openldap-bugs

openldap-bugs@openldap.org

1 participants
20967 discussions

Re: (ITS#4941) incorrect description of TLS_REQCERT setting
by hyc＠symas.com 19 Mar '09

19 Mar '09

Howard Chu wrote: > Philip Guenther wrote: >> On Mon, 30 Apr 2007, Howard Chu wrote: >>> guenther+ldapdev(a)sendmail.com wrote: >> ... >>>> - 'allow' checks the identity of the server vs its cert (per RFC 4513, >>>> section 3.1.3) and will terminate the connection if they don't match >>>> - 'try' is the same as 'demand' and 'hard' >>> Not quite. With both "allow" and "try" it's OK if the server provides no >>> certificate. >> >> That's true of 'demand' and 'hard' as well. The only difference between >> 'try' and 'demand' in the code is that the latter passes >> SSL_CTX_set_verify() the SSL_VERIFY_FAIL_IF_NO_PEER_CERT flag, but that >> flag has NO EFFECT on SSL clients. This is documented on the >> SSL_CTX_set_verify() manpage and confirmed by grepping the openssl source >> for it. >> >> If you don't believe me, I suggest you try configuring your server to >> accept the ADH suites (don't forget to set TLSDHParamFile to /dev/null) >> and give ldapsearch a whirl with >> LDAPTLS_REQCERT=hard >> LDAPTLS_CIPHER_SUITE=ADH-AES256-SHA >> >> in your environment. That's what I did. > > When this text was written, there was no support for anonymous cipher suites. > So the meaning of the text is: assuming a cipher suite that actually uses > certificates, the client would proceed even if the server didn't provide a > cert. It's entirely possible that this circumstance has been overcome by other > developments. Most likely this hasn't been a valid use case for quite a long > time. But it has nothing to do with Diffie-Hellman key exchanges... Aside from clarifying that we're assuming the use of X.509 certificates in the first place, this text is correct. I note that GnuTLS also works with OpenPGP keys, but I've never tested that here. Anyway, the current description is also accurate for GnuTLS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: add option for setting minimum TLS/SSL protocol (ITS#5655)
by guenther＠sendmail.com 19 Mar '09

19 Mar '09

On Fri, 23 Jan 2009, Howard Chu wrote: > guenther(a)sendmail.com wrote: > > I could have sworn I had uploaded the revised version of the patch back in > > August after some cleaning by Kurt, but have no way of confirming it. So > > I've uploaded it again as guenther-20081204.patch. > > Thanks, patch looks good, committed to HEAD. Have you got a manpage > update, by the way? Here's the chunk for ldap.conf(5), diffed against the trunk. None of the LDAP_OPT_X_TLS* options appear to be documented, so I didn't add anything to ldap_get_option(3). Philip Index: doc/man/man5/ldap.conf.5 =================================================================== RCS file: /data/cvs/openldap/pkg/ldap/doc/man/man5/ldap.conf.5,v retrieving revision 1.50 diff -u -r1.50 ldap.conf.5 --- doc/man/man5/ldap.conf.5 26 Jan 2009 01:54:32 -0000 1.50 +++ doc/man/man5/ldap.conf.5 19 Mar 2009 18:22:00 -0000 @@ -336,6 +336,19 @@ gnutls-cli -l .fi .TP +.B TLS_PROTOCOL_MIN <major>[.<minor>] +Specifies minimum SSL protocol version that will be negoiated. +If the server doesn't support at least that version, +the SSL handshake will fail. +To require TLS 1.x or higher, set this option to 3.(x+1), +e.g., +.B TLS_PROTOCOL_MIN 3.2 +would require TLS 1.1. +Specifying a minimum that is higher than that supported by the +OpenLDAP implementation will result it in requiring the +highest level that it does support. +This parameter is currently ignored with GNUtls. +.TP .B TLS_RANDFILE <filename> Specifies the file to obtain random bits from when /dev/[u]random is not available. Generally set to the name of the EGD/PRNGD socket.

1 0

Re: (ITS#5733) core dump in re24's slapd-ldap(5)
by quanah＠zimbra.com 18 Mar '09

18 Mar '09

--On Thursday, October 09, 2008 8:42 PM +0000 ando(a)sys-net.it wrote: > Full_Name: Pierangelo Masarati > Version: re24 > OS: Linux x86 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (81.72.89.40) > Submitted by: ando > > > I had a strange core dump while testing re24 (test039). I'm reporting it > in order to be able to investigate it further later. Backtrace follows: I hit this today in testing RE24 as well: Thread 1 (process 27053): #0 0x000000395e030155 in raise () from /lib64/libc.so.6 #1 0x000000395e031bf0 in abort () from /lib64/libc.so.6 #2 0x000000395e0295d6 in __assert_fail () from /lib64/libc.so.6 #3 0x00002b45fe1d3f51 in ldap_back_conn_delete (li=0xba73080, lc=0x2aaab0003690) at ../../../../servers/slapd/back-ldap/bind.c:157 #4 0x00002b45fe1d4a34 in ldap_back_freeconn (li=0xba73080, lc=0x2aaab0003690, dolock=0) at ../../../../servers/slapd/back-ldap/bind.c:467 #5 0x00002b45fe1d6492 in ldap_back_release_conn_lock (li=0xba73080, lcp=0x45b9c5e8, dolock=1) at ../../../../servers/slapd/back-ldap/bind.c:1144 #6 0x00002b45fe1d46b0 in ldap_back_bind (op=0xc168af0, rs=0x45b9cc40) at ../../../../servers/slapd/back-ldap/bind.c:355 #7 0x00000000004c24da in overlay_op_walk (op=0xc168af0, rs=0x45b9cc40, which=op_bind, oi=0xba2cd90, on=0x0) at ../../../servers/slapd/backover.c:669 #8 0x00000000004c26dd in over_op_func (op=0xc168af0, rs=0x45b9cc40, which=op_bind) at ../../../servers/slapd/backover.c:721 #9 0x00000000004c272b in over_op_bind (op=0xc168af0, rs=0x45b9cc40) at ../../../servers/slapd/backover.c:731 #10 0x0000000000460681 in fe_op_bind (op=0xc168af0, rs=0x45b9cc40) at ../../../servers/slapd/bind.c:383 #11 0x00000000004c24da in overlay_op_walk (op=0xc168af0, rs=0x45b9cc40, which=op_bind, oi=0xba6def0, on=0x0) at ../../../servers/slapd/backover.c:669 #12 0x00000000004c26dd in over_op_func (op=0xc168af0, rs=0x45b9cc40, which=op_bind) at ../../../servers/slapd/backover.c:721 #13 0x00000000004c272b in over_op_bind (op=0xc168af0, rs=0x45b9cc40) at ../../../servers/slapd/backover.c:731 #14 0x000000000045fdb0 in do_bind (op=0xc168af0, rs=0x45b9cc40) at ../../../servers/slapd/bind.c:205 #15 0x0000000000438a70 in connection_operation (ctx=0x45b9cd90, arg_v=0xc168af0) at ../../../servers/slapd/connection.c:1097 #16 0x0000000000438f8b in connection_read_thread (ctx=0x45b9cd90, argv=0x17) at ../../../servers/slapd/connection.c:1223 #17 0x00002b45fad8b6b7 in ldap_int_thread_pool_wrapper (xpool=0xba14330) at ../../../libraries/libldap_r/tpool.c:663 #18 0x00002b45fb5442f7 in start_thread () from /lib64/libpthread.so.0 #19 0x000000395e0d1e3d in clone () from /lib64/libc.so.6 (gdb) frame 6 #6 0x00002b45fe1d46b0 in ldap_back_bind (op=0xc168af0, rs=0x45b9cc40) at ../../../../servers/slapd/back-ldap/bind.c:355 355 ldap_back_release_conn( li, lc ); (gdb) p retrying $1 = LDAP_BACK_RETRYING (gdb) frame 3 #3 0x00002b45fe1d3f51 in ldap_back_conn_delete (li=0xba73080, lc=0x2aaab0003690) at ../../../../servers/slapd/back-ldap/bind.c:157 157 assert( !LDAP_BACK_CONN_TAINTED( lc ) ); (gdb) print *lc $2 = {lc_conn = 0x2b45fea45f50, lc_ld = 0x2aaab00126d0, lc_cred = {bv_len = 0, bv_val = 0x0}, lc_bound_ndn = {bv_len = 46, bv_val = 0x2aaaac126130 "cn=james a jones 4,ou=people,dc=example,dc=com"}, lc_local_ndn = {bv_len = 46, bv_val = 0x2aaaac1192a0 "cn=james a jones 4,ou=people,dc=example,dc=com"}, lc_lcflags = 289, lc_refcnt = 0, lc_flags = 4096, lc_create_time = 0, lc_time = 0, lc_q = {tqe_next = 0x0, tqe_prev = 0x0}} (gdb) p /x lc->lc_lcflags $3 = 0x121 --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5856) adauth overlay contribution
by hyc＠symas.com 18 Mar '09

18 Mar '09

neil.dunbar(a)hp.com wrote: > Still nothing? I can resubmit if the tarball has rotted away to nothing > on the incoming server. ;-) > > I don't mind if the code needs rewriting (it almost certainly does!), or > if it isn't felt to be the right fit for contrib, but a little feedback > would be helpful in getting things right. Sorry, we've been in bugfix-only mode for the past couple months. After this next (2.4.16) release is frozen we'll get back to working on new features. > > Cheers, > > Neil -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5856) adauth overlay contribution
by neil.dunbar＠hp.com 18 Mar '09

18 Mar '09

Still nothing? I can resubmit if the tarball has rotted away to nothing on the incoming server. ;-) I don't mind if the code needs rewriting (it almost certainly does!), or if it isn't felt to be the right fit for contrib, but a little feedback would be helpful in getting things right. Cheers, Neil -- SSL, HP Labs/Office of Strategy and Technology Hewlett-Packard Limited Registered Office: Cain Road, Bracknell, Berks RG12 1HN Registered No: 690597 England

1 0

Re: (ITS#6028) accesslog db after main db fails if main db is ""
by quanah＠zimbra.com 17 Mar '09

17 Mar '09

--On Tuesday, March 17, 2009 11:26 PM +0000 quanah(a)zimbra.com wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.4.15 > OS: Linux 2.6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (75.111.29.239) > > > If the main database is rooted at "", and you go to create an accesslog > database to set up delta-syncrepl replication, the modification is > erroneously rejected by cn=config: bah, never mind. Still would be nice though. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#6028) accesslog db after main db fails if main db is ""
by quanah＠zimbra.com 17 Mar '09

17 Mar '09

Full_Name: Quanah Gibson-Mount Version: 2.4.15 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.29.239) If the main database is rooted at "", and you go to create an accesslog database to set up delta-syncrepl replication, the modification is erroneously rejected by cn=config: ERROR: Unable to add accesslog database to freelancer.lab.zimbra.com - exiting ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcSuffix> namingContext "cn=accesslog" already served by a preceding hdb database adding new entry "olcDatabase={3}hdb,cn=config" Inserting the accesslog DB in front of the existing database works as expected.

1 0

Re: (ITS#6012) segmentation fault triggered with slapcat
by hyc＠symas.com 17 Mar '09

17 Mar '09

martin.konold(a)erfrakon.de wrote: > Am Dienstag, 10. März 2009 06:53:34 schrieben Sie: > >> Please provide steps to reproduce the segfault, thanks. > > Hi Howard, > > I tried to reproduce the problem on either OpenSUSE 11.1 or Fedora but I could > not reproduce the crash. > > The crash was reproducable with OpenPKG though I guess the crash depends on > the version of bdb beeing used. The code fetches an transaction from an > internal table which might have slightly different semantics with regards to > initialization depending on bdb version. > > Anyway if you look at the rather trivial patch you will see that it indeed > solves a problem independent of bdb version used so the code does not depend > on a side effect anymore. > > On one hand the void pointer *data should not be dangeling and therefore > initialization with NULL is correct. *data will only be referenced if ldap_pvt_thread_pool_getkey() succeeds. If that function succeeds, data will have a value. There is no dangling pointer here. > On the other hand TXN_ABORT() must not be called with potentially dangeling > pointers and therefor a trivial check for the validitiy of the pointer is a > good idea. Likewise, bdb_reader_free() will only get called as a result of successful pool_setkey() calls. There will be no dangling pointers there either. Since most of this code has been in place since 2002 and no one else has reported the problem before, it seems to me that OpenPKG is doing something very unusual. And being unable to reproduce the problem ourselves, I'd like to see exactly what they're doing to cause it. I've committed part of the patch in the meantime, but until we see steps to reproduce the crash, I'm unconvinced that this is any meaningful change. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: [Fwd: RE: (ITS#6019) puzon@eska.pl]
by hyc＠symas.com 17 Mar '09

17 Mar '09

This appears to be a dup of ITS#6014. Closing this one, send all future followups to #6014. michael(a)stroeder.com wrote: > The stack trace was sent to me personally. :-/ > > -------- Original Message -------- > Subject: RE: (ITS#6019) puzon(a)eska.pl > Date: Fri, 13 Mar 2009 15:09:04 +0100 > From: Lukasz PUZON Brodowski<puzon(a)eska.pl> > To: 'Michael Ströder'<michael(a)stroeder.com> > References:<200903121120.n2CBKHqo032649(a)boole.openldap.org> > <49B90F15.5070309(a)stroeder.com> > > Hi Michael > > Here is gdb: > (15:07:44<~>) 0 # gdb > GNU gdb 6.1.1 [FreeBSD] > Copyright 2004 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain > conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "i386-marcel-freebsd". > (gdb) file ldapsearch > Reading symbols from ldapsearch...(no debugging symbols found)...done. > (gdb) run -x -W -D 'cn=Manager,dc=eska' -b "" -s base > Starting program: /usr/local/bin/ldapsearch -x -W -D 'cn=Manager,dc=eska' -b > "" -s base > (no debugging symbols found)...(no debugging symbols found)...(no debugging > symbols found)...(no debugging symbols found)...(no debugging symbols > found)...(no debugging symbols found)...(no debugging symbols found)...(no > debugging symbols found)...(no debugging symbols found)...Enter LDAP > Password: > # extended LDIF > # > # LDAPv3 > # base<> with scope baseObject > # filter: (objectclass=*) > # requesting: ALL > # > > # > dn: > objectClass: top > objectClass: OpenLDAProotDSE > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 > > Program received signal SIGSEGV, Segmentation fault. > 0x282eb3f0 in free () from /lib/libc.so.7 > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6025) ldapdelete cannot handle base64 encoded dns
by hyc＠symas.com 17 Mar '09

17 Mar '09

quanah(a)OpenLDAP.org wrote: > Full_Name: Quanah Gibson-Mount > Version: RE24/HEAD > OS: NA > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (75.111.29.239) > > > As noted in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=334354 the OpenLDAP > ldapdelete utility cannot handle base-64 encoded DNs, even though the other > ldap* tools can. It would add to the tool consistency for ldapdelete to conform > with the other tools in this respect. Why are you bothering to report this now, when the original bug was filed in 2005 and went unanswered until last month? I agree with Peter Marschall's response - this is not a bug, and your assertion "other ldap* tools can" is false. ldapdelete is documented to take a list of DNs. It does *NOT* say that it takes them in LDIF format, and LDIF is the only relevant format specification that uses base64. As such, "DN" should only be taken to mean RFC4514 compliant strings. The only tool that accepts LDIF is ldapmodify (and ldapadd is just a symlink to ldapmodify). All of the other tools are specifically documented to take DNs, not LDIF. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs