openldap-bugs

openldap-bugs@openldap.org

1 participants
20959 discussions

(ITS#6340) What should I do it well?
by quanah＠zimbra.com 28 Oct '09

28 Oct '09

Hello, kbind is obsolete, and has been for quite some time. You should be using SASL/GSSAPI instead. In any case, this question is not a bug report, so it does not belong in the ITS system. I would suggest you use the openldap-technical list if you have further questions about developing applications with the OpenLDAP libraries. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6352) Not all certificates are read if the TLS_CACERTDIR contains broken links
by quanah＠zimbra.com 28 Oct '09

28 Oct '09

--On Tuesday, October 27, 2009 8:30 AM +0000 steffen.gruner(a)basf.com wrote: > Full_Name: Steffen Gruner > Version: 2.3.43 The 2.3 release series is no longer supported. I suggest upgrading to the latest stable release (2.4.19) and trying there. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6352) Not all certificates are read if the TLS_CACERTDIR contains broken links
by hyc＠symas.com 28 Oct '09

28 Oct '09

steffen.gruner(a)basf.com wrote: > Full_Name: Steffen Gruner > Version: 2.3.43 > OS: Gentoo Linux > URL: > Submission from: (NULL) (84.171.177.13) > > > If in the TLS_CACERTDIR (/etc/ssl/certs/ on by box) contains broken symbolic > links the ldapsearch command stops on the first broken link and doesn't use all > the other certificates. This functionality is provided by the OpenSSL library; you should file this bug report with them. In the meantime, now you know yet another reason why we recommend using TLS_CACERT instead of TLS_CACERTDIR. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6354) Regex-based authzTo example in docs, section 15.3.3.1, is incorrect.
by tim＠stoo.org 28 Oct '09

28 Oct '09

Full_Name: Tim Stewart Version: 2.4.x OS: N/A URL: Submission from: (NULL) (65.200.62.8) The OpenLDAP documentation at: http://www.openldap.org/doc/admin24/sasl.html#SASL%20Authentication describes an example of using a regular expression to describe a set of distinguished names as opposed to using an ldap:// URL. The example is authzTo: dn.regex=^uid=[^,]*,dc=example,dc=com$ which will produce a syntax error. Instead, the example should read like authzTo: dn.regex:^uid=[^,]*,dc=example,dc=com$ (the first `=' is replaced with `:') which is accepted by the server.

1 0

(ITS#6353) berval->string conversions ignore \0
by h.b.furuseth＠usit.uio.no 28 Oct '09

28 Oct '09

Full_Name: Hallvard B Furuseth Version: HEAD, RE24 OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard Conversion from a binary blob (struct berval*, BerElement read) to a char* string typically just grabs bv.bv_val even when the value may contain embedded '\0's. In these cases, correct operation may require that the conversion fails if bv_len != (bv_val ? strlen(bv_val) : 0). Or if bv_val is not \0-terminated, to check if memchr(bv_val, '\0', bv_len) == NULL. Examples: liblber/decode.c: ber_get_stringa, ber_get_stringb, ber_get_bitstringa, ber_scanf "aAv" Similarly, a lot of code requires a berval to be \0-terminated, but some also - sometimes unwarranted - also that the first \0 it encounters when walking the value is the terminating \0. For example, libldap/getdn.c has some exported functions that look for \0 without checking bv_len, some which checks bv_len but not a terminating \0, and some which does both. I really don't know which of these functions can expect there is no embedded \0. I think we need to introduce 'typedef struct berval BerString', used to document that bv_len == (bv_val ? strlen(bv_val) : 0) for the particular berval in question (e.g. in a function prototype). And maybe a typedef BerData for the opposite.

1 0

Re: (ITS#6334) hang during ldapmodify
by quanah＠zimbra.com 27 Oct '09

27 Oct '09

--On Tuesday, October 27, 2009 2:57 PM +0000 mkd(a)cs.brown.edu wrote: > One last question... what upstream stable release will include this fix? 2.4.20 will. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6334) hang during ldapmodify
by mkd＠cs.brown.edu 27 Oct '09

27 Oct '09

One last question... what upstream stable release will include this fix? Thanks! Mark Howard Chu wrote: > You're welcome, thanks for your help digging into the problem. >

1 0

(ITS#6352) Not all certificates are read if the TLS_CACERTDIR contains broken links
by steffen.gruner＠basf.com 27 Oct '09

27 Oct '09

Full_Name: Steffen Gruner Version: 2.3.43 OS: Gentoo Linux URL: Submission from: (NULL) (84.171.177.13) If in the TLS_CACERTDIR (/etc/ssl/certs/ on by box) contains broken symbolic links the ldapsearch command stops on the first broken link and doesn't use all the other certificates. Please see this trace: ... open("/lib/libz.so", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\24\0\0004\0\0\0\240"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=69512, ...}) = 0 mmap2(NULL, 71888, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7b39000 mmap2(0xb7b4a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x10) = 0xb7b4a000 close(4) = 0 munmap(0xb7ecf000, 145583) = 0 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 4 fstat64(4, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0 poll([{fd=4, events=POLLIN}], 1, 10) = 1 ([{fd=4, revents=POLLIN}]) read(4, "H\323y\354\334WM\262\274<qu\24\37\270\250\375ZI2\177\363\325\344-K\253'\330\241\211\243"..., 32) = 32 close(4) = 0 getuid32() = 1000 time(NULL) = 1256629367 open("/etc/ssl/cert.pem", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/etc/ssl/certs/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|0x80000) = 4 fstat64(4, {st_mode=S_IFDIR|0755, st_size=12512, ...}) = 0 fcntl64(4, F_GETFD) = 0x1 (flags FD_CLOEXEC) getdents(4, /* 120 entries */, 4096) = 4064 open("/etc/ssl/certs//.", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFDIR|0755, st_size=12512, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, 0xb7ef2000, 4096) = -1 EISDIR (Is a directory) close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//..", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFDIR|0755, st_size=152, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, 0xb7ef2000, 4096) = -1 EISDIR (Is a directory) close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//d537fba6.0", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=1505, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, "-----BEGIN CERTIFICATE-----\nMIIEK"..., 4096) = 1505 read(5, ""..., 4096) = 0 close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//DigiNotar_Root_CA.pem", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=1980, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, "-----BEGIN CERTIFICATE-----\nMIIFi"..., 4096) = 1980 read(5, ""..., 4096) = 0 close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//QuoVadis_Root_Certification_Authority.pem", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) close(4) = 0 write(2, "ldap_bind: Can't contact LDAP ser"..., 42ldap_bind: Can't contact LDAP server (-1) ) = 42 exit_group(1) = ?

1 0

Re: (ITS#6334) hang during ldapmodify
by hyc＠symas.com 27 Oct '09

27 Oct '09

SATOH Fumiyasu wrote: >> Please try with the latest include/ldap_pvt.h (1.113) and libldap/sasl.c >> (1.74) from CVS, thanks. > > http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/sasl.c.diff?r1=1… > > s/errno/err/ ? > Absolutely right, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6334) hang during ldapmodify
by fumiyas＠osstech.jp 27 Oct '09

27 Oct '09

> Please try with the latest include/ldap_pvt.h (1.113) and libldap/sasl.c > (1.74) from CVS, thanks. http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/sasl.c.diff?r1=1… s/errno/err/ ? -- -- Name: SATOH Fumiyasu (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- Personal Home: http://www.SFO.jp/blog/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs