openldap-bugs

openldap-bugs@openldap.org

1 participants
21513 discussions

(ITS#5812) New option to disable SASL host canonicalization
by geert＠boskant.nl 15 Nov '08

15 Nov '08

Full_Name: Geert Jansen Version: 2.4 OS: Linux URL: ftp://ftp.openldap.org/incoming/geert-jansen-081115.patch Submission from: (NULL) (12.230.186.195) This is a resubmission of my earlier patch in [1]. I'm asking for this patch to be included into OpenLDAP. The patch adds an LDAP option called LDAP_OPT_X_SASL_NOCANON to disable host name canonicalization using reverse DNS for the host name that is passed into SASL. Instead, it passes verbatim the host name part from the LDAP URI and lets SASL do the canonicalization. The option is disabled by default. Kerberos requires a canonical host name to work. Traditionally, host name canonicalization has been done using reverse DNS. However, this is problematic. See the comment below from the MIT Kerberos source on this subject: /* XXX: This is *so* bogus. There are several cases where this won't get us the canonical name of the host, but this is what we've trained people to expect. We'll probably fix it at some point, but let's try to preserve the current behavior and only shake things up once when it comes time to fix this lossage. */ Since some time MIT Kerberos has support for server-side canonicalization which is an alternative for the DNS based scheme. By default it uses both, but with an option "rdns = no", reverse DNS can be disabled. The use case for this is environments that do not have reverse DNS set up correctly. Especially in Windows Active Directory environments this is very common. Administrators are afraid to enable scavenging for their zones, and therefore any server IP change will leave a stale PTR record in place. This breaks reverse DNS based canonicalization if the IP adress is reassigned. The behaviour enabled by this patch should remain optional and cannot become the default. It breaks the use case when multiple LDAP servers are load balanced using a CNAME record. [1] http://www.openldap.org/lists/openldap-devel/200710/msg00071.html

1 0

Re: (ITS#5807) build broken for solaris 9
by brett.maxfield＠gmail.com 15 Nov '08

15 Nov '08

------=_Part_31358_1557470.1226757706470 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline There's a path worth travelling, not. These are relatively old servers, but even assuming Sun could be made to care, which i doubt, thier solution would probably be to upgrade the server to sol10 / new hardware, and not provide a patch. But i think the solution is probably in autoconf detection somehow, i'll see if i can do something with autoconf/automake stuff. This is sol9 sparc with gcc from sunfreeware, so maybe the autoconf assumes solaris cc in parts, as gcc was not always around. I dont have any sparc gear presently to test on, i'll investigate next week.. On Sat, Nov 15, 2008 at 9:09 AM, Howard Chu <hyc(a)symas.com> wrote: > The Solaris 9 docs say otherwise. > > http://docs.sun.com/app/docs/doc/816-0214/6m6nf1omp?a=view#indexterm-646 > > >>> > If the AI_PASSIVE bit is set in the ai_flags member of the hints structure, > the caller plans to use the returned socket address structure in a call to > bind(3SOCKET). > <<< > > We are using the flag correctly per the documentation, therefore I don't > believe this is an OpenLDAP bug. Take this up with Sun... > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > ------=_Part_31358_1557470.1226757706470 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline There's a path worth travelling, not. These are relatively old servers, but even assuming Sun could be made to care, which i doubt, thier solution would probably be to upgrade the server to sol10 / new hardware, and not provide a patch. But i think the solution is probably in autoconf detection somehow, i'll see if i can do something with autoconf/automake stuff. This is sol9 sparc with gcc from sunfreeware, so maybe the autoconf assumes solaris cc in parts, as gcc was not always around. I dont have any sparc gear presently to test on, i'll investigate next week.. <div class="gmail_quote">On Sat, Nov 15, 2008 at 9:09 AM, Howard Chu <<a href="mailto:hyc@symas.com">hyc(a)symas.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> The Solaris 9 docs say otherwise. <a href="http://docs.sun.com/app/docs/doc/816-0214/6m6nf1omp?a=view#indexterm-646" target="_blank">http://docs.sun.com/app/docs/doc/816-0214/6m6nf1omp?a=view#indexterm-646</a> >>> If the AI_PASSIVE bit is set in the ai_flags member of the hints structure, the caller plans to use the returned socket address structure in a call to bind(3SOCKET). <<< We are using the flag correctly per the documentation, therefore I don't believe this is an OpenLDAP bug. Take this up with Sun... --  -- Howard Chu  CTO, Symas Corp.           <a href="http://www.symas.com" target="_blank">http://www.symas.com</a>  Director, Highland Sun     <a href="http://highlandsun.com/hyc/" target="_blank">http://highlandsun.com/hyc/</a>  Chief Architect, OpenLDAP  <a href="http://www.openldap.org/project/" target="_blank">http://www.openldap.org/project/</a> </blockquote></div> ------=_Part_31358_1557470.1226757706470--

1 0

Re: (ITS#5811) slapo-dds documentation
by ando＠sys-net.it 15 Nov '08

15 Nov '08

Emmanuel Dreyfus wrote: > Pierangelo Masarati <ando(a)sys-net.it> wrote: > >> So, was that the issue? > > Yes, and I just added it to the man page. Probably, slapo-dds should allow a different means to perform internal operations as a privileged user without requiring rootdn to be defined. This problem is common to many overlays (and features in general) that need to perform internal operations, like syncrepl. Documenting this requirement is fine by now, but the general problem persists. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5811) slapo-dds documentation
by manu＠netbsd.org 15 Nov '08

15 Nov '08

Pierangelo Masarati <ando(a)sys-net.it> wrote: > So, was that the issue? Yes, and I just added it to the man page. -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

Re: (ITS#5804) attribute value regex expantion
by manu＠netbsd.org 15 Nov '08

15 Nov '08

Emmanuel Dreyfus <manu(a)netbsd.org> wrote: > I committed the modification: > http://www.openldap.org/lists/openldap-commit/200811/msg00303.html And this: http://www.openldap.org/lists/openldap-commit/200811/msg00302.html -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

Re: (ITS#5804) attribute value regex expantion
by manu＠netbsd.org 15 Nov '08

15 Nov '08

I committed the modification: http://www.openldap.org/lists/openldap-commit/200811/msg00303.html -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

Re: (ITS#5811) slapo-dds documentation
by ando＠sys-net.it 15 Nov '08

15 Nov '08

manu(a)netbsd.org wrote: > Full_Name: Emmanuel Dreyfus > Version: HEAD > OS: NetBSD > URL: > Submission from: (NULL) (213.41.141.172) > > > slapo-dds(5) does not document that rootdn definition is mandatory for proper > function So, was that the issue? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5811) slapo-dds documentation
by manu＠netbsd.org 15 Nov '08

15 Nov '08

Full_Name: Emmanuel Dreyfus Version: HEAD OS: NetBSD URL: Submission from: (NULL) (213.41.141.172) slapo-dds(5) does not document that rootdn definition is mandatory for proper function

1 0

Re: (ITS#5807) build broken for solaris 9
by hyc＠symas.com 14 Nov '08

14 Nov '08

brett.maxfield(a)gmail.com wrote: > Full_Name: Brett Maxfield > Version: 2.4.RELENG > OS: Solaris 9 (SunOS 2.9) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (203.18.108.167) > > > Hello, > > Trying to make tests for RE24 and 2.4.12 on solaris (SunOS 2.9) and getting a > failure : > > (build options - berkeleyDB previously installed with > --prefix=/usr/local/openldap24) > > export PATH=/usr/local/bin:/usr/ccs/bin:/usr/bin:/bin:/usr/sbin:/sbin > export LD_LIBRARY_PATH=/usr/local/openldap24/lib:/usr/local/ssl/lib:/usr/local/lib > CPPFLAGS="-I/usr/local/openldap24/include -I/usr/local/include" > LDFLAGS="-L/usr/local/openldap24/lib -L/usr/local/lib > -R/usr/local/openldap24/lib -R/usr/local/lib" ./configure --enable-shared > --enable-ssl --disable-ipv6 --with-threads --enable-slapd --enable-backends > --enable-overlays --disable-sql --disable-ndb --disable-slapi > > (result of make test, fails on the first test) > > # cat tests/testrun/slapd.1.log > @(#) $OpenLDAP: slapd 2.4.12 (Nov 13 2008 17:57:10) $ > testuser@myhost:/export/home/testuser/openldap24-build/openldap-2.4.12/servers/slapd > ldap_pvt_gethostbyname_a: host=myhost, r=0 > daemon_init: ldap://localhost:9011/ > daemon_init: listen on ldap://localhost:9011/ > daemon_init: 1 listeners to open... > ldap_url_parse_ext(ldap://localhost:9011/) > daemon: getaddrinfo() failed: invalid ai_flags > slapd stopped. > connections_destroy: nothing to destroy. > > ai_flags has to do with the options to listen/accept, and should be something > like NULL, it seemss sol9 does not like the AI_PASSIVE value. > > I manually changed it to šhints.ai_flags = NULL; // AI_PASSIVE;" > (servers/slapd/daemon.c line 1131) and the code compiles, and make test > succeeds. > > For solaris 9, hints.ai_flags should just use NULL. The Solaris 9 docs say otherwise. http://docs.sun.com/app/docs/doc/816-0214/6m6nf1omp?a=view#indexterm-646 >>> If the AI_PASSIVE bit is set in the ai_flags member of the hints structure, the caller plans to use the returned socket address structure in a call to bind(3SOCKET). <<< We are using the flag correctly per the documentation, therefore I don't believe this is an OpenLDAP bug. Take this up with Sun... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5809) syncrepl + back-ldif + "rename to same DN" fails
by hyc＠symas.com 14 Nov '08

14 Nov '08

Pierangelo Masarati wrote: > hyc(a)symas.com wrote: >> h.b.furuseth(a)usit.uio.no wrote: >>> Pierangelo Masarati writes: >>>> I think ITS#5326 is related. Namely, write operations (add, rename) >>>> should always rebuild the (new)DN hierarchically from the tree. >>> I'm not sure what exactly the problem is, if any:-) Syncrepl itself >>> needs to handle databases that are not that nice: We can't require >>> that of back-perl, nor back-ldap which accesses a non-OpenLDAP server >>> (if that makes any sense). And syncrepl + rwm, maybe? Also syncrepl >>> is an RFC (4533) so it should handle non-OpenLDAP peers. >> Syncrepl of course *handles* all of those cases. The only issue here is that >> our tests expect the results to be in a specific order, which is obviously an >> invalid requirement in the grand scheme of things. > I'm hitting an issue like this in some of the replication tests I'm > currently performing. For this purpose, I think we could hack > ldapsearch (or add a new prog, or use a script on ldapsearch output) > that sorts entries content attribute-wise and, within each attribute, > value-wise. Something like "sort" applied entry-wise after unwrapping > line folding, optionally case-insensitive would probably suffice. Hm, I already added that, when I was first putting back-ndb thru the test suite. In acfilter.sh, but currently only used for back-ndb too. At any rate, I've tweaked the consumer's rename detection code, so this specific ITS is now fixed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs