openldap-bugs

openldap-bugs@openldap.org

1 participants
20961 discussions

(ITS#6148) Need smbk5pwd to support MIT KDC
by hyc＠OpenLDAP.org 27 May '09

27 May '09

Full_Name: Howard Chu Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.67.104.102) Submitted by: hyc This is a reminder to me to investigate how the MIT KDC's LDAP backend works, and how to manage password synchronization there.

1 0

(ITS#6147) slapd should explicitly configure SASL auxprop
by hyc＠OpenLDAP.org 27 May '09

27 May '09

Full_Name: Howard Chu Version: 2.4.16/HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.67.104.110) Submitted by: hyc we need a config option for controlling which auxprop plugins the Cyrus SASL library uses, and it should default to just "slapd". See ITS#6056, the sasldb plugin causes problems and generally isn't useful anyway. (And yes, we probably need to investigate why those problems arise.) Also see ITS#6129, we should take more explicit steps to prevent the ldapdb auxprop from loading.

1 0

(ITS#6146) Note output format in ldapsearch man page DESCRIPTION
by rra＠stanford.edu 27 May '09

27 May '09

Full_Name: Russ Allbery Version: 2.4.11 OS: Debian URL: Submission from: (NULL) (171.66.157.16) A Debian user had some difficulty finding the output format of ldapsearch in the current man page. It's there, under -L, but it's not noted in the DESCRIPTION section. Would it be reasonable to add the sentence: The attributes are displayed using an extended version of LDIF. to the end of the DESCRIPTION section?

1 0

Re: (ITS#6145) Resource leaks shown when running cppcheck against openldap
by hyc＠symas.com 27 May '09

27 May '09

palbert1(a)yahoo.com wrote: > Full_Name: Paul Albert > Version: 2.4.16 > OS: SUSE Linux > URL: N/A > Submission from: (NULL) (198.24.6.168) > > > As part of working on a new project, I'm running cppcheck against various pieces > of code that we'll be using. I downloaded cppcheck version 1.32 and ran it > against open LDAP version 2.4.16. cppcheck reported 18 file descriptor/memory > leaks in the open LDAP code base in addition to 2 bad programming practices > (labeled as style). Visual inspection of the code verified these errors. > > The results are shown below and can be verified by running cppcheck against the > open ldap code: None of which matters, since these are all one-shot commands... > > sleepy code/openldap-2.4.16> ../cppcheck-1.32/cppcheck -q . > [./clients/tools/ldapdelete.c:230]: (error) Resource leak: fp > [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: entrydn > [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: rdn > [./clients/tools/ldapmodrdn.c:233]: (error) Resource leak: fp > [./contrib/slapd-modules/dsaschema/dsaschema.c:260]: (error) Memory leak: > saveline > [./libraries/libldap_r/thr_debug.c:575]: (error) Memory leak: t > [./libraries/liblutil/getpass.c:128]: (style) Found 'scanf'. You should use > 'fgets' instead > [./libraries/liblutil/getpass.c:153]: (style) Found 'scanf'. You should use > 'fgets' instead > [./servers/slapd/slapi/slapi_utils.c:2511]: (error) Wrong assignement of an > auto-variable to an effective parameter of a function > [./tests/progs/slapd-addel.c:192]: (error) Memory leak: manager > [./tests/progs/slapd-addel.c:192]: (error) Memory leak: filename > [./tests/progs/slapd-modify.c:194]: (error) Memory leak: manager > [./tests/progs/slapd-modify.c:194]: (error) Memory leak: entry > [./tests/progs/slapd-modrdn.c:177]: (error) Memory leak: manager > [./tests/progs/slapd-read.c:227]: (error) Memory leak: manager > [./tests/progs/slapd-read.c:227]: (error) Memory leak: entry > [./tests/progs/slapd-read.c:227]: (error) Memory leak: filter > [./tests/progs/slapd-search.c:250]: (error) Memory leak: manager > [./tests/progs/slapd-search.c:250]: (error) Memory leak: sbase > [./tests/progs/slapd-search.c:250]: (error) Memory leak: filter > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6056) Samba4 breaks OpenLDAP over ldapi
by abartlet＠samba.org 27 May '09

27 May '09

--=-Qa9s282ZNKloqhE3QHt5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2009-05-26 at 15:40 +0200, Michael Str=C3=B6der wrote: > abartlet(a)samba.org wrote: > > Samba4 always uses SASL credentials these days (trying to avoid simple > > binds). >=20 > libsasldb2.so is not required for a SASL bind with password-based > mechanism. You can store the passwords in attribute userPassword (in > clear-text). So the security consideration is more about password > storage than SASL vs. simple bind on the wire. Which we already use. Regardless, Howard's great detective work shows it still gets in the way.=20 > > Perhaps it's time to investigate EXTERNAL >=20 > That would be good anyway since in Samba4 the result of standard > provision is LDAPI access anyway. So you could directly map the Unix > user smbd is running as (root?) with authz-regexp to directory user > samba-admin. Well, we already discussed that.. ;-) We did. =20 Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com --=-Qa9s282ZNKloqhE3QHt5 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBKHJj0z4A8Wyi0NrsRAqkfAJ4jsghUdEiUTnOHsmG2Bg9njDe6agCeN4hF aNRmEnt5qtFNRw7WtnaXqto= =midd -----END PGP SIGNATURE----- --=-Qa9s282ZNKloqhE3QHt5--

1 0

(ITS#6145) Resource leaks shown when running cppcheck against openldap
by palbert1＠yahoo.com 26 May '09

26 May '09

Full_Name: Paul Albert Version: 2.4.16 OS: SUSE Linux URL: N/A Submission from: (NULL) (198.24.6.168) As part of working on a new project, I'm running cppcheck against various pieces of code that we'll be using. I downloaded cppcheck version 1.32 and ran it against open LDAP version 2.4.16. cppcheck reported 18 file descriptor/memory leaks in the open LDAP code base in addition to 2 bad programming practices (labeled as style). Visual inspection of the code verified these errors. The results are shown below and can be verified by running cppcheck against the open ldap code: sleepy code/openldap-2.4.16> ../cppcheck-1.32/cppcheck -q . [./clients/tools/ldapdelete.c:230]: (error) Resource leak: fp [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: entrydn [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: rdn [./clients/tools/ldapmodrdn.c:233]: (error) Resource leak: fp [./contrib/slapd-modules/dsaschema/dsaschema.c:260]: (error) Memory leak: saveline [./libraries/libldap_r/thr_debug.c:575]: (error) Memory leak: t [./libraries/liblutil/getpass.c:128]: (style) Found 'scanf'. You should use 'fgets' instead [./libraries/liblutil/getpass.c:153]: (style) Found 'scanf'. You should use 'fgets' instead [./servers/slapd/slapi/slapi_utils.c:2511]: (error) Wrong assignement of an auto-variable to an effective parameter of a function [./tests/progs/slapd-addel.c:192]: (error) Memory leak: manager [./tests/progs/slapd-addel.c:192]: (error) Memory leak: filename [./tests/progs/slapd-modify.c:194]: (error) Memory leak: manager [./tests/progs/slapd-modify.c:194]: (error) Memory leak: entry [./tests/progs/slapd-modrdn.c:177]: (error) Memory leak: manager [./tests/progs/slapd-read.c:227]: (error) Memory leak: manager [./tests/progs/slapd-read.c:227]: (error) Memory leak: entry [./tests/progs/slapd-read.c:227]: (error) Memory leak: filter [./tests/progs/slapd-search.c:250]: (error) Memory leak: manager [./tests/progs/slapd-search.c:250]: (error) Memory leak: sbase [./tests/progs/slapd-search.c:250]: (error) Memory leak: filter

1 0

Re: (ITS#6056) Samba4 breaks OpenLDAP over ldapi
by michael＠stroeder.com 26 May '09

26 May '09

abartlet(a)samba.org wrote: > Samba4 always uses SASL credentials these days (trying to avoid simple > binds). libsasldb2.so is not required for a SASL bind with password-based mechanism. You can store the passwords in attribute userPassword (in clear-text). So the security consideration is more about password storage than SASL vs. simple bind on the wire. > Perhaps it's time to investigate EXTERNAL That would be good anyway since in Samba4 the result of standard provision is LDAPI access anyway. So you could directly map the Unix user smbd is running as (root?) with authz-regexp to directory user samba-admin. Well, we already discussed that.. ;-) Ciao, Michael.

1 0

Re: (ITS#6056) Samba4 breaks OpenLDAP over ldapi
by hyc＠symas.com 26 May '09

26 May '09

Michael Ströder wrote: > hyc(a)symas.com wrote: >> Further testing with Andrew's kvm image shows the hang only occurs when Cyrus >> SASL's libsasldb2.so plugin is present. > > Probably you already checked whether there's a BDB library mix. Yes, the version is the same, BDB 4.7. However it's possible that BDB 4.7 doesn't like being initialized multiple times, as occurs here. I haven't yet looked more deeply to see what the real cause is. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6056) Samba4 breaks OpenLDAP over ldapi
by abartlet＠samba.org 26 May '09

26 May '09

--=-oqpE6PlbXuzML9/ubGjQ Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2009-05-26 at 04:26 -0700, Howard Chu wrote: > abartlet(a)samba.org wrote: > > Full_Name: Andrew Bartlett > > Version: CVS HEAD > > OS: Fedora 10 > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (59.167.251.137) > > > > > > Samba4's provision and 'make test' seems to create some internal situat= ion in > > OpenLDAP slapd where it will not accept any more connections over ldapi= :/// > > > > This is best seen by building Samba4, and running > > > > TEST_LDAP=3Dyes OPENLDAP_ROOT=3D/usr/local make test > > > > The slapd does not crash, but simply stops accepting new connections. = Samba4 > > currently then crashes due to some other bug (the LDAP backend not resp= onding is > > clearly untested code in Samba4). > > > > It isn't a Samba4 client bug, as ldapsearch also fails to respond. > > > > This seems very, very similar to ITS#5261 >=20 > Further testing with Andrew's kvm image shows the hang only occurs when C= yrus=20 > SASL's libsasldb2.so plugin is present. I always remove that plugin from = my=20 > installs, since I only use in-directory SASL secrets. That's probably why= I=20 > wasn't seeing the reported behavior before. Very interesting result! > Also a note - it's still not clear we've been talking about the same thin= g up=20 > to this point. Even when the samba test suite hangs, I see that ldapsearc= h=20 > still works fine against slapd. At any rate, currently all of the samba4 = tests=20 > pass for me. Samba4 always uses SASL credentials these days (trying to avoid simple binds). Perhaps it's time to investigate EXTERNAL if it would avoid some of this pain (but we should also try and fix the real bug here, if at all possible). =20 Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com --=-oqpE6PlbXuzML9/ubGjQ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBKG99Zz4A8Wyi0NrsRAmqZAJ9Oh4eSbVP7nbGAn0b8tp2hVMbWKQCfZ4Lr pIs94kn/tBYQYq0Qr1uSX44= =CZuG -----END PGP SIGNATURE----- --=-oqpE6PlbXuzML9/ubGjQ--

1 0

Re: (ITS#6056) Samba4 breaks OpenLDAP over ldapi
by michael＠stroeder.com 26 May '09

26 May '09

hyc(a)symas.com wrote: > Further testing with Andrew's kvm image shows the hang only occurs when Cyrus > SASL's libsasldb2.so plugin is present. Probably you already checked whether there's a BDB library mix. Ciao, Michael.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs