openldap-bugs

openldap-bugs@openldap.org

1 participants
20963 discussions

(ITS#7197) olcTLSVerifyClient missing options
by quanah＠OpenLDAP.org 04 Mar '12

04 Mar '12

Full_Name: Quanah Gibson-Mount Version: 2.4.30 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.108.184.39) >From the manual page: olcTLSVerifyClient: <level> Specifies what checks to perform on client certificates in an incoming TLS session, if any. The <level> can be specified as one of the following keywords: never This is the default. slapd will not ask the client for a certificate. allow The client certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, it will be ignored and the ses- sion proceeds normally. try The client certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, the session is immediately ter- minated. demand | hard | true These keywords are all equivalent, for compatibility rea- sons. The client certificate is requested. If no cer- tificate is provided, or a bad certificate is provided, the session is immediately terminated. Note that a valid client certificate is required in order to use the SASL EXTERNAL authentication mechanism with a TLS session. As such, a non-default olcTLSVerifyClient setting must be chosen to enable SASL EXTERNAL authenti- cation. However, the code has: static slap_verbmasks vfykeys[] = { { BER_BVC("never"), LDAP_OPT_X_TLS_NEVER }, { BER_BVC("demand"), LDAP_OPT_X_TLS_DEMAND }, { BER_BVC("try"), LDAP_OPT_X_TLS_TRY }, { BER_BVC("hard"), LDAP_OPT_X_TLS_HARD }, { BER_BVNULL, 0 } }; Which means: a) allow is missing b) true is missing c) demand and hard set different flags. Not sure if that means any difference functionality wise, but according to the manual page, demand/true/hard are supposed to be the same behavior.

1 0

(ITS#7196) libmdb: MDB_COMMIT_PAGES greater than IOV_MAX causes mdb_txn_commit failures
by roy.keene＠us.army.mil 02 Mar '12

02 Mar '12

Full_Name: Roy Keene Version: 2.4.30 OS: Solaris 10 URL: Submission from: (NULL) (140.194.193.14) libmdb uses writev() to write data to a file descriptor, however it can request that writev() write more blocks than IOV_MAX causing mdb txn errors to be reported to the LDAP client. MDB_COMMIT_PAGES should not be defined to be greater than IOV_MAX. IOV_MAX on Solaris 10 is 16.

1 0

Re: (ITS#7195) delta-syncrepl fails to fallback on some errors
by hyc＠symas.com 02 Mar '12

02 Mar '12

ebackes(a)symas.com wrote: > Full_Name: Emily Backes > Version: 2.4 > OS: any > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (98.155.30.248) > > > The delta-syncrepl code checks an explicit list of failure codes for cases that > merit falling back to syncrepl to regain syncronization. This list is missing a > few; in particular, rc=66 (Not a leaf!) slips through and creates a retry loop. Thanks, fixed in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7195) delta-syncrepl fails to fallback on some errors
by ebackes＠symas.com 02 Mar '12

02 Mar '12

Full_Name: Emily Backes Version: 2.4 OS: any URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (98.155.30.248) The delta-syncrepl code checks an explicit list of failure codes for cases that merit falling back to syncrepl to regain syncronization. This list is missing a few; in particular, rc=66 (Not a leaf!) slips through and creates a retry loop.

1 0

Re: (ITS#7191) libmdb: Alignment of MDB_db members
by roy.s.keene＠usace.army.mil 02 Mar '12

02 Mar '12

Hallvard, This also works. My naive approach was due to working out what the issue was with the original assigment and then trying to determine which members were not aligned correctly. Thanks, Roy Keene On Fri, 2 Mar 2012, Hallvard B Furuseth wrote: > On Fri, 2 Mar 2012 08:03:00 GMT, roy.keene(a)us.army.mil wrote: >> Breaking the assignment into an assignment of its members and using >> the existing COPY_PGNO() alleviates this fault. > > memcpy would be simpler, if it is 'db' which is unaligned. > Try this instead. > > --- mdb.c~ 2012-03-02 11:23:21 > +++ mdb.c 2012-03-02 11:25:06 > @@ -4699,4 +4699,3 @@ mdb_xcursor_init1(MDB_cursor *mc, MDB_no > if (node->mn_flags & F_SUBDATA) { > - MDB_db *db = NODEDATA(node); > - mx->mx_db = *db; > + memcpy(&mx->mx_db, NODEDATA(node), sizeof(MDB_db)); > mx->mx_cursor.mc_snum = 0; > > -- (U) Roy Keene (U) US Army Corps of Engineers IT (ACE-IT) (U) Contractor

1 0

(ITS#7193)
by barlone＠yandex.ru 02 Mar '12

02 Mar '12

Good day! I found problem: function under macro BACKSQL_STR2ID incorrectly work with 'zerofilled' values/fields (for example "000009") ------------------------------------------ Best regards, mailto:barlone@yandex.ru

1 0

(ITS#7193)
by barlone＠yandex.ru 02 Mar '12

02 Mar '12

Good day! I found some hint: if define BACKSQL_ARBITRARY_KEY in back-sql.h, then all records presents in search result, BUT LDAP entry do not contain any attribute! Just empty. Maybe it is another bug? ------------------------------------------ Best regards, mailto:barlone@yandex.ru

1 0

(ITS#7194) tlso_session_chkhost issue for OpenSSL TLS
by dimosthenis.pettas＠nsn.com 02 Mar '12

02 Mar '12

Full_Name: Dimosthenis Pettas Version: 2.4.23 OS: SOLARIS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (62.159.77.167) I use OpenLDAP version 2.4.23 client to connect via TLS to an LDAP server(slapd). i initialize connection with an IPV6 address using url ldap://[fd00:1111:1111:72:20c:29ff:fec5:4ade]:389 and then try to extend connection to TLS with calling ldap_start_tls_s. when trying to match client-server certificates hosts inside tlso_session_chkhost in tls_o.c we try to determine client host type(IS_DNS,IS_IP4,IS_IP6) but for IPV6 it expects to find "[" at first position and "]" at latst one to determine IPV6 address: #ifdef LDAP_PF_INET6 if (name[0] == '[' && strchr(name, ']')) { char *n2 = ldap_strdup(name+1); *strchr(n2, ']') = 0; if (inet_pton(AF_INET6, n2, &addr)) ntype = IS_IP6; LDAP_FREE(n2); } else but it seems that [] have been removed inside ldap_url_parse_ext in Url.c: /* If [ip address]:port syntax, url is [ip and we skip the [ */ ludp->lud_host = LDAP_STRDUP( url + is_v6 ); So name is not [fd00:1111:1111:72:20c:29ff:fec5:4ade] but fd00:1111:1111:72:20c:29ff:fec5:4ade and code above fails to determine ntype = IS_IP6. i modified code to: #ifdef LDAP_PF_INET6 if (inet_pton(AF_INET6, name, &addr)) { ntype = IS_IP6; } else #endif if ((ptr = strrchr(name, '.')) && isdigit((unsigned char)ptr[1])) { if (inet_aton(name, (struct in_addr *)&addr)) { ntype = IS_IP4; } } letting functions inet_pton and inet_aton determing IP type.Scenario worked. Let me know if i miss anything or this should be corrected. Sorry for submitting again ,i wanted to correct email address

1 0

(ITS#7193) SQL backend lost part of data on request
by barlone＠yandex.ru 02 Mar '12

02 Mar '12

Full_Name: barlone Version: 2.4.30 OS: FreeBSD 7.3 URL: Submission from: (NULL) (217.12.195.21) Good day. I have MySQL database (server 5.5.20) which contain data about peoples and organizations. (Dump of this database and others files I have place on our ftp server: ftp://46.28.65.114 user: alien password: neversaynever - read only access). We need to get from LDAP accounts of peoples and organizations which have email (to Mozilla Thunderbird mail client). I setup OpenLDAP server with SQL backend, unixODBC etc. This bridge work, but have serious problem - slapd gives not all objects. I record to openldap.log full trace of loading slapd, connection of LDAP browser (Apache Directory Studio) and searching the request with base: "dc=ffsua,dc=com" and filter: "(mail=*@*)". At line #1432 backend-sql construct and run such query: SELECT DISTINCT ldap_entries.id, orgs.id, 'ffsOrganization' AS objectClass, ldap_entries.dn AS dn FROM ldap_entries, orgs WHERE orgs.id = ldap_entries.keyval AND ldap_entries.oc_map_id = 2 AND 9 = 9 AND orgs.omail IS NOT NULL AND (upper(orgs.omail) LIKE '%@%') Further in the log can be seen that backend-sql retrieves 19 records, but really in database - 22 suitable records (records with id=83,92,93 losted, look to file sql_query_result.csv). But if we watch in LDAP browser, we seen 17(!) records - look to file ldap_search_result.csv, lines with o=... I can not understand the principle on which the records drop out... Please answer, what are your opportunity to address this problem. If you have not - I'd rather know about it immediately - I will have to deal with the source. P.S. Sorry for my English...

1 0

Re: (ITS#7191) libmdb: Alignment of MDB_db members
by h.b.furuseth＠usit.uio.no 02 Mar '12

02 Mar '12

On Fri, 2 Mar 2012 08:03:00 GMT, roy.keene(a)us.army.mil wrote: > Breaking the assignment into an assignment of its members and using > the existing COPY_PGNO() alleviates this fault. memcpy would be simpler, if it is 'db' which is unaligned. Try this instead. --- mdb.c~ 2012-03-02 11:23:21 +++ mdb.c 2012-03-02 11:25:06 @@ -4699,4 +4699,3 @@ mdb_xcursor_init1(MDB_cursor *mc, MDB_no if (node->mn_flags & F_SUBDATA) { - MDB_db *db = NODEDATA(node); - mx->mx_db = *db; + memcpy(&mx->mx_db, NODEDATA(node), sizeof(MDB_db)); mx->mx_cursor.mc_snum = 0; -- Hallvard

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs