openldap-bugs

openldap-bugs@openldap.org

1 participants
20961 discussions

Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch
by quanah＠zimbra.com 24 Jul '12

24 Jul '12

--On Friday, July 20, 2012 10:06 PM +0000 openldap(a)stormcloud9.net wrote: > I have also tried tls_reqcert=allow with the same result. And in a > desperate attempt, I also tried setting tls_cacert=/dev/null in the hope > that if it couldn't verify the cert it wouldnt check the hostname against > the cert subject, but this failed as well. Which of the three TLS software packages is your openldap build linked to? OpenSSL MozNSS GnuTLS Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7332) Patch to build using Microsoft Visual Studio
by hyc＠symas.com 23 Jul '12

23 Jul '12

Thanks for the patch, applied to git master. mbooth(a)apache.org wrote: > Full_Name: Mat Booth > Version: 2.4.31 > OS: Windows XP > URL: http://people.apache.org/~mbooth/0001-Changes-required-to-build-with-Micros… > Submission from: (NULL) (77.86.30.139) > > > The provided patch makes three changes that were necessary for me to build > liblber and libldap on Windows using Microsoft Visual Studio. > > > * include/ac/socket.h > The type socklen_t is defined in ws2tcpip.h on the Windows platform, so include > this header when including winsock2.h > > * libraries/libldap/ldap-int.h > The struct timeval is defined in winsock.h or winsock2.h on the Windows platform > so include ac/socket.h when _WIN32 is defined (The comment in winsock2.h > literary says "taken from the BSD file sys/time.h") > > * libraries/libldap/util-int.c > The error code EAI_SYSTEM is not defined at all on the Windows platform, so only > use it if it's defined. > > > > The attached patch file is derived from OpenLDAP Software. All of the > modifications to OpenLDAP Software represented in the following patch(es) were > developed by Mat Booth <mbooth(a)apache.org>. I have not assigned rights and/or > interest in this work to any party. > > I, Mat Booth, hereby place the following modifications to OpenLDAP Software (and > only these modifications) into the public domain. Hence, these modifications may > be freely used and/or redistributed for any purpose with or without attribution > and/or other notice. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7332) Patch to build using Microsoft Visual Studio
by mbooth＠apache.org 23 Jul '12

23 Jul '12

Full_Name: Mat Booth Version: 2.4.31 OS: Windows XP URL: http://people.apache.org/~mbooth/0001-Changes-required-to-build-with-Micros… Submission from: (NULL) (77.86.30.139) The provided patch makes three changes that were necessary for me to build liblber and libldap on Windows using Microsoft Visual Studio. * include/ac/socket.h The type socklen_t is defined in ws2tcpip.h on the Windows platform, so include this header when including winsock2.h * libraries/libldap/ldap-int.h The struct timeval is defined in winsock.h or winsock2.h on the Windows platform so include ac/socket.h when _WIN32 is defined (The comment in winsock2.h literary says "taken from the BSD file sys/time.h") * libraries/libldap/util-int.c The error code EAI_SYSTEM is not defined at all on the Windows platform, so only use it if it's defined. The attached patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Mat Booth <mbooth(a)apache.org>. I have not assigned rights and/or interest in this work to any party. I, Mat Booth, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7331) [PATCH] MozNSS: ignore untrusted issuer error when verifying server certificate
by jvcelak＠redhat.com 21 Jul '12

21 Jul '12

I forgot to add: The patch deals only with a local certificate validation. It does not have any effect on a remote peer's certificate verification.

1 0

(ITS#7331) [PATCH] MozNSS: ignore untrusted issuer error when verifying server certificate
by jvcelak＠redhat.com 21 Jul '12

21 Jul '12

Full_Name: Jan Vcelak Version: git master OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-20120721-moznss-ignore-untrusted-is… Submission from: (NULL) (193.165.79.10) If a self-issued certificate in PEM format is used as a server certificate, the TLS context initialization can fail with SEC_ERROR_UNTRUSTED_ISSUER error. Unfortunately we cannot set trust flags of the server certificate loaded by MozNSS PEM module. This patch allows to ignore this error code. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch
by openldap＠stormcloud9.net 21 Jul '12

21 Jul '12

I've come up with a few more critical details while trying to solve the issue. 1) If the other master is started first, when the local slapd starts, syncrepl connects and works fine. It only fails if the other master is started after the local slapd is running. 2) If I delete the specific olcSyncrepl attribute for one that is failing, and then add it back, syncrepl starts working fine. 3) After deleting and re-adding the olcSyncrepl attribute to make syncrepl work, if I stop and start the other master slapd, syncrepl starts failing again.

1 0

(ITS#7330) slapd mmr failure due to tls cert name mismatch
by openldap＠stormcloud9.net 21 Jul '12

21 Jul '12

Full_Name: Patrick Hemmer Version: 2.4.31 OS: RHEL 6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.238.31.70) I have 2 servers (version 2.4.31) in multi-master-replication behind a single IP. Whenever replication tries to start, it fails because the cert name does not match the hostname. ---- TLS: hostname (per5-unity-ldap02.mbox.net) does not match common name in certificate (unity-ldap.mbox.net). 5009c52e slap_client_connect: URI=ldap://per5-unity-ldap02.mbox.net Error, ldap_start_tls failed (-11) 5009c52e do_syncrepl: rid=523 rc -11 retrying (5 retries left) ---- However in the slapd configuration, I have the olcSyncrepl tls_reqcert parameter set to 'never' ---- dn: olcDatabase={3}hdb,cn=config olcSyncrepl: {0}rid=513 provider="ldap://per5-unity-ldap01.mbox.net" network-timeout=2 retry="1 10 10 60 60 +" keepalive="60:3:60" starttls=critical tls_reqcert=never bindmethod=simple timeout=2 binddn="uid=foo,cn=bar" credentials="baz" type=refreshAndPersist searchbase="dc=my,dc=domain" olcSyncrepl: {1}rid=523 provider="ldap://per5-unity-ldap02.mbox.net" network-timeout=2 retry="1 10 10 60 60 +" keepalive="60:3:60" starttls=critical tls_reqcert=never bindmethod=simple timeout=2 binddn="uid=foo,cn=bar" credentials="baz" type=refreshAndPersist searchbase="dc=my,dc=domain" ---- I have also tried tls_reqcert=allow with the same result. And in a desperate attempt, I also tried setting tls_cacert=/dev/null in the hope that if it couldn't verify the cert it wouldnt check the hostname against the cert subject, but this failed as well.

1 0

(ITS#7329) Bottleneck adding a single value to indexed multi-valued attribute
by mhardin＠symas.com 20 Jul '12

20 Jul '12

Full_Name: Matthew Hardin Version: 2.4.31 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (69.43.206.100) Opening at Howard Chu's request: When adding a single value to a multi-valued attribute that is indexed, slapd re-adds index entries for every value in the attribute. This is a bottleneck and the code to do this (per Howard) should be reworked.

1 0

(ITS#7328) slapcat fails silently with back-hdb/bdb
by quanah＠OpenLDAP.org 19 Jul '12

19 Jul '12

Full_Name: Quanah Gibson-Mount Version: 2.4 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.108.184.39) As reported in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673038, putting slapcat into a loop shows that it periodically fails to correctly dump an active database in full. We have also seen this at customer sites, when nightly backups are run. At the least, slapcat should return an error, so that failure can be caught and a new slapcat run.

1 0

(ITS#7327) [PATCH] smbk5pwd: error if crypto backend unsupported
by jvcelak＠redhat.com 19 Jul '12

19 Jul '12

Full_Name: Jan Vcelak Version: git master OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-20120719-smbk5pwd-error-if-crypto-b… Submission from: (NULL) (209.132.186.34) smbk5pwd overlay source code does not expect crypto backend other than OpenSSL or GnuTLS. When OpenLDAP si compiled with Mozilla NSS, Samba password hashes are not computed and the overlay returns uninitialized memory as the hash. This simple patch does not allow the smbk5pwd overlay to be compiled without OpenSSL or GnuTLS. Unfortunately we cannot add support for MozNSS, because MozNSS does not (and will not) implement MD4. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs