openldap-bugs

openldap-bugs@openldap.org

1 participants
20965 discussions

(ITS#6993)
by yann.carre＠alcatel-lucent.com 22 Aug '11

22 Aug '11

Hello This problem occurs at the end of the connection init. At the end of the connection_init, the connection is provided to the listener list (through slapd_add_internal call) and then, the connection mutex is freed. ==> At this point, the connection is available to the listener but the back end initialization has not been done. The backend_connection_init call is done out of the connection mutex protection. If the connection mutex is freed after the connection_init call, all the back end should performed their initialization before it could be used in the operation Regards Yann Carre

1 0

Re: (ITS#6993) Backend Connection problem
by masarati＠aero.polimi.it 22 Aug '11

22 Aug '11

[you must reply to the ITS to have your messages injected in the system] > Hello > > This problem occurs at the end of the connection init. > At the end of the connection_init, the connection is provided to the > listener list (through slapd_add_internal call) and then, the connection > mutex is freed. > > ==> At this point, the connection is available to the listener but the > back end initialization has not been done. > > The backend_connection_init call is done out of the connection mutex > protection. > If the connection mutex is freed after the connection_init call, all the > back end should performed their initialization before it could be used > in the operation

1 0

(ITS#7024) OpenLDAP does not save the attribute "jpegPhoto" in the sql database
by daniil＠chics.ru 21 Aug '11

21 Aug '11

Full_Name: Daniil Harun Version: 2.4.26 OS: FreeBSD, Linux URL: Submission from: (NULL) (80.85.151.246) OpenLDAP does not save the attribute "jpegphoto" in the sql database. Use back-sql, unixodbc and postgresql database. The reason for the problem of the use of the data type SQL_VARCHAR instead of SQL_LONGVARBINARY. slapd debug output: backsql_modify_internal(): adding new values for attribute "jpegPhoto" backsql_modify_internal(): arg(2)=1 backsql_modify_internal(): arg(1)="����"; executing "UPDATE personal SET jpegphoto=? WHERE id=?" backsql_modify_internal(): add_proc execution failed (rc=-1, prc=0) Return code: -1 nativeErrCode=7 SQLengineState=22021 msg="ERROR: invalid byte sequence for encoding "UTF8": 0xff; Error while executing the query" SQL tracing is enabled: [ODBC][23880][1313994179.641693][SQLPrepare.c][196] Entry: Statement = 0x293eae00 SQL = [UPDATE personal SET jpegphoto=? WHERE id=?][length = 42 (SQL_NTS)] [ODBC][23880][1313994179.641791][SQLPrepare.c][371] Exit:[SQL_SUCCESS] [ODBC][23880][1313994179.641886][SQLBindParameter.c][217] Entry: Statement = 0x293eae00 Param Number = 2 Param Type = 1 C Type = -27 SQL_C_UBIGINT SQL Type = 4 SQL_INTEGER Col Def = 0 Scale = 0 Rgb Value = 0xbf1fc7a4 Value Max = 0 StrLen Or Ind = 0x0 [ODBC][23880][1313994179.641988][SQLBindParameter.c][397] Exit:[SQL_SUCCESS] [ODBC][23880][1313994179.642182][SQLBindParamet[ODBC][23880][1313994179.641693][SQLPrepare.c][196] Entry: Statement = 0x293eae00 SQL = [UPDATE personal SET jpegphoto=? WHERE id=?][length = 42 (SQL_NTS)] [ODBC][23880][1313994179.641791][SQLPrepare.c][371] Exit:[SQL_SUCCESS] [ODBC][23880][1313994179.641886][SQLBindParameter.c][217] Entry: Statement = 0x293eae00 Param Number = 2 Param Type = 1 C Type = -27 SQL_C_UBIGINT SQL Type = 4 SQL_INTEGER Col Def = 0 Scale = 0 Rgb Value = 0xbf1fc7a4 Value Max = 0 StrLen Or Ind = 0x0 [ODBC][23880][1313994179.641988][SQLBindParameter.c][397] Exit:[SQL_SUCCESS] [ODBC][23880][1313994179.642182][SQLBindParameter.c][217] Entry: Statement = 0x293eae00 Param Number = 1 Param Type = 1 C Type = 1 SQL_C_CHAR SQL Type = 12 SQL_VARCHAR Col Def = 2790 Scale = 0 Rgb Value = 0x29529700 Value Max = 2790 StrLen Or Ind = 0x0 [ODBC][23880][1313994179.642284][SQLBindParameter.c][397] Exit:[SQL_SUCCESS] [ODBC][23880][1313994179.642741][SQLExecute.c][187] Entry: Statement = 0x293eae00 [ODBC][23880][1313994179.645733][SQLExecute.c][348] Exit:[SQL_ERROR] DIAG [22021] ERROR: invalid byte sequence for encoding "UTF8": 0xff; Error while executing the query er.c][217] Entry: Statement = 0x293eae00 Param Number = 1 Param Type = 1 C Type = 1 SQL_C_CHAR SQL Type = 12 SQL_VARCHAR Col Def = 2790 Scale = 0 Rgb Value = 0x29529700 Value Max = 2790 StrLen Or Ind = 0x0 [ODBC][23880][1313994179.642284][SQLBindParameter.c][397] Exit:[SQL_SUCCESS] [ODBC][23880][1313994179.642741][SQLExecute.c][187] Entry: Statement = 0x293eae00 [ODBC][23880][1313994179.645733][SQLExecute.c][348] Exit:[SQL_ERROR] DIAG [22021] ERROR: invalid byte sequence for encoding "UTF8": 0xff; Error while executing the query OpenLDAP uses the wrong data - types SQL_C_CHAR,SQL_VARCHAR instead of SQL_C_BINARY,SQL_LONGVARBINARY. How to make use of the correct data types?

1 0

ITS#7021
by masarati＠aero.polimi.it 20 Aug '11

20 Aug '11

All in all, I think it is better to stick with the spec and with the documentation, although I also added some notes to slapo-ppolicy(5). p.

1 0

Re: (ITS#6997) Segmentation fault when using slapo-rwm and slapo-chain
by masarati＠aero.polimi.it 19 Aug '11

19 Aug '11

> Full_Name: Manuel Gaupp > Version: 2.4.26 > OS: Linux 2.6.18 (CentOS 5.6 x86_64) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (93.208.112.253) > > > Under the following circumstances OpenLDAP crashes when a chained search > does not return with result code 0: > - "rwm" overlay used in a global context > - "chain" overlay used in a database specifix context > > (gdb) bt > #0 0x0000000400040004 in ?? () > #1 0x000000000042e5c7 in slap_cleanup_play (op=0x197834b0, rs=0x42a07ca0) > at result.c:539 > #2 0x000000000042ef9b in send_ldap_response (op=0x197834b0, > rs=0x42a07ca0) > at result.c:724 > #3 0x000000000042fcf9 in slap_send_ldap_result (op=0x197834b0, > rs=0x42a07ca0) at result.c:851 > #4 0x00000000004d982a in ldap_chain_response (op=0x197834b0, > rs=0x42a07ca0) at chain.c:1165 > #5 0x00000000004820ca in over_back_response (op=0x197834b0, > rs=0x42a07ca0) > at backover.c:237 > #6 0x000000000042e535 in slap_response_play (op=0x197834b0, > rs=0x42a07ca0) > at result.c:505 > #7 0x000000000042ef78 in send_ldap_response (op=0x197834b0, > rs=0x42a07ca0) > at result.c:579 > #8 0x000000000042fcf9 in slap_send_ldap_result (op=0x197834b0, > rs=0x42a07ca0) at result.c:851 > #9 0x00000000004928f0 in bdb_search (op=0x197834b0, rs=0x42a07ca0) > at search.c:499 > #10 0x0000000000482352 in overlay_op_walk (op=0x197834b0, rs=0x42a07ca0, > which=op_search, oi=0x196f3bb0, on=0x0) at backover.c:671 > #11 0x00000000004828b7 in over_op_func (op=0x197834b0, rs=0x42a07ca0, > which=op_search) at backover.c:723 > #12 0x0000000000421cf9 in fe_op_search (op=0x197834b0, rs=0x42a07ca0) > at search.c:402 > #13 0x0000000000482352 in overlay_op_walk (op=0x197834b0, rs=0x42a07ca0, > which=op_search, oi=0x1970fd30, on=0x0) at backover.c:671 > #14 0x00000000004828b7 in over_op_func (op=0x197834b0, rs=0x42a07ca0, > which=op_search) at backover.c:723 > #15 0x0000000000422505 in do_search (op=0x197834b0, rs=0x42a07ca0) > at search.c:247 > #16 0x000000000041fa95 in connection_operation (ctx=0x42a07d70, > arg_v=<value optimized out>) at connection.c:1138 > #17 0x0000000000503d5c in ldap_int_thread_pool_wrapper (xpool=0x196beee0) > at tpool.c:685 > #18 0x000000316820673d in start_thread () from /lib64/libpthread.so.0 > #19 0x0000003167ad44bd in clone () from /lib64/libc.so.6 > > OpenLDAP 2.4.26 was built using: > ./configure --enable-rewrite --enable-ldap --enable-rwm --enable-bdb > > This issue can be reproduced using the following configuration > (referred as 'slapd.conf.proxy') > ------------------------------------------ > overlay rwm > # There might be some rewrite directives > database bdb > suffix "o=example" > rootdn "cn=admin,o=example" > rootpw secret > directory /root/db.proxy > overlay chain > chain-return-error true > chain-uri "ldap://localhost:38977" > ------------------------------------------ > The process is started on port 389 with plain ldap > /usr/local/libexec/slapd -f slapd.conf.proxy -h "ldap://localhost:389" > > Create the following entry in this server: > dn: cn=ldap,o=example > objectclass: extensibleObject > objectclass: referral > ref: ldap://localhost:38977/cn=real,o=example > > To reproduce the error there has to be another server where the referral > points to. It contains the following minimal configuration: > (referred as 'slapd.conf.server') > ------------------------------------------ > database bdb > suffix "cn=real,o=example" > rootdn "cn=admin,cn=real,o=example" > rootpw secret > directory /root/db.server > ------------------------------------------ > The process is started on port 38977 with plain ldap > /usr/local/libexec/slapd -f slapd.conf.server -h "ldap://localhost:38977" > > Using the following ldapsearch, slapd crashes: > ldapsearch -h localhost -p 389 -D "cn=admin,o=example" -w secret \ > -x -b "ou=abc,cn=ldap,o=example" 1.1 > > Whereas the following ldapsearch returns with "success" > ldapsearch -h localhost -p 389 -D "cn=admin,o=example" -w secret \ > -x -b "cn=ldap,o=example" 1.1 > > Deactivating the "rwm" overlay prevents from this issue. So I think the > problem can be found somewhere in the rwm sources. I'm afraid that's unavoidable given the stacking order of the overlays. This will likely be fixed only when ITS#6166 is addressed, i.e. in OpenLDAP 2.5. p.

1 0

Re: (ITS#6993) Backend Connection problem
by masarati＠aero.polimi.it 19 Aug '11

19 Aug '11

> Full_Name: Yann Carre > Version: 2.4.26 > OS: red hat 5 (64 bits) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (64.208.49.20) > > > I work on a specific Backend > I have provided in my back end a function to the bi_connection_init > pointer. > This function adds a context needed in the operation backend function > (search, > ...) > > When several connections start up, my LDAP server crashes. > The crash arrives because the context is not created before the call to > do_searh. > The connection is provided to the application Backend before my Back end > connection_init. > I have checked it with the debugger and see that the thread with > initialize the > connection is suspend before the backend connection_init. In another > thread, the > search function is executed without any context attached to the > connection. > > This problem seems to be bring because the connection mutex is freed > before the > calling of the Back end connection_init in the function connection_init > (connection.c). > > I have moved this mutex after the backend connection_init and it seems to > work. > > Would you confirm this analysis and take the correction in account? Honestly, if that context you mention is connection-specific, I don't see how this could happen, since operations on that connection should not be possible until connection_init() returns. OTOH, if the context is global, you should initialize it differently, and protect it from being used before its initialization is complete, e.g. by a specific mutex that is completely internal to your backend. In any case, it is not clear how this can be an OpenLDAP bug. You should provide a clearer evidence. In the absence, I'd consider this ITS closed. p.

1 0

Re: (ITS#7021) pwdAllowUserChange: FALSE disallows password change by anybody
by masarati＠aero.polimi.it 19 Aug '11

19 Aug '11

> masarati(a)aero.polimi.it wrote: >> The patch is the result of my reading in 5 minutes a single portion of a >> spec I read in detail years ago, so my interpretation could not be the >> most correct. > > But your interpretation makes sense: E.g. system accounts most times do > not > need to change their own password. And for security reasons you might want > to > avoid that. Think of a the case where the password of a more exposed > system is > known by an attacker (which is likely a very bad case anyway). But at > least > the attacker should not be able to disable this service by setting a new > password. > > Yes, this can be done with ACLs. But you might already have a password > policy > assigned to this special system accounts because you don't want the system > accounts' password to expire. So adding an extra ACL is more work > especially > if system accounts are spread across a more complicated DIT. Well, as a counter-example, if security is compromised, then setting pwdAllowUserChange to FALSE would only prevent password modification for users that fall under that password policy, while others would need to be protected anyway using ACLs. And if security is seriously compromised, none of these would work, because rootdn circumvents all checks. So giving different orthogonal means to obtain similar but not identical effects sounds to me making things more complicated than they ought to be. Given the fact that pwdAllowUserChange is a gross subset of ACLs, I'd rather discourage its usage through clear documentation than try to make it conform to some or some other interpretation of the specs. p.

1 0

Re: (ITS#7021) pwdAllowUserChange: FALSE disallows password change by anybody
by michael＠stroeder.com 18 Aug '11

18 Aug '11

masarati(a)aero.polimi.it wrote: > The patch is the result of my reading in 5 minutes a single portion of a > spec I read in detail years ago, so my interpretation could not be the > most correct. But your interpretation makes sense: E.g. system accounts most times do not need to change their own password. And for security reasons you might want to avoid that. Think of a the case where the password of a more exposed system is known by an attacker (which is likely a very bad case anyway). But at least the attacker should not be able to disable this service by setting a new password. Yes, this can be done with ACLs. But you might already have a password policy assigned to this special system accounts because you don't want the system accounts' password to expire. So adding an extra ACL is more work especially if system accounts are spread across a more complicated DIT. Ciao, Michael.

1 0

(ITS#7023) TLSCACertificateFile description in slapd.conf.5 is missing critical information
by Frank.Swasey＠uvm.edu 18 Aug '11

18 Aug '11

Full_Name: Francis Swasey Version: 2.4.26 OS: Linux URL: http://www.uvm.edu/~fcs/0001-document-TLSCACertificateFile-in-the-man-page.… Submission from: (NULL) (132.198.107.64) The following referenced patch copies critical information that should be in the slapd.conf.5 man page from the admin guide: http://www.uvm.edu/~fcs/0001-document-TLSCACertificateFile-in-the-man-page.…

1 0

Re: (ITS#7021) pwdAllowUserChange: FALSE disallows password change by anybody
by masarati＠aero.polimi.it 18 Aug '11

18 Aug '11

> masarati(a)aero.polimi.it wrote: >>>> Then the patch is trivial: >>>> [..] >>>> If there's consensus, I'll commit it. >>> >>> Seems like a pointless change. You must set ACLs for this type of >>> modification >>> to be allowed. Since you must set ACLs anyway, there is no good reason >>> to >>> use >>> the pwdAllowUserChange policy setting in the first place. In general >>> the >>> pwdAllowUserChange option is only useful on systems that do not already >>> provide fine grained access controls. >> >> Agree (see my previous message). For this purpose, I suggest to add, in >> slapo-ppolicy(5), a comment about discouraging the use of >> pwdAllowUserChange since OpenLDAP provides fine-grain ACLs. > > I already knew that this can be achieved by ACLs but... > > 1. OpenLDAP should behave as stated in the ppolicy spec and the man-pages. > > 2. sometimes it'd be more handy to use this flag in an already existing > pwdPolicy entry than defining additional ACLs. > > Since this patch seems so trivial why not commit it? The patch is the result of my reading in 5 minutes a single portion of a spec I read in detail years ago, so my interpretation could not be the most correct. Since Howard implemented slapo-ppolicy(5), I believe his interpretation of the spec is more accurate. The fact that he interprets this flag as a complete replacement of ACLs on systems where they are not granular enough lets me think that its behavior should be broader (i.e. apply to all users) rather than strictly sticking to the word (i.e. apply to self only). That's why I'm seeking consensus before committing a patch (that could be harmful, as the current behavior of slapo-ppolicy(5) makes this flag work as a complete alternative to ACLs, while the new behavior, not complemented by appropriate ACLs, could allow anybody but self to change the pwd). p.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs