openldap-bugs

openldap-bugs@openldap.org

1 participants
20961 discussions

(ITS#6677) unregister_supported_control not under ifdef control
by doug.leavitt＠oracle.com 16 Oct '10

16 Oct '10

Full_Name: Douglas Leavitt Version: HEAD OS: OpenSolaris URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (192.18.43.225) The definition of unregister_supported_control is ifdef'd SLAP_CONFIG_DELETE but one reference in sssvlv.c is not. Compiling HEAD in a non Devel configuration will cause link failures. Suggested fix: --- openldap/servers/slapd/overlays/sssvlv.c.bad Wed Oct 13 12:08:18 2010 +++ openldap/servers/slapd/overlays/sssvlv.c Thu Oct 14 23:32:31 2010 @@ -1183,12 +1183,12 @@ if ( rc != LDAP_SUCCESS ) { Debug( LDAP_DEBUG_ANY, "Failed to register VLV Request control '%s' (%d)\n", LDAP_CONTROL_VLVREQUEST, rc, 0 ); #ifdef SLAP_CONFIG_DELETE overlay_unregister_control( be, LDAP_CONTROL_SORTREQUEST ); -#endif /* SLAP_CONFIG_DELETE */ unregister_supported_control( LDAP_CONTROL_SORTREQUEST ); +#endif /* SLAP_CONFIG_DELETE */ return rc; } } si = (sssvlv_info *)ch_malloc(sizeof(sssvlv_info));

1 0

Re: (ITS#6676) Some slap-commands remove nssov overlay socket
by hyc＠symas.com 16 Oct '10

16 Oct '10

sergei(a)bslos.com wrote: > Full_Name: Sergei Butakov > Version: 2.4.23 > OS: Linux > URL: > Submission from: (NULL) (94.190.117.137) > > > I'm using nssov overlay (and nss-pam-ldapd-0.7.10). > > > Some slap-commands remove nssov overlay socket "/var/run/nslcd/socket" (it shows > "strace slapcat"). > > For example, next commands remove socket: > slapcat -n 2, slapschema -n 2, slapacl<anything> > > But these ones do not remove: > slapcat -n 1, slapschema -n 1, slapdn<anything> Thanks for the report, fixed in CVS HEAD. > > > To avoid this, I commented out in contrib/slapd-modules/nssov/nssov.c file > from 890 to 894 lines (in nssov_db_close() function). Now the socket exists > even if slapd is stopped. But it seems that it does not interfere with > anything. > > > I have in slapd.conf two database: > ... > ... > database monitor > rootdn "cn=Manager" > ... > database hdb > suffix "" > rootdn "cn=Manager" > > overlay nssov > nssov-map aliases rfc822MailMember x-bsl-mailMember > nssov-map group uniqueMember member > nssov-ssd passwd > ldap:///??sub?(&(objectClass=posixAccount)(objectClass=sambaSamAccount)) > > overlay smbk5pwd > overlay memberof > ... > overlay refint > ... > ... > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6673) ldap_unbind() hangs on unreachable LDAP server when using TLS
by hyc＠symas.com 16 Oct '10

16 Oct '10

Arthur de Jong wrote: > On Thu, 2010-10-14 at 14:42 -0700, Howard Chu wrote: >> What is the GnuTLS version number? Seems like you should be submitting >> this to their tracker anyway, as the original reporter. > > I'm using GnuTLS 2.8.6. I've just also tried with GnuTLS 2.10.2 which > shows the same behaviour. > > I've reported it to > https://savannah.gnu.org/support/index.php?107495 > feel free to add any more pointers that may be useful. > > Anyway, thanks for your help. > Based on the discussion there, I've committed the workaround I already mentioned in my previous reply. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6676) Some slap-commands remove nssov overlay socket
by sergei＠bslos.com 15 Oct '10

15 Oct '10

Full_Name: Sergei Butakov Version: 2.4.23 OS: Linux URL: Submission from: (NULL) (94.190.117.137) I'm using nssov overlay (and nss-pam-ldapd-0.7.10). Some slap-commands remove nssov overlay socket "/var/run/nslcd/socket" (it shows "strace slapcat"). For example, next commands remove socket: slapcat -n 2, slapschema -n 2, slapacl <anything> But these ones do not remove: slapcat -n 1, slapschema -n 1, slapdn <anything> To avoid this, I commented out in contrib/slapd-modules/nssov/nssov.c file from 890 to 894 lines (in nssov_db_close() function). Now the socket exists even if slapd is stopped. But it seems that it does not interfere with anything. I have in slapd.conf two database: ... ... database monitor rootdn "cn=Manager" ... database hdb suffix "" rootdn "cn=Manager" overlay nssov nssov-map aliases rfc822MailMember x-bsl-mailMember nssov-map group uniqueMember member nssov-ssd passwd ldap:///??sub?(&(objectClass=posixAccount)(objectClass=sambaSamAccount)) overlay smbk5pwd overlay memberof ... overlay refint ... ...

1 0

Re: (ITS#6673) ldap_unbind() hangs on unreachable LDAP server when using TLS
by arthur＠arthurdejong.org 15 Oct '10

15 Oct '10

--=-ex4J6k12RcsGQxVIbjnQ Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, 2010-10-14 at 14:42 -0700, Howard Chu wrote: > What is the GnuTLS version number? Seems like you should be submitting > this to their tracker anyway, as the original reporter. I'm using GnuTLS 2.8.6. I've just also tried with GnuTLS 2.10.2 which shows the same behaviour. I've reported it to https://savannah.gnu.org/support/index.php?107495 feel free to add any more pointers that may be useful. Anyway, thanks for your help. --=20 -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org -- --=-ex4J6k12RcsGQxVIbjnQ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAABAgAGBQJMuAfmAAoJECqLdGgQ4K/Bws4P/3AP3NwmRZeO8feXY/F9wFwI NTr7zxjHjbdVOoOjS81YPIDGXrefDx5kV5ufpVhDI7ojZSyhJc7rKRu7mpEiWzZH pYIm9h+pFvRBSp4uGYGmlWQlkZHYNZFCYTNJo2+srl/evqyd4vKlvuMMn5QHlb8g DCJEf+3Zo2+kd42V0WdVcpOuTcTjvGzGEd5SLRHjHvcjSX/YTW4JijgiBILqN745 ei8jyE1qpm/N6W2Zevb+XRhnQ6g5X95UmFNeWie8PNWGgpMu0IhRh79cPX25wOIK 4fSVDTW6rNnKR4E9rtJkhl/VwYNSQgwd9g0kyhinCn3sswa1UGxs6abBcF8sILIe tEGiUJ7ZtJU4bA9uiILgGu94AV/zwkfqGC9y2q14jJ3N/28IcJIScWGqeYHaKZ1U uB+2Y33fmEbXaAUBjPng4dNmnmrtNU1/MAyf24SC+wx8HKrOliQl1Y9z5GeN/rgM bmSgFkdIJmHGvgmfW1+qUjynII67IIW5a42Amg/+o8LzKDJLZjs+WiJeZ7q7Pjd9 K6SgKiXTwu1mFgSt1kKz0rGUIYe4dZhkmmsKe8q7vCy8ME8MzibeQGwGK9cJLRqv GC1RIXKGVqBhjgwhJVwB+8EFZImWg/pfREofkyuphRwfT2i+omrYuHdpESoSJiCD i+QftiX5vMjKx+b965Jd =apB7 -----END PGP SIGNATURE----- --=-ex4J6k12RcsGQxVIbjnQ--

1 0

Re: (ITS#6673) ldap_unbind() hangs on unreachable LDAP server when using TLS
by hyc＠symas.com 14 Oct '10

14 Oct '10

Arthur de Jong wrote: > On Wed, 2010-10-13 at 14:17 -0700, Howard Chu wrote: >> It seems you can workaround this by changing tls_g.c's invocation of >> gnutls_bye() to use GNUTLS_SHUT_WR instead of GNUTLS_SHUT_RDWR. However, that >> strikes me as fundamentally wrong, since libldap is clearly closing both >> directions when it gets here. I think the bug is in gnutls_bye(), it shouldn't >> be waiting indefinitely when it tries to read the peer's Close alert. I'm not >> sure it should even be trying to read that at all; some peers may never send it. > > I can't comment on the GnuTLS API because I haven't used it before. Can > you file a bugreport with GnuTLS? Do you need any more input from my > end? What is the GnuTLS version number? Seems like you should be submitting this to their tracker anyway, as the original reporter. https://savannah.gnu.org/support/?group=gnutls >> Note that because you're breaking the connection without warning, TCP doesn't >> know that the connection is gone, so there will be no error detected when >> gnutls attempts to send its own Close alert. In this case, it will probably >> block for 2*MSL before getting any further. > > In my tests I haven't waited that long (I think). Do you know if there > are any problems with using setsockopt(SO_RCVTIMEO) and > setsockopt(SO_SNDTIMEO) on the socket? > I have no idea whether GnuTLS handles asynch I/O properly or not. If you're only setting these options immediately before closing, I don't see why it should cause any problems. But GnuTLS has enough flaws in general that I wouldn't claim it ever does anything right or as expected. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6625) draft-zeilenga-ldap-c-api-concurrency support
by doug.leavitt＠oracle.com 14 Oct '10

14 Oct '10

Version 2... Part 3 of 3 of this patch with the request changes to options.c is now available for review. The full details are located here: http://cr.opensolaris.org/~djl/openldap-patch3/ The revised patch has been updated to include all changes as on 10-14-10AM including the commit of: Modified Files: cyrus.c 1.159 -> 1.160 The only file modified between the first and second version of this patch was options.c The web link above includes both the original patch (as version 1) and the revised patch (version 2) with full diff -Us, tarballs and such for both versions. Retesting has been completed on both Solaris x86 and Solaris SPARC. Both platforms have been re-tested under 32-bit and 64-bit compiles. All regression testing passed successfully. IPR Notice This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Oracle Corporation. Oracle Corporation has not assigned rights and/or interest in this work to any party. I, Douglas Leavitt am authorized by Oracle Corporation, my employer, to release this work under the following terms. Thank you for your consideration, Doug.

1 0

Re: (ITS#6673) ldap_unbind() hangs on unreachable LDAP server when using TLS
by arthur＠arthurdejong.org 14 Oct '10

14 Oct '10

--=-6hDPPEPvd2QOD+/Er+Q8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2010-10-13 at 14:17 -0700, Howard Chu wrote: > It seems you can workaround this by changing tls_g.c's invocation of=20 > gnutls_bye() to use GNUTLS_SHUT_WR instead of GNUTLS_SHUT_RDWR. However, = that=20 > strikes me as fundamentally wrong, since libldap is clearly closing both= =20 > directions when it gets here. I think the bug is in gnutls_bye(), it shou= ldn't=20 > be waiting indefinitely when it tries to read the peer's Close alert. I'm= not=20 > sure it should even be trying to read that at all; some peers may never s= end it. I can't comment on the GnuTLS API because I haven't used it before. Can you file a bugreport with GnuTLS? Do you need any more input from my end? > Note that because you're breaking the connection without warning, TCP doe= sn't=20 > know that the connection is gone, so there will be no error detected when= =20 > gnutls attempts to send its own Close alert. In this case, it will probab= ly=20 > block for 2*MSL before getting any further. In my tests I haven't waited that long (I think). Do you know if there are any problems with using setsockopt(SO_RCVTIMEO) and setsockopt(SO_SNDTIMEO) on the socket? --=20 -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org -- --=-6hDPPEPvd2QOD+/Er+Q8 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAABAgAGBQJMt01mAAoJECqLdGgQ4K/B5ogP/ihMljH3hvC7aKd6W4Mt526F J/W6Gpx8w7UUI2uymq23epRa1s/2aLWnPDpdP9uGbswrdBrOsRrUARWHPRy/I61L 8JhCiFcEXqyMJxrm7sW4uaVTHBS1AZPklCdfQ0+s4JdVKccLjOkUGJFh4sQL5TtA 3syopgjuQ2inqc9+wA3ZuGL3HgiOuLjXQauHQ0YbWdr+QYZjDZcero5RU6HU+jIv uh+SyQaTiTkzDc8MqGc/ImPZ5R55YORiKUF90Wr+3lGPGCloj8snqfUbMpjNTBkG jUPKBrl+bKgmKPtnpJzLzeCAZsH/rMdyhL0Apr1AZb5Ay8uHqxE3bHE/bTL7/mxA J/RvZlIR/BGed1dWWlQ+j2YE8zsCfvUNxH1GbbmWqk6pO+4BbZP/7XHs6rMW7XkL bT+LwW6J70ZrUFR7XEjkn/a++S7dm9zRoIVDvVgw7HduQSVU+nVQRIwh/CxyGhoG J8OefK5OEYuAqZjFJk8U1OpslstpGDvMjr7nbnY2TRkAg1QshydvhFaq+cp56Uey RT97jWFYTYuIUTrWh8SOog/NxE0WaBJuUqx/Lz/mBX7BkJj+zSDT9SD6IntV73eJ GBBr5wgyEzYyu7pg9uo3Ux16XFp+wwtjMHd8H9/EEEsBjOkuPyGVCz/9CynUgegr A/rMhnTnXTAt7zM/ydh2 =uUuU -----END PGP SIGNATURE----- --=-6hDPPEPvd2QOD+/Er+Q8--

1 0

Re: (ITS#6675) ConnectException UnknownHostException using subdomain URL when searching
by quanah＠zimbra.com 14 Oct '10

14 Oct '10

--On Thursday, October 14, 2010 10:54 AM +0000 adolfo(a)ingenia.es wrote: > Full_Name: Adolfo Cort?s > Version: openldap-2.3.43-12.el5 > OS: CentOS release 5.2 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (62.15.226.90) I see nothing in this report that has to do with OpenLDAP. I.e., you do not show any problems with ldapsearch or any other utility provided by the OpenLDAP Foundation. All of your information is about Java/JNDI, none of which uses the OpenLDAP Code base. I advise you to contact Oracle if you have questions/issues with JNDI. I would note that there are far superior Java API's for connecting to LDAP than JNDI, and that Active Directory, while LDAP "like", is not truly LDAP, and has many unique quirks. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#6675) ConnectException UnknownHostException using subdomain URL when searching
by adolfo＠ingenia.es 14 Oct '10

14 Oct '10

Full_Name: Adolfo Cortés Version: openldap-2.3.43-12.el5 OS: CentOS release 5.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (62.15.226.90) I try to connect to an Active directory from a java application using JNDI /OpenLDAP openldap-2.3.43-12.el5 in CentOS release 5.2 When i did a search i get a CommunicationException Error : javax.naming.CommunicationException: xxxxxxxx.es:636 [Root exception is java.net.UnknownHostException: xxxxxxxx.es]] xxxxxxxx.es:636 is reachable and another operations over LDAP as create user goes fine. I see that the problem is related to the DNS configuration: the Active Directory server DNS is aaaaa.bbbbb.xxxxxxxx.es but the base search is only xxxxxxxx.es when I do the search i get the exception because it takes xxxxxxxx.es instead of ssss.xxxxxxxx.es to perform the operation. I tried to solve it adding xxxxxxxx.es to hosts and writing the same IP of aaaaa.bbbbb.xxxxxxxx.es , so the bypass works and the connection goes but now i have a new problem, when i execute the search it connects but retrieves a Referral Limit Exception, iŽm thinking because there are jumps or confussion between aaaaa.bbbbb.xxxxxxxx.es and xxxxxxxx.es because of the hosts bypass i did. So my workaround doesnŽt works and i need to know or solve the connection problem for use subdomain DNS and domain in search base. Connection Parameters: everytihg goes right, is interesting the url, using not secure ldap protocol I also get the same error. [url: ldaps://aaaaa.bbbbb.xxxxxxxx.es] java.naming.security.authentication:simple Usuario mypassword(a)bbbbb.xxxxxxxx.es] Password[getLDAPropertiesSSL]:mypassword] keystore[getLDAPropertiesSSL]:/opt/java/jre/lib/security/jssecacerts trustStore[getLDAPropertiesSSL]:/opt/java/jre/lib/security/jssecacerts Especificacion uso SSL[getLDAPPropertiesSSL]java.naming.security.protocol ssl Search details: see that base DC is xxxxxxxx.es [base: OU=YYY,DC=xxxxxxxx,DC=es] [searchFilter: (&(objectClass=group)(cn={0}))] [filterArgs: new String[] {Usuarios}] [searchControls: SUBTREE_SCOPE, Atributes null, returningobjflag true] This Hosts file doesnŽt produce the Communication ERROR aaaaa.bbbbb.xxxxxxxx.es ccc.ccc.ccc.ccc xxxxxxxx.es ccc.ccc.ccc.ccc With this hosts file i get the Communication ERROR aaaaa.bbbbb.xxxxxxxx.es ccc.ccc.ccc.ccc If i try this search directly in the AD server console, it works giving me the results. Thanks in advance, Adolfo

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs