openldap-bugs

openldap-bugs@openldap.org

1 participants
20965 discussions

Re: (ITS#7053) back-monitor blocks
by michael＠stroeder.com 28 Sep '11

28 Sep '11

This is a multi-part message in MIME format. --------------070806090607090407080503 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit I can sometimes reproduce this with ldapsearch. But for whatever reason it's immediately reproducible with web2ldap browsing cn=Monitor. The configuration is quite small (see slapd.conf attached). $ strace -p $(cat run/slapd.pid) Process 6275 attached - interrupt to quit futex(0x7f6f246209d0, FUTEX_WAIT, 6276, NULL Here's what gdb outputs attached to the blocking process. (gdb) info threads 4 Thread 0x7f6f24620700 (LWP 6276) 0x00007f6f28b41cb3 in epoll_wait () from /lib64/libc.so.6 3 Thread 0x7f6f23e1f700 (LWP 6277) 0x00007f6f29a5f38c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 2 Thread 0x7f6f2361e700 (LWP 6285) 0x00007f6f29a61ea4 in __lll_lock_wait () from /lib64/libpthread.so.0 * 1 Thread 0x7f6f2aed9740 (LWP 6275) 0x00007f6f29a5bcb5 in pthread_join () from /lib64/libpthread.so.0 (gdb) thread apply all bt Thread 4 (Thread 0x7f6f24620700 (LWP 6276)): #0 0x00007f6f28b41cb3 in epoll_wait () from /lib64/libc.so.6 #1 0x0000000000437751 in slapd_daemon_task (ptr=0x0) at daemon.c:2528 #2 0x00007f6f29a5aa3f in start_thread () from /lib64/libpthread.so.0 #3 0x00007f6f28b4167d in clone () from /lib64/libc.so.6 #4 0x0000000000000000 in ?? () Thread 3 (Thread 0x7f6f23e1f700 (LWP 6277)): #0 0x00007f6f29a5f38c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 #1 0x00007f6f2aa94f23 in ldap_pvt_thread_cond_wait (cond=0x7cc7c0, mutex=0x7cc798) at thr_posix.c:277 #2 0x00007f6f2aa93999 in ldap_int_thread_pool_wrapper (xpool=0x7cc790) at tpool.c:672 #3 0x00007f6f29a5aa3f in start_thread () from /lib64/libpthread.so.0 #4 0x00007f6f28b4167d in clone () from /lib64/libc.so.6 #5 0x0000000000000000 in ?? () Thread 2 (Thread 0x7f6f2361e700 (LWP 6285)): #0 0x00007f6f29a61ea4 in __lll_lock_wait () from /lib64/libpthread.so.0 #1 0x00007f6f29a5d294 in _L_lock_999 () from /lib64/libpthread.so.0 #2 0x00007f6f29a5d0aa in pthread_mutex_lock () from /lib64/libpthread.so.0 #3 0x00007f6f2aa94f76 in ldap_pvt_thread_mutex_lock (mutex=0x96dcf0) at thr_posix.c:296 #4 0x00007f6f260492bf in monitor_cache_lock (e=0x88e7c8) at cache.c:117 #5 0x00007f6f2604824b in monitor_send_children (op=0x97d320, rs=0x7f6f2361da30, e_nonvolatile=0x88e728, e_ch=0x88f3a8, sub=1) at search.c:102 #6 0x00007f6f260483db in monitor_send_children (op=0x97d320, rs=0x7f6f2361da30, e_nonvolatile=0x88e1d8, e_ch=0x0, sub=1) at search.c:139 #7 0x00007f6f260488eb in monitor_back_search (op=0x97d320, rs=0x7f6f2361da30) at search.c:255 #8 0x000000000043f7fa in fe_op_search (op=0x97d320, rs=0x7f6f2361da30) at search.c:402 #9 0x000000000043f03e in do_search (op=0x97d320, rs=0x7f6f2361da30) at search.c:247 #10 0x000000000043b927 in connection_operation (ctx=0x7f6f2361db60, arg_v=0x97d320) at connection.c:1138 #11 0x000000000043bec5 in connection_read_thread (ctx=0x7f6f2361db60, argv=0xd) at connection.c:1274 #12 0x00007f6f2aa93a40 in ldap_int_thread_pool_wrapper (xpool=0x7cc790) at tpool.c:685 #13 0x00007f6f29a5aa3f in start_thread () from /lib64/libpthread.so.0 #14 0x00007f6f28b4167d in clone () from /lib64/libc.so.6 #15 0x0000000000000000 in ?? () Thread 1 (Thread 0x7f6f2aed9740 (LWP 6275)): #0 0x00007f6f29a5bcb5 in pthread_join () from /lib64/libpthread.so.0 #1 0x00007f6f2aa94e64 in ldap_pvt_thread_join (thread=140115328501504, thread_return=0x0) at thr_posix.c:197 #2 0x00000000004388b9 in slapd_daemon () at daemon.c:2922 #3 0x0000000000416c60 in main (argc=11, argv=0x7fff0ce78fd8) at main.c:983 (gdb) --------------070806090607090407080503 Content-Type: text/plain; name="slapd.conf" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="slapd.conf" # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # # Schemata aus der OpenLDAP-Distribution include /opt/openldap-RE24/etc/openldap/schema/core.schema include /opt/openldap-RE24/etc/openldap/schema/cosine.schema include /opt/openldap-RE24/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. pidfile /home/michael/temp/openldap-testbed-its7053/run/slapd.pid argsfile /home/michael/temp/openldap-testbed-its7053/run/slapd.args modulepath /opt/openldap-RE24/libexec/openldap ################################################################## # Load dynamic backend modules: ################################################################## moduleload back_hdb.la moduleload back_monitor.la ################################################################## # slapd global parameters ################################################################## #loglevel conns filter stats threads 6 sasl-secprops minssf=0 #sasl-realm STROEDER.COM ################################################################## # Rewrite SASL identity to DIT identity ################################################################## # EXTERNAL over Unix Domain socket authz-regexp "gidnumber=([0-9]+)\\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth" "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=$2)(gidNumber=$1))" # All mechs based on userID most times with password authz-regexp "uid=([a-zA-Z0-9]+),cn=(digest-md5|cram-md5|ntlm|plain|login|gssapi),cn=auth" "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(uid=$1)" ################################################################## # Global access control ################################################################## # Root DSE: allow anyone to read it access to dn.base="" by * read # Subschema (sub)entry DSE: allow anyone to read it access to dn.base="cn=Subschema" by * read ####################################################################### # Datenbank fuer Namensraum ou=schulung,dc=stroeder,dc=local ####################################################################### database hdb suffix "ou=schulung,dc=stroeder,dc=local" directory /home/michael/temp/openldap-testbed-its7053/data1/bv rootdn "uid=diradm,ou=schulung,dc=stroeder,dc=local" rootpw {SSHA}t2umh2Mbf7NVLBWhJ9DeHXrwmYPt3rSs lastmod on # Index-Konfiguration index objectClass eq checkpoint 200 5 # Entries to cache in memory cachesize 1000 # Search results to cache in memory idlcachesize 100 sizelimit -1 # DB_CONFIG parameters dbconfig set_cachesize 0 20000000 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 262144 dbconfig set_lg_max 10485760 dbconfig set_tas_spins 0 ################################################################################## # Berechtigungen im Namensraum ou=schulung,dc=stroeder,dc=local ################################################################################## access to attrs=userPassword by group="cn=Admins,ou=Groups,ou=schulung,dc=stroeder,dc=local" =wx by group="cn=Replicas,ou=Groups,ou=schulung,dc=stroeder,dc=local" read by self =wx by * =x access to dn.subtree="ou=schulung,dc=stroeder,dc=local" by group="cn=Admins,ou=Groups,ou=schulung,dc=stroeder,dc=local" write by group="cn=Replicas,ou=Groups,ou=schulung,dc=stroeder,dc=local" read by * None ####################################################################### # Monitor-Datenbank ####################################################################### database monitor access to dn.subtree="cn=Monitor" by * read --------------070806090607090407080503--

1 0

Re: (ITS#7047) slapd crash on bad indexed translucent
by hugo.monteiro＠fct.unl.pt 28 Sep '11

28 Sep '11

On 09/21/2011 09:38 PM, Pierangelo Masarati wrote: > Can you reproduce with latest release/master? Can you provide a minimal > configuration+data that allows to reproduce the issue? > > p. > Hello Pierangelo, We are in the middle of several migration processes and i don't have the time to dig further into this issue right now, particularly in regard to trying latest/master. I can however serve you with some extra data. our LDAP infrastructure is like this: 1 master (provider) ----- 2 slaves (consumer) ----- 2 proxys But the problem is happening in another server, which as a translucent overlay and several other very small local databases. that server configuration file is --- snip --- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/rfc2307bis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/unl.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/qmail.schema include /etc/ldap/schema/sudo.schema include /etc/ldap/schema/RADIUS-LDAPv3.schema include /etc/ldap/schema/dyngroup.schema include /etc/ldap/schema/hdb.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 idletimeout 600 threads 8 modulepath /usr/lib/ldap moduleload back_hdb moduleload memberof moduleload dynlist moduleload back_ldap moduleload translucent TLSCertificateFile /etc/ssl/certs/ldap.fct.unl.pt-2010-01-12.crt TLSCertificateKeyFile /etc/ssl/certs/ldap.fct.unl.pt-2010-01-12.key TLSCACertificateFile /etc/ssl/certs/ca-bundle.crt backend ldap sizelimit 100 timelimit unlimited include /etc/ldap/cdstaff.conf database hdb suffix "dc=unl,dc=pt" rootdn cn=cdstaff,dc=unl,dc=pt directory "/var/lib/ldap/dc=unl,dc=pt" lastmod on include /etc/ldap/acls.conf access to attrs=userPassword,sambaLMPassword,sambaNTPassword by dn.regex="cn=cpdunl,dc=unl,dc=pt" write by dn.regex="cn=readercpdunl,dc=unl,dc=pt" read by dn.regex="cn=cdstaff,dc=unl,dc=pt" write by self read by anonymous auth by * none access to * by dn.regex="cn=cpdunl,dc=unl,dc=pt" write by dn.regex="cn=cdstaff,dc=unl,dc=pt" write by * read index entryCSN eq index entryUUID eq index objectClass eq index uniqueIdentifier eq index displayName eq index uidNumber eq index gidNumber eq index title eq index uid eq,pres,sub,subinitial,subany,subfinal index member eq,pres index memberOf eq,pres index cn eq,sub,subinitial index sambaSID eq,pres,sub index sambaPrimaryGroupSID eq,pres index sambaSIDList eq,pres index sambaGroupType eq index memberUid eq index uniqueMember eq index sambaDomainName eq,pres index qmailUID eq index qmailGID eq index accountStatus eq index modifytimestamp eq index mailForwardingAddress eq index mail pres,eq,approx,sub index mailAlternateAddress pres,eq,approx,sub index mailHost pres,eq index radiusGroupName eq index sudoUser eq index krb5PrincipalName eq overlay translucent uri "ldap://ldap1.fct.unl.pt ldap://ldap2.fct.unl.pt" acl-bind binddn="cn=readercpdunl,dc=unl,dc=pt" credentials="h2qev49%71" translucent_strict translucent_local sambaAcctFlags,sambaAlgorithmicRidBase,sambaBadPasswordCount,sambaBadPasswordTime,sambaDomainName,sambaGroupType,sambaHomeDrive,sambaHomePath,sambaKickoffTime,sambaLogoffTime,sambaLogonHours,sambaLogonScript,sambaLogonTime,sambaMungedDial,sambaNextGroupRid,sambaNextRid,sambaNextUserRid,sambaPasswordHistory,sambaPrimaryGroupSID,sambaProfilePath,sambaPwdCanChange,sambaPwdLastSet,sambaPwdMustChange,sambaSID,sambaSIDList,sambaUserWorkstations --- snip --- That /etc/ldap/cdstaff.conf file contains the definitions of several local databases, which use no other overlays or special configuration. Its content is --- snip --- database hdb suffix "sambaDomainName=STAFF,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/sambaDomainName=STAFF,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,sambaDomainName,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="sambaDomainName=STAFF,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "ou=machines,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/ou=machines,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="ou=machines,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Administrator,ou=agentes,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Administrator,ou=agentes,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Administrator,ou=agentes,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Admins,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Admins,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Domain Admins,ou=grupos,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Users,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Users,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Guests,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Guests,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Domain Computers,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Domain Computers,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Domain Computers,ou=grupos,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Administrators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Administrators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="cn=Domain Guests,ou=grupos,dc=fct,dc=unl,dc=pt" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Users,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Users,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Guests,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Guests,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Account Operators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Account Operators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Print Operators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Print Operators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Backup Operators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Backup Operators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate database hdb suffix "cn=Replicators,ou=grupos,dc=fct,dc=unl,dc=pt" rootdn "cn=cdstaff,dc=unl,dc=pt" directory "/var/lib/ldap/cn=Replicators,ou=grupos,dc=fct,dc=unl,dc=pt" index objectClass,sambaSID,uid,uidNumber,gidNumber,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,displayName,cn eq lastmod on access to dn.base="" by * read access to * by dn="cn=cpdunl,dc=unl,dc=pt" write by dn="cn=readercpdunl,dc=unl,dc=pt" write by dn="cn=cdstaff,dc=unl,dc=pt" write by * read subordinate --- snip --- Some entry examples follow On the central LDAP infrastructure: hm@DIVINF-PC15:~$ ldapsearch -b "ou=agentes,dc=fct,dc=unl,dc=pt" -x -h ldap.fct.unl.pt "uid=hmmm" -LL version: 1 dn: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt mailQuotaSize: 10737418240 radiusGroupName: Adm deliveryMode: noreply mailReplyText:: TWVuc2FnZW0gZGUgYXV0by1yZXBseSBwYXJhIHRlc3RlLg0K uid: hmmm gidNumber: 1000 homeDirectory: /home/agentes/15093 loginShell: /bin/customshell givenName: Hugo sn: Monteiro gecos: Hugo Miguel Marques Monteiro cn: Hugo Monteiro displayName: Hugo Monteiro uidNumber: 15093 objectClass: top objectClass: uidObject objectClass: agenteUNL objectClass: shadowAccount objectClass: inetOrgPerson objectClass: posixAccount objectClass: sambaSamAccount objectClass: krb5Principal objectClass: krb5KDCEntry objectClass: qmailUser objectClass: radiusprofile uniqueIdentifier: 15093 title: Trabalhador FCT title: Aluno LEI-FCT accountStatus: active mailHost: mailstrg2.ci.fct.unl.pt qmailGID: 1000 qmailUID: 15093 mail: hmmm(a)fct.unl.pt mailAlternateAddress: hmmm(a)students.fct.unl.pt mailAlternateAddress: hugo.monteiro(a)fct.unl.pt mailForwardingAddress: fctunl-teste(a)fct.unl.pt krb5KDCFlags: 126 krb5PrincipalName: hmmm(a)FCT.UNL.PT sambaSID: S-1-5-21-588362536-2687990616-3095848848-30186 sambaPrimaryGroupSID: S-1-5-21-588362536-2687990616-3095848848-513 sambaHomeDrive: H: sambaLogonScript: logon.bat sambaAcctFlags: [UX ] sambaPwdLastSet: 1317217397 krb5KeyVersionNumber: 11 that same entry after translucent hm@DIVINF-PC15:~$ ldapsearch -b "ou=agentes,dc=fct,dc=unl,dc=pt" -x -h cdstaff.fct.unl.pt "uid=hmmm" -LL version: 1 dn: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt mailQuotaSize: 10737418240 radiusGroupName: Adm deliveryMode: noreply mailReplyText:: TWVuc2FnZW0gZGUgYXV0by1yZXBseSBwYXJhIHRlc3RlLg0K uid: hmmm gidNumber: 1000 homeDirectory: /home/agentes/15093 loginShell: /bin/customshell givenName: Hugo sn: Monteiro gecos: Hugo Miguel Marques Monteiro cn: Hugo Monteiro displayName: Hugo Monteiro uidNumber: 15093 objectClass: top objectClass: uidObject objectClass: agenteUNL objectClass: shadowAccount objectClass: inetOrgPerson objectClass: posixAccount objectClass: sambaSamAccount objectClass: qmailUser objectClass: radiusprofile objectClass: krb5Principal objectClass: krb5KDCEntry uniqueIdentifier: 15093 title: Trabalhador FCT title: Aluno LEI-FCT accountStatus: active mailHost: mailstrg2.ci.fct.unl.pt qmailGID: 1000 qmailUID: 15093 mail: hmmm(a)fct.unl.pt mailAlternateAddress: hmmm(a)students.fct.unl.pt mailAlternateAddress: hugo.monteiro(a)fct.unl.pt mailForwardingAddress: fctunl-teste(a)fct.unl.pt krb5KDCFlags: 126 krb5PrincipalName: hmmm(a)FCT.UNL.PT sambaSID: S-1-5-21-1327543176-3185848629-1254536839-31186 sambaPrimaryGroupSID: S-1-5-21-1327543176-3185848629-1254536839-513 sambaHomeDrive: H: sambaLogonScript: logon.bat sambaAcctFlags: [UX ] sambaPwdLastSet: 1317217397 krb5KeyVersionNumber: 11 and finaly just the local part to the problematic server dn: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt uidNumber: 15093 sambaSID: S-1-5-21-1327543176-3185848629-1254536839-31186 sambaHomeDrive: H: sambaLogonScript: logon.bat sambaAcctFlags: [UX ] sambaPrimaryGroupSID: S-1-5-21-1327543176-3185848629-1254536839-513 We noticed that the crash would also happen if the query was like (&(uid=*)(objectClass=sambaSamAccount)), BUT is does not happen every time. Happens mostly when there is more usage, but nothing like high loads or anything. We've had problems every morning, around 9am, when everyone would login to their workstation. I then gave the VM more resources and since 2 days ago there has been no problem (so far). I would love to be able to help a bit more, perhaps with a core file, but i'm really lacking time atm. I will try to provide a core in a couple of days or so. Let me know if there is any special way to collect the information you need. Best regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

1 0

(ITS#7053) back-monitor blocks
by michael＠stroeder.com 28 Sep '11

28 Sep '11

Full_Name: Michael Ströder Version: 2.4.26 OS: openSUSE Linux URL: Submission from: (NULL) (192.166.104.102) When doing LDAP searches on cn=Monitor the search thread blocks and the only way to stop slapd is kill -9 then. One can completely block slapd with this. More information will follow (want to grab the ITS# first).

1 0

(ITS#7052) Spurious CSNs being recorded on syncrepl consumers.
by cmikk＠qwest.net 26 Sep '11

26 Sep '11

Full_Name: Chris Mikkelson Version: 2.4.26 OS: FreeBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (204.147.85.37) When the provider sends a search response with state 'delete' with no / null cookie, the syncrepl consumer queues an locally-generated CSN and updates its context CSN with that. This appears to happen only with cookie-less deletion, not with cookie-less modification. I have not observed a cookie-less addition, so I do not know if it occurs there, too. Example logs from a pure consumer (no server-id, replicating from a provider with server id 002): Sep 26 13:05:42 mpls-auth-02 slapd[57295]: do_syncrep2: rid=100 cookie= Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 be_search (0) Sep 26 13:05:42 mpls-auth-02 slapd[57295]: syncrepl_entry: rid=100 uid=<snip>,ou=improv,dc=qwest,dc=net Sep 26 13:05:42 mpls-auth-02 slapd[57295]: slap_queue_csn: queing 0x7ffffe3fa560 20110926130542.130924Z#000000#000#000000 Sep 26 13:05:42 mpls-auth-02 slapd[57295]: slap_graduate_commit_csn: removing 0x8f58a8a90 20110926130542.130924Z#000000#000#000000 This is problematic at our site because the provider cookie contains a SID 0 CSN from before we migrated to multimaster, and the SID 0 CSN recorded at the consumer renders the consumer state newer than the provider, breaking replication.

1 0

(ITS#7051) ldap_pvt_tls_get_peer_dn fails under gnutls
by giampaolo＠tomassoni.biz 25 Sep '11

25 Sep '11

Full_Name: Giampaolo Tomassoni Version: 2.4.24 OS: Linux 2.6.39-gentoo-r3 URL: Submission from: (NULL) (79.23.61.128) A triky mistake (is it a typo?) in libraries/libldap/tls_g.c:tlsg_x509_cert_dn prevents a gnutls-enabled server to correctly obtain the "subject" ASN.1 tree from the client's certificate. This is the needed patch: --- libraries/libldap/tls_g.c.wrong 2011-09-25 14:58:30.000000000 +0200 +++ libraries/libldap/tls_g.c 2011-09-25 14:35:06.000000000 +0200 @@ -530,7 +530,7 @@ ber_init2( ber, cert, LBER_USE_DER ); tag = ber_skip_tag( ber, &len ); /* Sequence */ tag = ber_skip_tag( ber, &len ); /* Sequence */ - tag = ber_skip_tag( ber, &len ); /* Context + Constructed (version) */ + tag = ber_peek_tag( ber, &len ); /* Context + Constructed (version) */ if ( tag == 0xa0 ) /* Version is optional */ tag = ber_get_int( ber, &i ); /* Int: Version */ tag = ber_skip_tag( ber, &len ); /* Int: Serial (can be longer than ber_int_t) */ Basically, the optional version field in the certificate wasn't peeked, but rather skipped. This resulted in walking in the certificate tree in the wrong way, thereby impairing a correct result from libraries/libldap/tls2.c:ldap_pvt_tls_get_peer_dn. I'm not using sasl, so I can't be sure about this, but I guess this problem could impair client authentication via certificate using the sasl external method.

1 0

(ITS#7050) meta stop at the first unreachable candidate
by victor.gattegno＠gmail.com 23 Sep '11

23 Sep '11

Full_Name: victor gattegno Version: 2.4.26 OS: CentOS 5.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (88.181.196.138) Hello, With OpenLDAP 2.4.26, as soon as a candidate directory is unreachable, other directories are not requested by the proxy ; that problem doesn't occur in 2.4.23. It is described in: http://www.openldap.org/lists/openldap-technical/201108/msg00221.html and there is a complete example in: http://www.openldap.org/lists/openldap-technical/201109/msg00044.html I modified openldap-2.4.26/servers/slapd/back-meta/search.c (lines 192 to 198) as follow, and then the problem is solved. I replaced in OpenLDAP 2.4.26 search.c, (from line 192): switch ( rc ) { case LDAP_SUCCESS: break; case LDAP_UNAVAILABLE: goto down; default: goto other; } by (like it was in 2.4.23): if ( rc != LDAP_SUCCESS ) { goto down; } Here is the diff : 192,195c192 < switch ( rc ) { < case LDAP_SUCCESS: < break; < case LDAP_UNAVAILABLE: --- > if ( rc != LDAP_SUCCESS ) { 197,198d193 < default: < goto other; Rgds.

1 0

(ITS#7049) DEL/LDAP_SYNC_DELETE race touching entryCSN
by ebackes＠symas.com 22 Sep '11

22 Sep '11

Full_Name: Emily Backes Version: 2.4.26 OS: any URL: Submission from: (NULL) (76.88.107.46) Similar to the recent overlay fixes to prevent updating entryCSN/contextCSN on local changes, delete operations can cause inappropriate CSN setting on remote servers. Given a multi-master setup (normal syncrepl tested), so that each server has a serverID set, with no overlays loaded other than syncprov, set up two or more threads of delete operations; three or more seems to most reliably reproduce the problem on the systems I've tested. As the deletes are happening, the server1 side should of course show it's entryCSN updating: dn: dc=example,dc=com contextCSN: 20110923044343.412634Z#000000#001#000000 This should of course be mirrored on the server2 side with contextCSN exactly matching the set of CSN's from the server1 side. Instead, after enough concurrent deletes to hit the race: dn: dc=example,dc=com contextCSN: 20110923044343.412634Z#000000#001#000000 contextCSN: 20110923044349.314803Z#000000#002#000000 This happens even though server2 has never received any local write operations (or indeed any connection other than the syncrepl search from server1 and my searches to retrieve contextCSN). Again, no overlays are loaded. This breaks syncrepl's assumptions and can result in other replication problems as a result of CSN desync. Working on tracing out exactly where it goes awry...

1 0

Re: (ITS#7047) slapd crash on bad indexed translucent
by Pierangelo Masarati 21 Sep '11

21 Sep '11

Can you reproduce with latest release/master? Can you provide a minimal configuration+data that allows to reproduce the issue? p.

1 0

Re: (ITS#7048) Non root binding causes assert
by Pierangelo Masarati 21 Sep '11

21 Sep '11

> Full_Name: Aitor Carrera Please check with latest release (or master code); please upload patches according to <http://www.openldap.org/devel/contributing.html>. p.

1 0

Re: (ITS#7048) Non root binding causes assert
by aitor.carrera＠edosoftfactory.com 21 Sep '11

21 Sep '11

--20cf307abe69d114a404ad78b34e Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable With this pacth it is solved, we added a precompiler macro to contribute th= e patch because we are not sure about security issues related this problem. META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATING_EXPIRED_CONNECTION =3D> It m= ust be defined for solving this issue diff -Naur openldap-2.4.21.orig/servers/slapd/back-meta/conn.c openldap-2.4.21/servers/slapd/back-meta/conn.c --- openldap-2.4.21.orig/servers/slapd/back-meta/conn.c 2011-07-26 13:40:40.989376998 +0200 +++ openldap-2.4.21/servers/slapd/back-meta/conn.c 2011-07-26 13:51:40.537383269 +0200 @@ -1156,6 +1156,9 @@ mc =3D NULL; } else { +#ifdef META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATING_EXPIRED_CONNECTION + if ( mc->mc_refcnt =3D=3D 0) +#endif if ( ( mi->mi_conn_ttl !=3D 0 && op->o_time > mc->mc_create_time + mi->mi_conn_ttl ) || ( mi->mi_idle_timeout !=3D 0 && op->o_time > mc->mc_time + mi->mi_idle_timeout ) ) { Regards -------------------------------------------------------- Aitor Carrera Hern=E1ndez - Edosoft Factory Telf. +34 828021575 Fax. +34 828066081 Antonio Mar=EDa Manrique 3, Planta 2 - Oficina 6. 35011 Las Palmas de Gran Canaria -------------------------------------------------------- --20cf307abe69d114a404ad78b34e Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div>With this pacth it is solved, we added a precompiler macro to contribu= te the patch because we are not sure about security issues related this pro= blem.</div><div><br></div><div>META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATI= NG_EXPIRED_CONNECTION =3D> It must be defined for solving this issue</di= v> <div><br></div><div><br></div><div><span class=3D"Apple-style-span" style= =3D"font-family: 'Times New Roman'; font-size: medium; "><pre style= =3D"word-wrap: break-word; white-space: pre-wrap; ">diff -Naur openldap-2.4= .21.orig/servers/slapd/back-meta/conn.c openldap-2.4.21/servers/slapd/back-= meta/conn.c --- openldap-2.4.21.orig/servers/slapd/back-meta/conn.c 2011-07-26 13:40:40= .989376998 +0200 +++ openldap-2.4.21/servers/slapd/back-meta/conn.c 2011-07-26 13:51:40.5373= 83269 +0200 @@ -1156,6 +1156,9 @@ mc =3D NULL; =20 } else { +#ifdef META_BACK_REFCNT_MUST_BE_ZERO_FOR_INVALIDATING_EXPIRED_CONNECTION + if ( mc->mc_refcnt =3D=3D 0) +#endif if ( ( mi->mi_conn_ttl !=3D 0 && op->o_time > mc->= mc_create_time + mi->mi_conn_ttl ) || ( mi->mi_idle_timeout !=3D 0 && op->o_time > mc-&= gt;mc_time + mi->mi_idle_timeout ) ) {</pre><pre style=3D"word-wrap: break-word; white-space: pre-wrap; "><= br></pre><pre style=3D"word-wrap: break-word; white-space: pre-wrap; ">Rega= rds</pre></span></div><div><br></div>--------------------------------------= ------------------<br> Aitor Carrera Hern=E1ndez - Edosoft Factory<br>Telf. +34 828021575<br>Fax. = +34 828066081<br>Antonio Mar=EDa Manrique 3, Planta 2 - Oficina 6.<br>35011= Las Palmas de Gran Canaria<br>--------------------------------------------= ------------<br> --20cf307abe69d114a404ad78b34e--

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs