openldap-bugs

openldap-bugs@openldap.org

1 participants
20961 discussions

Re: (ITS#7650) Multi-master replication deadlock with TLS
by hyc＠symas.com 26 Jul '13

26 Jul '13

sdj42(a)live.com wrote: > Full_Name: Scott Ireland > Version: 2.4.23 > OS: RHEL 6.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (207.34.120.71) > > > A 2-server, multi-master replication setup appears to deadlock during sync. > After a period of time (sometimes hours), both servers will lock up at the same > time and fail to handle requests (although they do accept TCP connections). > This only occurs when the sync occurs with TLS (either StartTLS or ldaps); when > TLS is not used the sync runs without incident. Stopping/restarting one of the > servers clears the lockup on the other server. Sometimes the issue can be > triggered immediately when a change is made to the database (in which case the > client does not see the operation complete), but will also occur on its own as > periodic replication checks occur. You're running a very old release, current is 2.4.35. You're running a Red Hat customized build, contact Red Hat for support. Closing this ITS. > Typical log (level 0x4100) before the freeze: > > Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 fd=23 ACCEPT from > IP=redacted:48388 (IP=redacted:389) > Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 op=0 EXT > oid=1.3.6.1.4.1.1466.20037 > Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 op=0 STARTTLS > Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 op=0 RESULT oid= err=0 text= > [freezes here] > > GDB backtrace (this lock was triggered by a change in cn=config): > > (gdb) info threads > 5 Thread 0x7f7eeb3d0700 (LWP 7048) 0x00007f7eee227f03 in epoll_wait () > from /lib64/libc.so.6 > 4 Thread 0x7f7ed5028700 (LWP 7049) 0x00007f7eee6eb054 in __lll_lock_wait () > from /lib64/libpthread.so.0 > 3 Thread 0x7f7ed4827700 (LWP 7050) 0x00007f7eee6eb54d in read () > from /lib64/libpthread.so.0 > 2 Thread 0x7f7ecffff700 (LWP 7051) 0x00007f7eee6e843c in > pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 > * 1 Thread 0x7f7ef0700700 (LWP 7043) 0x00007f7eee6e50ad in pthread_join () > from /lib64/libpthread.so.0 > > (gdb) bt > #0 0x00007f7eee6e50ad in pthread_join () from /lib64/libpthread.so.0 > #1 0x00007f7ef075685c in slapd_daemon () > at ../../../servers/slapd/daemon.c:2842 > #2 0x00007f7ef0742b0e in main (argc=5, argv=<value optimized out>) > at ../../../servers/slapd/main.c:961 > > (gdb) thread 2 > [Switching to thread 2 (Thread 0x7f7ecffff700 (LWP 7051))]#0 0x00007f7eee6e843c > in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 > (gdb) bt > #0 0x00007f7eee6e843c in pthread_cond_wait@@GLIBC_2.3.2 () > from /lib64/libpthread.so.0 > #1 0x00007f7ef085c6fb in handle_pause (tpool=<value optimized out>, > do_pause=1) at ../../../libraries/libldap_r/tpool.c:757 > #2 0x00007f7ef074a53c in config_back_modify (op=0x7f7ec81adaa0, > rs=0x7f7ecfffe920) at ../../../servers/slapd/bconfig.c:5677 > #3 0x00007f7ef07c8977 in overlay_op_walk (op=0x7f7ec81adaa0, > rs=0x7f7ecfffe920, which=op_modify, oi=0x7f7ef1a644c0, on=0x0) > at ../../../servers/slapd/backover.c:669 > #4 0x00007f7ef07c93cb in over_op_func (op=0x7f7ec81adaa0, > rs=<value optimized out>, which=<value optimized out>) > at ../../../servers/slapd/backover.c:721 > #5 0x00007f7ef0775ece in fe_op_modify (op=0x7f7ec81adaa0, rs=0x7f7ecfffe920) > at ../../../servers/slapd/modify.c:301 > #6 0x00007f7ef077685c in do_modify (op=0x7f7ec81adaa0, rs=0x7f7ecfffe920) > at ../../../servers/slapd/modify.c:175 > #7 0x00007f7ef075c9f9 in connection_operation (ctx=0x7f7ecfffeb70, > arg_v=0x7f7ec81adaa0) at ../../../servers/slapd/connection.c:1109 > #8 0x00007f7ef075d34d in connection_read_thread (ctx=0x7f7ecfffeb70, > argv=<value optimized out>) at ../../../servers/slapd/connection.c:1245 > #9 0x00007f7ef085cdd8 in ldap_int_thread_pool_wrapper (xpool=0x7f7ef19957b0) > at ../../../libraries/libldap_r/tpool.c:685 > #10 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 > #11 0x00007f7eee22790d in clone () from /lib64/libc.so.6 > > (gdb) thread 3 > [Switching to thread 3 (Thread 0x7f7ed4827700 (LWP 7050))]#0 0x00007f7eee6eb54d > in read () from /lib64/libpthread.so.0 > (gdb) bt > #0 0x00007f7eee6eb54d in read () from /lib64/libpthread.so.0 > #1 0x00007f7ef088c67c in sb_debug_read (sbiod=0x7f7ec0174cb0, > buf=0x7f7ec0191130, len=5) at ../../../libraries/liblber/sockbuf.c:829 > #2 0x00007f7ef0882564 in tlsm_PR_Recv (fd=<value optimized out>, > buf=0x7f7ec0191130, len=5, flags=<value optimized out>, > timeout=<value optimized out>) at tls_m.c:3032 > #3 0x00007f7eef6ed1ed in ssl_DefRecv (ss=<value optimized out>, > buf=<value optimized out>, len=5, flags=<value optimized out>) > at ssldef.c:62 > #4 0x00007f7eef6e8480 in ssl3_GatherData (ss=0x7f7ec0190d50, flags=0) > at ssl3gthr.c:59 > #5 ssl3_GatherCompleteHandshake (ss=0x7f7ec0190d50, flags=0) at ssl3gthr.c:318 > #6 0x00007f7eef6eaed2 in ssl_GatherRecord1stHandshake (ss=0x7f7ec0190d50) > at sslcon.c:1227 > #7 0x00007f7eef6f1135 in ssl_Do1stHandshake (ss=0x7f7ec0190d50) > at sslsecur.c:120 > #8 0x00007f7eef6f296f in SSL_ForceHandshake (fd=<value optimized out>) > at sslsecur.c:390 > #9 0x00007f7ef0882288 in tlsm_session_accept_or_connect ( > session=0x7f7ec0174910, is_accept=<value optimized out>) at tls_m.c:2677 > #10 0x00007f7ef0880e8a in ldap_int_tls_connect (ld=0x7f7ec0107ca0, > conn=<value optimized out>, host=0x7f7ec0170710 "redacted") > at tls2.c:366 > #11 0x00007f7ef088110a in ldap_int_tls_start (ld=0x7f7ec0107ca0, > conn=0x7f7ec0107f10, srv=<value optimized out>) at tls2.c:845 > #12 0x00007f7ef088120e in ldap_start_tls_s (ld=0x7f7ec0107ca0, > serverctrls=0x0, clientctrls=0x0) at tls2.c:938 > #13 0x00007f7ef075269e in slap_client_connect (ldp=0x7f7ec01709f0, > sb=0x7f7ec01707d0) at ../../../servers/slapd/config.c:1921 > #14 0x00007f7ef07c5062 in do_syncrep1 (ctx=<value optimized out>, > arg=0x7f7ec0170b60) at ../../../servers/slapd/syncrepl.c:571 > #15 do_syncrepl (ctx=<value optimized out>, arg=0x7f7ec0170b60) > at ../../../servers/slapd/syncrepl.c:1422 > #16 0x00007f7ef085cdd8 in ldap_int_thread_pool_wrapper (xpool=0x7f7ef19957b0) > at ../../../libraries/libldap_r/tpool.c:685 > #17 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 > #18 0x00007f7eee22790d in clone () from /lib64/libc.so.6 > > (gdb) thread 4 > [Switching to thread 4 (Thread 0x7f7ed5028700 (LWP 7049))]#0 0x00007f7eee6eb054 > in __lll_lock_wait () from /lib64/libpthread.so.0 > (gdb) bt > #0 0x00007f7eee6eb054 in __lll_lock_wait () from /lib64/libpthread.so.0 > #1 0x00007f7eee6e6388 in _L_lock_854 () from /lib64/libpthread.so.0 > #2 0x00007f7eee6e6257 in pthread_mutex_lock () from /lib64/libpthread.so.0 > #3 0x00007f7ef0882280 in tlsm_session_accept_or_connect ( > session=0x7f7ec4131df0, is_accept=<value optimized out>) at tls_m.c:2674 > #4 0x00007f7ef08812c7 in ldap_pvt_tls_accept (sb=0x7f7ec4140420, > ctx_arg=0x7f7ef1a82e70) at tls2.c:433 > #5 0x00007f7ef075d3bb in connection_read (ctx=0x7f7ed5027b70, argv=0x17) > at ../../../servers/slapd/connection.c:1326 > #6 connection_read_thread (ctx=0x7f7ed5027b70, argv=0x17) > at ../../../servers/slapd/connection.c:1238 > #7 0x00007f7ef085cdd8 in ldap_int_thread_pool_wrapper (xpool=0x7f7ef19957b0) > at ../../../libraries/libldap_r/tpool.c:685 > #8 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 > #9 0x00007f7eee22790d in clone () from /lib64/libc.so.6 > > (gdb) thread 5 > [Switching to thread 5 (Thread 0x7f7eeb3d0700 (LWP 7048))]#0 0x00007f7eee227f03 > in epoll_wait () from /lib64/libc.so.6 > (gdb) bt > #0 0x00007f7eee227f03 in epoll_wait () from /lib64/libc.so.6 > #1 0x00007f7ef07576f5 in slapd_daemon_task (ptr=<value optimized out>) > at ../../../servers/slapd/daemon.c:2467 > #2 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 > #3 0x00007f7eee22790d in clone () from /lib64/libc.so.6 > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7650) Multi-master replication deadlock with TLS
by quanah＠zimbra.com 26 Jul '13

26 Jul '13

--On Friday, July 26, 2013 7:54 PM +0000 sdj42(a)live.com wrote: > Full_Name: Scott Ireland > Version: 2.4.23 > OS: RHEL 6.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (207.34.120.71) 2.4.23 is years old. The build from RHEL is also known to be particularly bad because of the way they hacked NSS support into it, instead of sanely linking to OpenSSL. If you expect support on this issue, you need to talk to RedHat. I would suggest you use a modern version of OpenLDAP. If you are incapable of compiling it yourself, the packages from <http://ltb-project.org/wiki/download#openldap> are quite good. This ITS will be closed. If you can reproduce the problem on a *current* version of OpenLDAP linked to a *known good* TLS implementation, feel free to open a new report. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7650) Multi-master replication deadlock with TLS
by sdj42＠live.com 26 Jul '13

26 Jul '13

Full_Name: Scott Ireland Version: 2.4.23 OS: RHEL 6.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (207.34.120.71) A 2-server, multi-master replication setup appears to deadlock during sync. After a period of time (sometimes hours), both servers will lock up at the same time and fail to handle requests (although they do accept TCP connections). This only occurs when the sync occurs with TLS (either StartTLS or ldaps); when TLS is not used the sync runs without incident. Stopping/restarting one of the servers clears the lockup on the other server. Sometimes the issue can be triggered immediately when a change is made to the database (in which case the client does not see the operation complete), but will also occur on its own as periodic replication checks occur. Typical log (level 0x4100) before the freeze: Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 fd=23 ACCEPT from IP=redacted:48388 (IP=redacted:389) Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 op=0 STARTTLS Jul 25 11:09:43 cd1911-o99 slapd[5789]: conn=1380 op=0 RESULT oid= err=0 text= [freezes here] GDB backtrace (this lock was triggered by a change in cn=config): (gdb) info threads 5 Thread 0x7f7eeb3d0700 (LWP 7048) 0x00007f7eee227f03 in epoll_wait () from /lib64/libc.so.6 4 Thread 0x7f7ed5028700 (LWP 7049) 0x00007f7eee6eb054 in __lll_lock_wait () from /lib64/libpthread.so.0 3 Thread 0x7f7ed4827700 (LWP 7050) 0x00007f7eee6eb54d in read () from /lib64/libpthread.so.0 2 Thread 0x7f7ecffff700 (LWP 7051) 0x00007f7eee6e843c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 * 1 Thread 0x7f7ef0700700 (LWP 7043) 0x00007f7eee6e50ad in pthread_join () from /lib64/libpthread.so.0 (gdb) bt #0 0x00007f7eee6e50ad in pthread_join () from /lib64/libpthread.so.0 #1 0x00007f7ef075685c in slapd_daemon () at ../../../servers/slapd/daemon.c:2842 #2 0x00007f7ef0742b0e in main (argc=5, argv=<value optimized out>) at ../../../servers/slapd/main.c:961 (gdb) thread 2 [Switching to thread 2 (Thread 0x7f7ecffff700 (LWP 7051))]#0 0x00007f7eee6e843c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 (gdb) bt #0 0x00007f7eee6e843c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 #1 0x00007f7ef085c6fb in handle_pause (tpool=<value optimized out>, do_pause=1) at ../../../libraries/libldap_r/tpool.c:757 #2 0x00007f7ef074a53c in config_back_modify (op=0x7f7ec81adaa0, rs=0x7f7ecfffe920) at ../../../servers/slapd/bconfig.c:5677 #3 0x00007f7ef07c8977 in overlay_op_walk (op=0x7f7ec81adaa0, rs=0x7f7ecfffe920, which=op_modify, oi=0x7f7ef1a644c0, on=0x0) at ../../../servers/slapd/backover.c:669 #4 0x00007f7ef07c93cb in over_op_func (op=0x7f7ec81adaa0, rs=<value optimized out>, which=<value optimized out>) at ../../../servers/slapd/backover.c:721 #5 0x00007f7ef0775ece in fe_op_modify (op=0x7f7ec81adaa0, rs=0x7f7ecfffe920) at ../../../servers/slapd/modify.c:301 #6 0x00007f7ef077685c in do_modify (op=0x7f7ec81adaa0, rs=0x7f7ecfffe920) at ../../../servers/slapd/modify.c:175 #7 0x00007f7ef075c9f9 in connection_operation (ctx=0x7f7ecfffeb70, arg_v=0x7f7ec81adaa0) at ../../../servers/slapd/connection.c:1109 #8 0x00007f7ef075d34d in connection_read_thread (ctx=0x7f7ecfffeb70, argv=<value optimized out>) at ../../../servers/slapd/connection.c:1245 #9 0x00007f7ef085cdd8 in ldap_int_thread_pool_wrapper (xpool=0x7f7ef19957b0) at ../../../libraries/libldap_r/tpool.c:685 #10 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 #11 0x00007f7eee22790d in clone () from /lib64/libc.so.6 (gdb) thread 3 [Switching to thread 3 (Thread 0x7f7ed4827700 (LWP 7050))]#0 0x00007f7eee6eb54d in read () from /lib64/libpthread.so.0 (gdb) bt #0 0x00007f7eee6eb54d in read () from /lib64/libpthread.so.0 #1 0x00007f7ef088c67c in sb_debug_read (sbiod=0x7f7ec0174cb0, buf=0x7f7ec0191130, len=5) at ../../../libraries/liblber/sockbuf.c:829 #2 0x00007f7ef0882564 in tlsm_PR_Recv (fd=<value optimized out>, buf=0x7f7ec0191130, len=5, flags=<value optimized out>, timeout=<value optimized out>) at tls_m.c:3032 #3 0x00007f7eef6ed1ed in ssl_DefRecv (ss=<value optimized out>, buf=<value optimized out>, len=5, flags=<value optimized out>) at ssldef.c:62 #4 0x00007f7eef6e8480 in ssl3_GatherData (ss=0x7f7ec0190d50, flags=0) at ssl3gthr.c:59 #5 ssl3_GatherCompleteHandshake (ss=0x7f7ec0190d50, flags=0) at ssl3gthr.c:318 #6 0x00007f7eef6eaed2 in ssl_GatherRecord1stHandshake (ss=0x7f7ec0190d50) at sslcon.c:1227 #7 0x00007f7eef6f1135 in ssl_Do1stHandshake (ss=0x7f7ec0190d50) at sslsecur.c:120 #8 0x00007f7eef6f296f in SSL_ForceHandshake (fd=<value optimized out>) at sslsecur.c:390 #9 0x00007f7ef0882288 in tlsm_session_accept_or_connect ( session=0x7f7ec0174910, is_accept=<value optimized out>) at tls_m.c:2677 #10 0x00007f7ef0880e8a in ldap_int_tls_connect (ld=0x7f7ec0107ca0, conn=<value optimized out>, host=0x7f7ec0170710 "redacted") at tls2.c:366 #11 0x00007f7ef088110a in ldap_int_tls_start (ld=0x7f7ec0107ca0, conn=0x7f7ec0107f10, srv=<value optimized out>) at tls2.c:845 #12 0x00007f7ef088120e in ldap_start_tls_s (ld=0x7f7ec0107ca0, serverctrls=0x0, clientctrls=0x0) at tls2.c:938 #13 0x00007f7ef075269e in slap_client_connect (ldp=0x7f7ec01709f0, sb=0x7f7ec01707d0) at ../../../servers/slapd/config.c:1921 #14 0x00007f7ef07c5062 in do_syncrep1 (ctx=<value optimized out>, arg=0x7f7ec0170b60) at ../../../servers/slapd/syncrepl.c:571 #15 do_syncrepl (ctx=<value optimized out>, arg=0x7f7ec0170b60) at ../../../servers/slapd/syncrepl.c:1422 #16 0x00007f7ef085cdd8 in ldap_int_thread_pool_wrapper (xpool=0x7f7ef19957b0) at ../../../libraries/libldap_r/tpool.c:685 #17 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 #18 0x00007f7eee22790d in clone () from /lib64/libc.so.6 (gdb) thread 4 [Switching to thread 4 (Thread 0x7f7ed5028700 (LWP 7049))]#0 0x00007f7eee6eb054 in __lll_lock_wait () from /lib64/libpthread.so.0 (gdb) bt #0 0x00007f7eee6eb054 in __lll_lock_wait () from /lib64/libpthread.so.0 #1 0x00007f7eee6e6388 in _L_lock_854 () from /lib64/libpthread.so.0 #2 0x00007f7eee6e6257 in pthread_mutex_lock () from /lib64/libpthread.so.0 #3 0x00007f7ef0882280 in tlsm_session_accept_or_connect ( session=0x7f7ec4131df0, is_accept=<value optimized out>) at tls_m.c:2674 #4 0x00007f7ef08812c7 in ldap_pvt_tls_accept (sb=0x7f7ec4140420, ctx_arg=0x7f7ef1a82e70) at tls2.c:433 #5 0x00007f7ef075d3bb in connection_read (ctx=0x7f7ed5027b70, argv=0x17) at ../../../servers/slapd/connection.c:1326 #6 connection_read_thread (ctx=0x7f7ed5027b70, argv=0x17) at ../../../servers/slapd/connection.c:1238 #7 0x00007f7ef085cdd8 in ldap_int_thread_pool_wrapper (xpool=0x7f7ef19957b0) at ../../../libraries/libldap_r/tpool.c:685 #8 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 #9 0x00007f7eee22790d in clone () from /lib64/libc.so.6 (gdb) thread 5 [Switching to thread 5 (Thread 0x7f7eeb3d0700 (LWP 7048))]#0 0x00007f7eee227f03 in epoll_wait () from /lib64/libc.so.6 (gdb) bt #0 0x00007f7eee227f03 in epoll_wait () from /lib64/libc.so.6 #1 0x00007f7ef07576f5 in slapd_daemon_task (ptr=<value optimized out>) at ../../../servers/slapd/daemon.c:2467 #2 0x00007f7eee6e4851 in start_thread () from /lib64/libpthread.so.0 #3 0x00007f7eee22790d in clone () from /lib64/libc.so.6

1 0

Re: (ITS#7591) back-meta modify operation not sending result to client
by hyc＠symas.com 26 Jul '13

26 Jul '13

This is a multi-part message in MIME format. --------------080809090905040609080207 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit hyc(a)symas.com wrote: > jorge.perez.burgos(a)ericsson.com wrote: >> Hi, >> >> At the end, meta_back_op_result() will map inside the error returned by > ldap_modify_ext to LDAP_OTHER, since we don't call it with LDAP_BACK_SENDERR, > nothing is sent. Since the error is not LDAP_UNAVAILABLE there will be no > retries. I think this happens too in add and delete. > > This explanation makes no sense, since meta_back_op_result is being called > with LDAP_BACK_SENDRESULT, which is SENDOK|SENDERR. > > The bug is definitely a problem, I can reproduce it running test036 repeatedly > on my laptop. Typically the test hangs within 5-10 iterations. This patch appears to fix the dropped result msg problem, but I haven't checked yet to see if it's now sending doubled result msgs somewhere else. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ --------------080809090905040609080207 Content-Type: text/plain; charset=UTF-8; name="dif.txt" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="dif.txt" diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c index 7e63fae..ab88028 100644 --- a/servers/slapd/back-meta/conn.c +++ b/servers/slapd/back-meta/conn.c @@ -787,10 +787,12 @@ meta_back_retry( LDAP_BACK_CONN_BINDING_CLEAR( msc ); } } - } + } +#if 0 /* don't send twice */ sendok &= ~LDAP_BACK_SENDERR; +#endif } if ( rc != LDAP_SUCCESS ) { --------------080809090905040609080207--

1 0

Re: (ITS#7591) back-meta modify operation not sending result to client
by hyc＠symas.com 26 Jul '13

26 Jul '13

jorge.perez.burgos(a)ericsson.com wrote: > Hi, > > At the end, meta_back_op_result() will map inside the error returned by ldap_modify_ext to LDAP_OTHER, since we don't call it with LDAP_BACK_SENDERR, nothing is sent. Since the error is not LDAP_UNAVAILABLE there will be no retries. I think this happens too in add and delete. This explanation makes no sense, since meta_back_op_result is being called with LDAP_BACK_SENDRESULT, which is SENDOK|SENDERR. The bug is definitely a problem, I can reproduce it running test036 repeatedly on my laptop. Typically the test hangs within 5-10 iterations. > BR > > -----Original Message----- > From: Pierangelo Masarati [mailto:pierangelo.masarati@polimi.it] > Sent: lunes, 20 de mayo de 2013 21:41 > To: Jorge Perez Burgos > Cc: openldap-its(a)openldap.org > Subject: Re: (ITS#7591) back-meta modify operation not sending result to client > > On 05/15/2013 08:57 AM, jorge.perez.burgos(a)ericsson.com wrote: >> kludge fix for the problem >> >> --- servers/slapd/back-meta/modify.c 2012-07-31 18:39:26.000000000 +0200 >> +++ servers/slapd/back-meta/modify.c 2013-05-14 12:45:39.273333000 +0200 >> @@ -176,6 +176,7 @@ >> } >> modv[ i ] = 0; >> >> + rs->sr_type = -1; >> retry:; >> ctrls = op->o_ctrls; >> rc = meta_back_controls_add( op, rs, mc, candidate, &ctrls ); @@ >> -198,6 +200,10 @@ >> } >> >> cleanup:; >> + if (rs->sr_type != REP_RESULT) { >> + send_ldap_error(op, rs, LDAP_OTHER, "connection problem trying to reach the other node"); >> + } >> + >> (void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls ); >> >> if ( mdn.bv_val != op->o_req_dn.bv_val ) { > > Thanks for the feedback; I am under the impression that a result should have been returned by meta_back_op_result(). Before applying the suggested fix, I would like to understand whether that function was called and in case why it did not send a result. > > p. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7615) NetBSD sem_open limited to 14 characters
by hyc＠symas.com 26 Jul '13

26 Jul '13

hyc(a)symas.com wrote: > Greg(a)Akua.com wrote: >> Full_Name: Greg Kerr >> Version: 2.4.35 >> OS: NetBSD & FreeBSD >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (50.88.130.68) >> >> >> MDB is not usable on NetBSD because mdb.c has >> >> sprintf(env->me_txns->mti_wmname, "/MDBw%s", hexbuf); >> >> To create the semaphore name. >> >> This results in a 21 character name which is beyond the 14 allowed per "man >> sem_open" > > That's unfortunate. In Linux this limit is 251 characters. Seems you'd need to > use the btoa algorithm to safely fit a hash into this size limit. > > Pretty sure we've tested successfully on FreeBSD and MacOSX already, so > apparently they don't suffer from this same limit. mdb.master has been patched to use the btoa algorithm, which reduces our semaphore name length down to 15 chars. On NetBSD we additionally truncate the last to bring it down to 14. >> "less than 14 characters in length not including the terminating null >> character." >> >> I will make a local patch ... and maybe it's a NetBSD bug - or at least the >> package maintainers ... I will report to him. It's a NetBSD kernel limitation, which I verified here: http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/kern/uipc_sem.c?rev=1.40&conten… Seems like a stupid limit, but whatever. Also the doc wording is inaccurate, the name can actually be *up to* 14 chars. "Less than 14" to most English speakers means the length must be *less than* 14. I.e., 13 or shorter. But in fact 14 characters are allowed. If you're contacting the NetBSD maintainers already, please tell them their manpage is incorrect. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7649) Feature request: numSubordinates attribute
by michael＠stroeder.com 26 Jul '13

26 Jul '13

On Fri, 26 Jul 2013 15:03:41 GMT hyc(a)symas.com wrote > Need to think about this some more. While it's true that the back-hdb/mdb > backends already have this information and can easily provide it, it > introduces new security concerns that sysadmins would have to be aware of. > I.e., clients could use numsubordinates to discover the existence of entries > they are not permitted to access. Which means sysadmins would need to add new > ACLs specifically for controlling access to numsubordinates. > > If we just add the feature, and sysadmins aren't aware it was added, then > they have a security hole. True, but not really a new security consideration for an admin. We already have 'hasSubordinates' anyway. And for whatever new operational attribute introduced in former times the admin was considered responsible to restrict access by appropriate ACLs. I also find such an attribute to be very useful in some use-cases. Another aspect is how searches like (numSubordinates>=1) can be efficiently handled, e.g. in cases where most entries will have numSubordinates=0. Yes, I admit I use it for count-like searches where using no-op search control is too expensive. Ciao, Michael.

1 0

Re: (ITS#7649) Feature request: numSubordinates attribute
by ghenry＠OpenLDAP.org 26 Jul '13

26 Jul '13

> Need to think about this some more. While it's true that the back-hdb/mdb > backends already have this information and can easily provide it, it > introduces new security concerns that sysadmins would have to be aware of. > I.e., clients could use numsubordinates to discover the existence of entries > they are not permitted to access. Which means sysadmins would need to add > new ACLs specifically for controlling access to numsubordinates. > > If we just add the feature, and sysadmins aren't aware it was added, then > they have a security hole. That's very true. If it's an operational attribute wouldn't normal ACLs apply? For example if you are only permitted to see "self" in ou=Users, then you shouldn't be able to request numSubordinates on ou=Users or if you do you only see 1. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

1 0

Re: (ITS#7649) Feature request: numSubordinates attribute
by hyc＠symas.com 26 Jul '13

26 Jul '13

ghenry(a)OpenLDAP.org wrote: > Full_Name: Gavin Henry > Version: > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.159.59.85) > Submitted by: ghenry > > > Dear all, > > It would be great if we supported a numSubordinates attribute so you can request > a count of the number of entries say at a base of > ou=suretec.hosted.surevoip.co.uk,ou=Contacts,dc=surevoip,dc=co,dc=uk rather than > retrieve them all and count them up. I know there is a contrib noopsrch overlay > that others are using. > > The only reference I can see that other directories has is based on this: > > http://tools.ietf.org/html/draft-ietf-boreham-numsubordinates-01 Need to think about this some more. While it's true that the back-hdb/mdb backends already have this information and can easily provide it, it introduces new security concerns that sysadmins would have to be aware of. I.e., clients could use numsubordinates to discover the existence of entries they are not permitted to access. Which means sysadmins would need to add new ACLs specifically for controlling access to numsubordinates. If we just add the feature, and sysadmins aren't aware it was added, then they have a security hole. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7649) Feature request: numSubordinates attribute
by ghenry＠OpenLDAP.org 26 Jul '13

26 Jul '13

Full_Name: Gavin Henry Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.159.59.85) Submitted by: ghenry Dear all, It would be great if we supported a numSubordinates attribute so you can request a count of the number of entries say at a base of ou=suretec.hosted.surevoip.co.uk,ou=Contacts,dc=surevoip,dc=co,dc=uk rather than retrieve them all and count them up. I know there is a contrib noopsrch overlay that others are using. The only reference I can see that other directories has is based on this: http://tools.ietf.org/html/draft-ietf-boreham-numsubordinates-01 Thanks, Gavin.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs