libc.so.6 #5 0x00b066f3 in _int_malloc () from /lib/libc.so.6 #6 0x00b07bdd in calloc () from /lib/libc.so.6 #7 0x00afce7d in open_memstream () from /lib/libc.so.6 #8 0x00b69656 in __vsyslog_chk () from /lib/libc.so.6 #9 0x00b69bfa in syslog () from /lib/libc.so.6 #10 0x080687e5 in connection2anonymous () #11 0x08068c9c in connection2anonymous () #12 0x0011b56d in ldap_int_thread_pool_wrapper (xpool=0x0) at tpool.c:478 #13 0x00c133db in start_thread () from /lib/libpthread.so.0 #14 0x00b6d26e in clone () from /lib/libc.so.6 Please let me know what else is needed. Thanks, Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs