https://bugs.openldap.org/show_bug.cgi?id=7165
--- Comment #5 from Howard Chu <hyc(a)openldap.org> ---
Most of this bug appears to be obsolete.
(In reply to Hallvard Furuseth from comment #0)
> Full_Name: Hallvard B Furuseth
> Version: master, d861910f55cb1beb5e443caa7e961ed760074352
> OS: Linux x86_64
> URL:
> Submission from: (NULL) (195.1.106.125)
> Submitted by: hallvard
>
>
> Aborting an MDB process can break MDB if another MDB process is
> running, because then locks/reader table info are not reset.
Using mdb_stat -rr will purge stale readers. I suppose we could
tweak back-mdb to also do a reader purge if it ever gets a MDB_READERS_FULL
error from mdb_txn_begin.
>
> The problems below go away when the last slap process terminates
> so the lockfile can be reset. Sometimes kill -KILL is needed.
>
>
> ==== lock.conf ====
> include servers/slapd/schema/core.schema
> database mdb
> suffix o=hi
> directory lock.dir
>
>
> (A) If a process holding a shared mutex dies, other processes' ops
> on the mutex can hang/fail:
Robust mutex support was added in a2ac10107e2fb845c4a38a339239063ec4407d84 in
2014.
>
> rm -rf lock.dir; mkdir lock.dir
> servers/slapd/slapd -f lock.conf -h ldapi://ldapi -d0 &
> MDB_KILL_R=true servers/slapd/slapd -Tcat -f lock.conf
> ldapsearch -xLLH ldapi://ldapi -b o=hi l=x 1.1
> ^C (kills ldapsearch which is waiting for results)
> kill %% (fails to kill slapd)
> kill -KILL %%
>
> The Posix fix, robust mutexes, is outlined below. With _WIN32,
> check return code WAIT_ABANDONED. __APPLE__ Posix semaphores:
> Don't know. SysV semaphores have SEM_UNDO to cancel the process'
> effect if the process dies, but the peers do not seem to be
> informed that this happened.
>
> if ((rc = pthread_mutexattr_init( &mattr )) ||
> (rc = pthread_mutexattr_setpshared(&mattr, PTHREAD_PROCESS_SHARED)) ||
> (rc = pthread_mutexattr_setrobust( &mattr, PTHREAD_MUTEX_ROBUST )) ||
> (rc = pthread_mutex_init(&mutex, &mattr )))
> return rc;
> ...
> switch (pthread_mutex_lock(&mutex)) {
> case 0:
> break;
> case EOWNERDEAD:
> Repair the possibly half-updated data protected by <mutex>;
> if (successful repair) {
> pthread_mutex_consistent(&mutex);
> break;
> }
> /* With Posix mutexes, make future use of <mutex> return failure: */
> pthread_mutex_unlock(&mutex);
> /* FALLTHRU */
> default:
> return MDB_PANIC;
> }
> ...
> pthread_mutex_unlock(&mutex);
>
>
> BTW, the above also happens with MDB_KILL_W=true slapcat followed
> by ldapadd, dunno why slapcat uses a txn without MDB_TXN_RDONLY.
slapcat already opens the env RDONLY. In
3e47e825fd61e1bff001c01f40d70263c89ffabd in 2012 was patched to also create
the txn RDONLY.
> In this case, raise(SIGINT) is sufficient. With MDB_KILL_R, that
> does not kill slapd and we need SIGKILL - it catches SIGINT I
> guess. Don't know if that difference is intentional.
>
>
> (B1) Repeated kill -KILL slap<tool> while slapd is running can use
> up the reader table since it does not clear its table slots,
> making the db unusable.
>
> (B2) slapcat report no error after it fails to read the db due to
> full reader table, it exits with success status.
Unable to reproduce, dunno when this was fixed but it returns
an error code now.
>
> (B3) After one "kill -KILL slap<tool>" while slapd is running, I
> imagine the stale slot which does not go away can prevent freelist
> reuse so the db grows quickly. But I have not seen that.
Depends on timing I suppose; it's possible that there was no
active read txn at the moment, in which case the stale reader slot
has no effect on page reuse.
>
> bash$ rm -rf lock.dir; mkdir lock.dir
> bash$ servers/slapd/slapd -f lock.conf -h ldapi://ldapi -d0 &
> bash$ for (( i=0; i<130; i++)) {
> MDB_KILL_UR=true servers/slapd/slapd -Tcat -f lock.conf
> } > /dev/null
> bash$ servers/slapd/slapd -Tcat -f lock.conf -d-1 2>cat.out
> (success result, no output, no errors in the log)
> bash$ ldapsearch -xLLH ldapi://ldapi -b o=hi l=x 1.1
> version: 1
>
> [R..RLOCKED..R1] Other (e.g., implementation specific) error (80)
> Additional information: internal error
> bash$
>
> Maybe it's easier to have a per-process reader table after all,
> and a shared table with just the oldest txn per process.
>
> Or, each transaction chould have an exclusive file region lock.
> A writer could try to grab the oldest txn's region lock if that
> belongs to another process, and clear the txn it if successful.
> A reader, before giving up, would just search for another pid's
> txn whose lock it can grab.
The current code uses an fcntl lock to detect process liveness.
>
> Except since the system reuses pids, the ID would either have to
> be more exclusive (e.g. pid + mdb_env_open() time) or mdb_env_open
> must clear away reader table entries with its own pid.
>
> Speaking of which, I don't see the use of the repeated getpid()
> calls. Should be enough to store the pid in the MDB_env. fcntl
> record locks do not survive fork(), so an MDB_env doesn't either.
> And the thread ID is unsed, and must be reset with memset, not
> 'mr_tid = 0' since pthread_t can be a struct.
>
The above is no longer true.
>
> (C) Mentioned earlier: Startup can fail due to a race condition,
> when another process starts MDB at the same time and then aborts:
> - Process 1 starts MDB, gets write lock in mdb_env_setup_locks().
> - Process 2 starts MDB, awaits read lock since write lock is taken.
> - Process 1 dies.
> - Process 2 gets the read lock and proceeds, but with an uninitialized
> lockfile since it expects that process 1 initialized it.
Probably still true, but already doc'd in Caveats.
>
> Fix: An extra exclusive lock around the current lock setup code.
>
> kill slapd process, if any
> rm -rf lock.dir; mkdir lock.dir
> MDB_RACE=true servers/slapd/slapd -Tcat -f lock.conf & sleep 1; \
> servers/slapd/slapd -Tcat -f lock.conf
>
> In addition, the above dumps core in mdb_env_close:
> for (i=0; i<env->me_txns->mti_numreaders; i++)
> where env->me_txns == (MDB_txninfo *) 0xffffffffffffffff.
>
>
> (D) And of course ^Z when holding a mutex can block other processes'
> threads, but I suppose BDB has the same problem.
>
> DB_SUSPEND=true servers/slapd/slapd -Tadd -f lock.conf < /dev/null
> servers/slapd/slapd -Tadd -f lock.conf < /dev/null
> (hanging...) ^C
> kill %%
>
> The fix I can see for now is "don't do that" in the doc. MDB
> could in addition use pthread_mutex_timedlock() so slapd at least
> can keep running and can be killed without kill -KILL. Final fix
> = a lock-free library, when a useful portable one emerges.
At this point the only potential action I see is to add a check for
MDB_READERS_FULL as noted at the beginning of this reply.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9565
Issue ID: 9565
Summary: radlib.h: No such file or directory - passwd
slapd-module
Product: OpenLDAP
Version: 2.5.4
Hardware: All
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: contrib
Assignee: bugs(a)openldap.org
Reporter: rguichardspam(a)Gmail.com
Target Milestone: ---
Hi,
while compile passwd slapd-modules, I've got error on Radius compilation.
gcc -DOPENLDAP_FD_SETSIZE=4096 -O2 -g -DSLAP_SCHEMA_EXPOSE -g -O2
-I/usr/kerberos/include -I../../../include -I../../../include
-I../../../servers/slapd -c radius.c -fPIC -DPIC -o .libs/radius.o
radius.c:27:20: fatal error: radlib.h: No such file or directory
#include <radlib.h>
I've searched which package could provide the radlib file but I didn't found
it.
Please confirm which package should be used .. or link to the source..
I'm on CentOS
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9567
Issue ID: 9567
Summary: Double free error after attempt to insert a duplicate
entry
Product: LMDB
Version: 0.9.17
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: wietse(a)porcupine.org
Target Milestone: ---
This problem was originally discovered by Adi Prasaja on Ubuntu with
lmdb-0.9.24, and reproduced by me on Fedora with lmdb-0.9.25, as well as
multiple source repo branches from github.com/openldap.
The problem was introduced with lmdb version 0.9.17 and still exists in the
'head' version 0.9.70 as retrieved from github.com on May 28, 2021.
Quick demo (any Postfix version with LMDB support): create a key-value store
from a file containing one (key, value) per line.
$ cat /tmp/aa
aa 1
aa 2
$ postmap lmdb:/tmp/aa
postmap: warning: lmdb:/tmp/aa: duplicate entry: "aa" <== Postfix message
free(): double free detected in tcache 2 <== libc message
Aborted (core dumped)
Commenting out the free(env->me_txn0) call mdb_env_close0() will prevent the
double free() error. Of course, that results in a memory leak when the input
contains no duplicate line.
The remainder of this message show the steps to reproduce this with lmdb
version 0.9.70 (from github 'head') on Fedora 32 with postfix-3.7-20210424.
These steps have been verified to also work for Postfix 3.2.
The steps assume that the LMDB library and header files are installed in
/usr/local, by using the default lmdb Makefile.
$ cat >makemakefiles-lmdb-local <<'EOF'
#!/bin/sh
export OPT=""
export CCARGS="-DNO_NIS"
export AUXLIBS=""
# Add LMDB
export CCARGS="$CCARGS -DHAS_LMDB"
export AUXLIBS_LMDB="-L/usr/local/lib -Wl,-rpath,/usr/local/lib -llmdb"
unset shlib_directory
make -f Makefile.in makefiles shared=no dynamicmaps=no
CCARGS="-I/usr/local/include $CCARGS" AUXLIBS="$AUXLIBS $AUXLIBS_LMDB"
EOF
$ make tidy
[some output]
$ sh makemakefiles-lmdb-local
$ make -j8
[lots of output]
$ cat >/tmp/aa << EOF
aa 1
aa 2
EOF
$ valgrind --tool=memcheck bin/postmap lmdb:/tmp/aa
==340318== Memcheck, a memory error detector
==340318== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==340318== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==340318== Command: bin/postmap lmdb:/tmp/aa
==340318==
postmap: warning: lmdb:/tmp/aa: duplicate entry: "aa"
==340318== Invalid free() / delete / delete[] / realloc()
==340318== at 0x483B9F5: free (vg_replace_malloc.c:538)
==340318== by 0x4858CFD: mdb_env_close0 (in /usr/local/lib/liblmdb.so)
==340318== by 0x4859B0C: mdb_env_close (in /usr/local/lib/liblmdb.so)
==340318== by 0x13CBC3: slmdb_close (slmdb.c:780)
==340318== by 0x13B297: dict_lmdb_close (dict_lmdb.c:475)
==340318== by 0x113DFF: mkmap_close (mkmap_open.c:211)
==340318== by 0x10F080: postmap (postmap.c:557)
==340318== by 0x1108E4: main (postmap.c:1140)
==340318== Address 0x7320c30 is 0 bytes inside a block of size 258 free'd
==340318== at 0x483B9F5: free (vg_replace_malloc.c:538)
==340318== by 0x48561DE: mdb_txn_commit (mdb.c:4130)
==340318== by 0x13CB7D: slmdb_close (slmdb.c:771)
==340318== by 0x13B297: dict_lmdb_close (dict_lmdb.c:475)
==340318== by 0x113DFF: mkmap_close (mkmap_open.c:211)
==340318== by 0x10F080: postmap (postmap.c:557)
==340318== by 0x1108E4: main (postmap.c:1140)
==340318== Block was alloc'd at
==340318== at 0x483CAE9: calloc (vg_replace_malloc.c:760)
==340318== by 0x48599F2: mdb_env_open (in /usr/local/lib/liblmdb.so)
==340318== by 0x13CD91: slmdb_open (slmdb.c:851)
==340318== by 0x13B6C6: dict_lmdb_open (dict_lmdb.c:612)
==340318== by 0x113F50: mkmap_open (mkmap_open.c:283)
==340318== by 0x10EC02: postmap (postmap.c:438)
==340318== by 0x1108E4: main (postmap.c:1140)
==340318==
==340318==
==340318== HEAP SUMMARY:
==340318== in use at exit: 27,608 bytes in 634 blocks
==340318== total heap usage: 1,430 allocs, 797 frees, 3,356,293 bytes
allocated
==340318==
==340318== LEAK SUMMARY:
==340318== definitely lost: 0 bytes in 0 blocks
==340318== indirectly lost: 0 bytes in 0 blocks
==340318== possibly lost: 27,582 bytes in 633 blocks
==340318== still reachable: 26 bytes in 1 blocks
==340318== suppressed: 0 bytes in 0 blocks
==340318== Rerun with --leak-check=full to see details of leaked memory
==340318==
==340318== For lists of detected and suppressed errors, rerun with: -s
==340318== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Similar errors happen with lmdb-0.9.17. The problem does not exist in
lmdb-0.9.16 or earlier versions.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9564
Issue ID: 9564
Summary: Race condition with freeing the spilled pages from
transaction
Product: LMDB
Version: 0.9.29
Hardware: Other
OS: Mac OS
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: kriszyp(a)gmail.com
Target Milestone: ---
Created attachment 825
--> https://bugs.openldap.org/attachment.cgi?id=825&action=edit
Free the spilled pages and dirty overflows before unlocking the write mutex
The spilled pages (a transaction's mt_spill_pgs) is freed *after* a write
transaction's mutex is unlocked (in mdb.master3). This can result in a race
condition where a second transaction can start and subsequently assign a new
mt_spill_pgs list to the transaction structure that it reuses. If this occurs
after the first transaction unlocks the mutex, but before it performs the free
operation on mt_spill_pgs, then the first transaction will end up calling a
free on the same spilled page list as the second transaction, resulting in a
double free (and crash).
It would seem to be an extremely unlikely scenario to actually happen, since
the free call is literally the next operation after the mutex is unlocked, and
the second transaction would need to make it all the way to the point of saving
the freelist before a page spill list is likely to be allocated. Consequently,
this probably has rarely happened. However, one of our users (see
https://github.com/DoctorEvidence/lmdb-store/issues/48 for the discussion) has
noticed this occurring, and it seems that it may be particularly likely to
happen on MacOS on the new M1 silicon. Perhaps there is some peculiarity to how
the threads are more likely to yield execution after a mutex unlock, I am not
sure. I was able to reproduce the issue by intentionally manipulating the
timing (sleeping before the free) to verify that the race condition is
technically feasible, and apparently this can happen "in the wild" on MacOS, at
least with an M1.
It is also worth noting that this is due to (or a regression from) the fix for
ITS#9155
(https://github.com/LMDB/lmdb/commit/cb256f409bb53efeda4ac69ee8165a0b4fc1a277)
where the free call was moved outside the conditional (for having a parent)
that had previously never been executed after the mutex is unlocked, but now is
called after the unlock.
Anyway, the solution is relatively simple, the free call simply has to be moved
above the unlock. In my patch, I also moved the free call for mt_dirty_ovs. I
am not sure what OVERFLOW_NOTYET/mt_dirty_ovs is for, but presumably it should
be handled the same. This could alternately be solved by saving the reference
to these lists before unlocking, and freeing after unlocking, which would
slightly decrease the amount of processing within the mutex guarded code. Let
me know if you prefer a patch that does that.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9563
Issue ID: 9563
Summary: OpenLDAP enable TLS1.3
Product: OpenLDAP
Version: 2.4.45
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: santhu227(a)gmail.com
Target Milestone: ---
How we can enable TLS1.3 on OopenLDAP for ubuntu 18.04.5 LTS.
Package details :
OS PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
OpenSSL 1.1.1g 21 Apr 2020.
grep -R olcTLS /etc/ldap/slapd.d/
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCRLCheck: none
/etc/ldap/slapd.d/cn=config.ldif:olcTLSProtocolMin: 3.4
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCipherSuite: NORMAL
/etc/ldap/slapd.d/cn=config.ldif:olcTLSVerifyClient: try
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCACertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile:
/etc/ldap/sasl2/ldap_server_new_13.key
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
dpkg -s slapd | grep Version
Version: 2.4.45+dfsg-1ubuntu1.10
Is there any possibility to enable TLS1.3 on slapd service(OpenLDAP server) for
above configuration.
If need to upgrade any package will it be possible to upgrade or update on
Ubuntu 18.04.5.
openssl client output where openssl is not able to connecte with TLS1.3. Same
will list ciphers for TLS1.2
openssl s_client -connect <host>:636 -tls1_3
CONNECTED(00000003)
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 215 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9562
Issue ID: 9562
Summary: Unable to setup TLS1.3
Product: OpenLDAP
Version: 2.4.45
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: santhu227(a)gmail.com
Target Milestone: ---
How we can enable TLS1.3 on OopenLDAP for ubuntu 18.04.5 LTS.
Package details :
OS PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
OpenSSL 1.1.1g 21 Apr 2020.
grep -R olcTLS /etc/ldap/slapd.d/
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCRLCheck: none
/etc/ldap/slapd.d/cn=config.ldif:olcTLSProtocolMin: 3.3
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCipherSuite: NORMAL
/etc/ldap/slapd.d/cn=config.ldif:olcTLSVerifyClient: try
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCACertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile:
/etc/ldap/sasl2/ldap_server_new_13.key
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
dpkg -s slapd | grep Version
Version: 2.4.45+dfsg-1ubuntu1.10
Is there any possibility to enable TLS1.3 on slapd service(OpenLDAP server) for
above configuration.
If need to upgrade any package will it be possible to upgrade or update on
Ubuntu 18.04.5.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9560
Issue ID: 9560
Summary: Dead images in documentation
Product: website
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: website
Assignee: bugs(a)openldap.org
Reporter: shea.ramage(a)gmail.com
Target Milestone: ---
Created attachment 823
--> https://bugs.openldap.org/attachment.cgi?id=823&action=edit
Screenshot of broken images
Documentation release 2.5 (https://www.openldap.org/doc/admin25) contains
several dead image links. One example (Figure 3.1)
https://www.openldap.org/doc/admin25/config_local.png results in a 404 not
found error, however changing the '5' in the URL to a '4' loads an image
correctly.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8882
--- Comment #10 from Matthew Hardin <mhardin(a)symas.com> ---
It appears that the source code for the module is no longer on the FTP server.
Would someone from daasi please upload it and mark the correct URL in the
comment?
Thanks,
--
You are receiving this mail because:
You are on the CC list for the issue.