openldap-bugs

openldap-bugs@openldap.org

1 participants
20962 discussions

Re: (ITS#7242) new -y (Read password from file) does not work
by chris.paul＠rexconsulting.net 13 Apr '12

13 Apr '12

Oh duh. I see now. Thanks! CP On Apr 13, 2012, at 13:59, masarati(a)aero.polimi.it wrote: >> Full_Name: Chris Paul >> Version: ldapsearch 2.4.23 (Dec 7 2011 21:37:03) >> OS: tried both Centos 2.6.32-220.el6.i686 and Cygwin >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (162.119.68.25) >> >> >> I really like the new -y option to read the password from a file but it >> doesn't >> work. Also it broke the old behavior which read it from standard input if >> you >> used -W. >> >> I have a one line password file. I used to use this successfully with a >> command >> like: >> >> $ ldapsearch -x -H $TIM -s sub -b "dc=myorg, dc=org" "(uid=someuid)" uid >> cn < >> ~/.ldappw >> >> Now this command just prompts me for the password. >> >> And when I try -y, it seems that an 0x0a character is added to the >> password >> string (I found this by using tcpdump to capture the packets), so that >> fails >> with "Invalid credentials (49)". > > This is a common user error. The "0x0a" is a newline ('\n') which is > probably present in your file. You need to create a file that contains > exactly the password. For example, to create a file that contains the > password "secret" you need to do > > echo -n "secret" > filename. > > This ITS will be closed. > > p. >

1 0

Re: (ITS#7242) new -y (Read password from file) does not work
by masarati＠aero.polimi.it 13 Apr '12

13 Apr '12

> Full_Name: Chris Paul > Version: ldapsearch 2.4.23 (Dec 7 2011 21:37:03) > OS: tried both Centos 2.6.32-220.el6.i686 and Cygwin > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (162.119.68.25) > > > I really like the new -y option to read the password from a file but it > doesn't > work. Also it broke the old behavior which read it from standard input if > you > used -W. > > I have a one line password file. I used to use this successfully with a > command > like: > > $ ldapsearch -x -H $TIM -s sub -b "dc=myorg, dc=org" "(uid=someuid)" uid > cn < > ~/.ldappw > > Now this command just prompts me for the password. > > And when I try -y, it seems that an 0x0a character is added to the > password > string (I found this by using tcpdump to capture the packets), so that > fails > with "Invalid credentials (49)". This is a common user error. The "0x0a" is a newline ('\n') which is probably present in your file. You need to create a file that contains exactly the password. For example, to create a file that contains the password "secret" you need to do echo -n "secret" > filename. This ITS will be closed. p.

1 0

(ITS#7242) new -y (Read password from file) does not work
by chris.paul＠rexconsulting.net 13 Apr '12

13 Apr '12

Full_Name: Chris Paul Version: ldapsearch 2.4.23 (Dec 7 2011 21:37:03) OS: tried both Centos 2.6.32-220.el6.i686 and Cygwin URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (162.119.68.25) I really like the new -y option to read the password from a file but it doesn't work. Also it broke the old behavior which read it from standard input if you used -W. I have a one line password file. I used to use this successfully with a command like: $ ldapsearch -x -H $TIM -s sub -b "dc=myorg, dc=org" "(uid=someuid)" uid cn < ~/.ldappw Now this command just prompts me for the password. And when I try -y, it seems that an 0x0a character is added to the password string (I found this by using tcpdump to capture the packets), so that fails with "Invalid credentials (49)".

1 0

Re: (ITS#7212) slapmodify support for back-config
by ondrej.kuznik＠acision.com 13 Apr '12

13 Apr '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 03/20/2012 11:11 AM, ondrej.kuznik(a)acision.com wrote: > For slapmodify to be usable on a database, that database needs to > implement the bi_tool_dn2id_get and bi_tool_entry_modify > functions, which is not the case of the back-config. I've put > together a minimal (and maybe too naive) implementation of these > for back-config and back-ldif at the above link. Ok, nevermind for now, the implementation was too naive and would break some other things (the slapadd in test005). - -- Ondrej Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk+IMUkACgkQ9GWxeeH+cXtodQCeJdq8IQvH+hWEYTTMt3hn+6UC K20An0uaLb/lmDo6zBJtHm3RL9FMXezq =xnVE -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.

1 0

Re: (ITS#7088) slapo-accesslog makes OpenLDAP hang
by Pierangelo Masarati 12 Apr '12

12 Apr '12

> The root cause of this bug seems to be related to olcAccessLogOps and > olcAccessLogBase features. If I use one of them to specify I want to log > only "modify" operations: > olcAccessLogOps: modify > or > olcAccessLogBase: modify <suffix> > > Then when I do an "add", slapo-accesslog takes the op_rmutex in > accesslog_op_mod but never release it in accesslog_response. The analysis looks correct. slapo-accesslog(5) was locking the mutex for all write operations, but only releasing it for those that needed to be logged. Should be fixed now in master. Please test. Thanks, p.

1 0

Re: (ITS#7240) [PATCH] MozNSS: skip hostname check if peer certificate was not requested
by jvcelak＠redhat.com 12 Apr '12

12 Apr '12

> ftp://ftp.openldap.org/incoming/jvcelak-120412-moznss-hostname-check.patch The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#7241) [PATCH] unbind: free the socket prior to destroying TLS context
by jvcelak＠redhat.com 12 Apr '12

12 Apr '12

Full_Name: Jan Vcelak Version: git master OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-120412-unbind-free-socket-prior-to-… Submission from: (NULL) (209.132.186.34) Hello. I'm proposing uploaded patch which moves ber_sockbuf_free() prior to ldap_int_tls_destroy() in ldap_ld_free(). I sent the reasoning on the openldap-devel list: http://www.openldap.org/lists/openldap-devel/201204/msg00003.html And there is an answer from Howard: http://www.openldap.org/lists/openldap-devel/201204/msg00004.html Please, consider its inclusion. Jan The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#7240) [PATCH] MozNSS: skip hostname check if peer certificate was not requested
by jvcelak＠redhat.com 12 Apr '12

12 Apr '12

Full_Name: Jan Vcelak Version: git master OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-120412-moznss-hostname-check.patch Submission from: (NULL) (209.132.186.34) Hello. With Mozilla NSS crypto backend, the 'tls_checkpeer no' option in 'sudo' tool does not work. I have uploaded a patch which fixes the bug. But some explanation is necessary: sudo initially creates a ldap handle using ldap_initialize() function. Then it uses ldap_set_option() to set all the settings. The TLS configuration is applied without passing a LDAP handle, which means the the global options are changed. In ldap_int_start_tls(): - The ldap_int_tls_connect() is called and the global TLS context is used (LDAP_INT_GLOBAL_OPT()->ldo_tls_ctx). Which is correct. - The ldap_pvt_tls_check_hostname() is called always. "sudo" will set the ldo_tls_require_cert in global options to LDAP_OPT_X_TLS_NEVER, but the handle options (ld->ld_options) are used to check whether the verification is supposed to happen. And ldo_tls_require_cert in handle options is LDAP_OPT_X_TLS_DEMAND (the default), because it was copied from the global options at the time when ldap_initialize() was called. - With OpenSSL, hostname check (tlso_session_chkhost) will succeed because tlso_get_cert() will return NULL. This is true because no certificate was requested when connecting. We do not request the certificate as well in Mozilla NSS, but it seems that the peer can send it anyway and the library will accept and store it. In this case, hostname check (tlsm_session_chkhost) might fail because SSL_PeerCertificate() will return it. I've added an additional check, which skips the hostname verification within tlsm_session_chkhost if we do not request the certificate validation. With this patch, the behavior is consistent with OpenSSL. (Maybe ldap_pvt_tls_check_hostname() should not just be called, because the global context was used and therefore we should use global options. Not sure what is expected, but I think that changing this might break some applications. My fix is safer.) Jan

1 0

Re: (ITS#7225) back-monitor/ldap crash in test020-proxycache
by ondrej.kuznik＠acision.com 12 Apr '12

12 Apr '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/04/2012 02:09 PM, h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth Version: master, > fc1396fa2e94ee2e752fd7c3ea5bb22f6592398a OS: Linux x86_64 URL: > Submission from: (NULL) (129.240.203.186) Submitted by: hallvard > > > back-ldap:ldap_back_monitor_conn_init() calls > monitor_back_register_entry_attrs(,,,nbase=NULL,,) which crashes > at: > > 1093 if ( !BER_BVISNULL( nbase ) ) { > > That checks if nbase->bv_val is NULL, it does not check nbase > itself. Backtrace: > > #0 monitor_back_register_entry_attrs (ndn_in=0x1023d50, > a=0x1092be8, cb=0x10f59b0, nbase=0x0, scope=0, filter=0x0) at > init.c:1093 #1 ldap_back_monitor_conn_init (be=0x104d0c0, > ms=0x1023d28) at monitor.c:658 #2 monitor_back_db_open > (be=0x104d0c0, cr=0x7fff704846e0) at init.c:2365 #3 > backend_startup_one (be=0x104d0c0, cr=0x7fff704846e0) at > backend.c:224 #4 backend_startup (be=0x104d0c0) at backend.c:325 #5 > slap_startup (be=0x0) at init.c:219 I prepared a patch mentioned in the -devel mailing list for the remaining issue not yet fixed in master. - -- Ondrej Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk+Gsb8ACgkQ9GWxeeH+cXvTvgCfeIIljtQv7XahXE9P2aocg+xu oWoAn0zvQVQ6x3PnL3IhL2SWMo1iSKWo =NZ52 -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.

1 0

ITS#7239
by michael＠stroeder.com 12 Apr '12

12 Apr '12

This is a cryptographically signed message in MIME format. --------------ms020908090503080200050809 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable It seems that 'logops all' only fails if an entry is renamed which has an= RDN attribute which is check by slapo-unique. It seems slapo-unique's interna= l search is also logged to accesslog DB. Is that correct behaviour? So this combination does *not* work: ----------------------------------- overlay unique unique_attributes uid overlay accesslog logdb "cn=3Daccesslog" logops all ----------------------------------- This combination works correctly: ----------------------------------- overlay unique unique_attributes uid overlay accesslog logdb "cn=3Daccesslog" logops writes session ----------------------------------- --------------ms020908090503080200050809 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIFOzCC BTcwggMfoAMCAQICAwl4kDANBgkqhkiG9w0BAQUFADB5MRAwDgYDVQQKEwdSb290IENBMR4w HAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNBIENlcnQgU2lnbmlu ZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZzAeFw0xMDEx MTcxNTQzMzFaFw0xMjExMTYxNTQzMzFaMD8xGDAWBgNVBAMUD01pY2hhZWwgU3Ry9mRlcjEj MCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDo2SKth5GhtaDrCyfGtyUG+/hAAa/J52L0NFN4SSRvTtdGf9HfWwwd NCtgae0TVGWk2lKDbXA9d5vmyIiRhuwxd90H6FLErhRBeB9G67qtw87E8WUoXt2DwPQEUTWV hqHpPadlmgFw3+i3TGQQTe3O3W9MMMd4GJNhObem2VGRuCD37OXnzBksTcq0FPJgcWAhe3d/ 0ItOkNWBqgq8Mf3p7WFBhaQ0a27BC/mKtH8fI3kPcS305imPRja69Msq3EwUZBc9ToVp6FRQ NYKjfOBybDUzVkmRZl3H8xutQP2w8Zxb8m5f7Q1BfLLrIFScfYvIDgOERxTCd4lab8+/09XH AgMBAAGjggEAMIH9MAwGA1UdEwEB/wQCMAAwVgYJYIZIAYb4QgENBEkWR1RvIGdldCB5b3Vy IG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSBoZWFkIG92ZXIgdG8gaHR0cDovL3d3dy5DQWNl cnQub3JnMEAGA1UdJQQ5MDcGCCsGAQUFBwMEBggrBgEFBQcDAgYKKwYBBAGCNwoDBAYKKwYB BAGCNwoDAwYJYIZIAYb4QgQBMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDov L29jc3AuY2FjZXJ0Lm9yZzAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkq hkiG9w0BAQUFAAOCAgEANPf/aLF41eQlvN5dEg3CFnlN//qQK7+EPIXLnHprNWLb4nBwgdPj /E+qa1umT7px4Py3VS0UTKqLmMdWftwid8MOMHWalZwrfx0Z8U3He+EdJhOSnn9vdd/ug7Xd dI/hRjLaBSq9ZhCczEUgL6vTxCYPlIoHF56y/oxSJw59vRBjvRFKXvpBZWseeRkcGACQduNH SNdWC1IqHAbQlgOS9VWQUYlm//BdaLkezRxqnQp5+KJMAcZzHpdNJ3G4SqCJ02Z3n4kk8IKZ AjgiWxisDFNsfXKDb9Ng5ntnnH2ouxrgPoNnW445tgkz50VKHstylx9s5O3G7uUTtg0J+z63 TA8xbN6kzRx7RgAUkEXhl6WEdW+3EVj5tYY38Uy8vleP+gYZfphKEmQJgIQqy9D2+gesbolT QdWYgbUYY2AHJOshskMW7pahYnFX2pZmn/ayaPc+JFJlCEqO0+DcYQjYuv6sntQgZGkok7yZ R4xMbyCp61pTrfGWOufZs/FiScJZg1IWY5qb4URH4VZZjLNMR2pFMRuE4LvgkkMRasbUv7Yv n3Lzv34lTfJKUqYW6nx//L2NS4rN63o0taPwRygnuBK4kp7EYEcwtLeanJhQoIu4b6If9rwy D7CFAp51wIewV9VtZ1Is0irNBcMVyhJogIcuIn+VWY1ff1RxySD/djMxggOUMIIDkAIBATCB gDB5MRAwDgYDVQQKEwdSb290IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcx IjAgBgNVBAMTGUNBIENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1 cHBvcnRAY2FjZXJ0Lm9yZwIDCXiQMAkGBSsOAwIaBQCgggHoMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEyMDQxMjA3NTUxOFowIwYJKoZIhvcNAQkEMRYE FNS0/62yD9dzyzS3EyhbuMy09iM7MF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoG CCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggq hkiG9w0DAgIBKDCBkQYJKwYBBAGCNxAEMYGDMIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAc BgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5n IEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMJeJAwgZMG CyqGSIb3DQEJEAILMYGDoIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6 Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEh MB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMJeJAwDQYJKoZIhvcNAQEBBQAE ggEAKMtTuAEUZMWoCtepWolUde61WnPI+6pmWV/PUVJHHx2jvQHE4CTRI10LzG9MDp371Hf9 PhsFUamF1uEZ7zq7uFHqT8ry3Ku4aKZuIWOnaY8qZxPZTGkkeP6krmJwye/FFsldwNo1iQnl goNRG1PmCkAN2J9cVyUSd+2Ls388sSaThAhUZBvRknF8UbOCMazw8gWNypCSR2euR+0DJhhf kUD6YsQvPpe4eWi6ZIb4nhy1UDqxvWeOnnD2j0Ryg5eixL41DLGjfhwsV8GwMqjkBoFEsEec /yjo46BvN6YX5Ow9SGoy2eYbZo6K2aLZ23OvYsiqgRn/k13R71QPht/4eAAAAAAAAA== --------------ms020908090503080200050809--

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs