openldap-bugs

openldap-bugs@openldap.org

1 participants
21509 discussions

(ITS#5549) slapd SEGV faults in entry_partsize when monitoring
by andreas.mueller＠othello.ch 11 Jun '08

11 Jun '08

Full_Name: Andreas Mueller Version: 2.4.9 OS: Solaris 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (193.134.170.35) We have four slapd servers in a mirrormode configuration. This generally works well. We monitor these servers using ldapsearches to cn=Monitor every minute, and collect performance data to construct load/performance graphs with rrdtool. Unfortunately, it sometimes happens that slapd crashes during the monitoring query. Using gdb, we were able to get a stack backtrace: Core was generated by `/usr/local/libexec/slapd'. Program terminated with signal 11, Segmentation fault. #0 0x0005fd48 in entry_partsize () (gdb) bt #0 0x0005fd48 in entry_partsize () #1 0x000603b4 in entry_flatsize () #2 0x0006a5c8 in slap_send_search_entry () #3 0x00134330 in monitor_send_children () #4 0x001348e0 in monitor_back_search () #5 0x000523ac in fe_op_search () #6 0x00051b64 in do_search () #7 0x0004dd8c in connection_operation () #8 0x0004e4c4 in connection_read_thread () #9 0x001a22a8 in ldap_int_thread_pool_wrapper () #10 0xfe3c5800 in __tbl_10_huge_digits () from /lib/libc.so.1 All cores obtained so far show that the segmentation fault occured at the same location inside entry_partsize. Unfortunately we cannot systematically reproduce this behaviour, and we also cannot get the line number (binaries are stripped). We have not tried other versions or other platforms. For production, we use the versions available in package form from www.sunfreeware.com, but the error also happens on servers we have compiled ourselves from the sources.

1 0

(ITS#5548) syncprov evaluates ACL rules with wrong connection info
by rein＠OpenLDAP.org 11 Jun '08

11 Jun '08

Full_Name: Rein Tollevik Version: 2.4.10 (CVS head) OS: linux, solaris URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.215.2.34) Submitted by: rein Access control rules that uses connection data are evaluated using the wrong connection structure. The problem is in syncprov_matchop() where it around line 1233 assigns: op2.o_hdr = op->o_hdr; This causes ACL rules to be tested against the connection that made the change, not the syncrepl connection. It should retain the value from ss->s_op. Rein Tollevik Basefarm AS

1 0

(ITS#5547) JLDAP: unauthenticated bind silently converted to anonymous bind
by johannes.geiger＠vkb.de 11 Jun '08

11 Jun '08

Full_Name: Johannes Geiger Version: n/a OS: Windows, Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (62.245.172.60) While the documentation of JLDAP states that only authenticated and anonymous bind are supported, JLDAP silently converts an unauthenticated bind to an anonymous one. >From LDAPconnection.java boolean anonymous = false; if( passwd.length == 0) { anonymous = true; // anonymous, passwd length zero with simple bind dn = ""; // set to null if anonymous } (I even think there is a bug in this, as the flag "anonymous" stays on false, if there is a password given but no dn.) This is in fact a security issue, as - while unauthenticated bind usually is forbidden by the server, anonymous bind is allowed - the client using bind for authentication reasons might be led to believe in successful authentication whereas the server only accepted an anonymous bind and did not do any credential verification.

1 0

(ITS#5546) slapd aborts using slapo-pcache when caching negative searches
by toby＠inf.ed.ac.uk 11 Jun '08

11 Jun '08

Full_Name: Toby Blake Version: 2.4.10 OS: Scientific Linux 5.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (129.215.218.33) Hi there, If I specify a negative ttl when using slapo-pcache, e.g... overlay pcache proxycache bdb 5000 1 500 300 proxycachequeries 10000 proxyattrset 0 uid # proxytemplate using ttl and negative ttl of 1800 proxytemplate (uid=) 0 1800 1800 ... slapd aborts whenever there is a negative search to cache. The cause of this seems to be the assert(0) in pcache.c:pcache_op_cleanup, code fragment starting line 2010... switch ( si->caching_reason ) { case PC_POSITIVE: cache_entries( op, rs, &qc->q_uuid ); break; case PC_SIZELIMIT: qc->q_sizelimit = rs->sr_nentries; break; default: assert( 0 ); break; } The value of si>caching_reason when slapd SIGABRTs is PC_NEGATIVE (which isn't handled by the switch statement). Let me know if you need any more info... Cheers Toby Blake School of Informatics University of Edinburgh

1 0

(ITS#5545) Inconsistency in multi-master setup
by st＠itsc.cuhk.edu.hk 11 Jun '08

11 Jun '08

Full_Name: SiuTo Wong Version: 2.4.10 OS: CentOS 5 (Final) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (137.189.29.184) Have setup 2-node multi-master configuration. Found that when operating on same set of users at high loading, there will be consistency between the masters. The problem can be simulated by running copies of perl script to add/delete the same set of users simultaneously, e.g. add user a001 - a100 & delete user a001 - a100 & or add user a001 - a100 & add user a001 - a100 & There is no problem if multiple threads of add/delete are running, when operating on different sets of users. Attached please find snap of syncrepl setting of one of the servers. All attributes are the same on both masters, except serverId, rid, and provider. Thanks a lot. ====================== cut here ====================== index entryCSN,entryUUID eq lastmod on serverId 2 syncrepl rid=002 provider=ldap://192.168.28.70 starttls=yes tls_reqcert=never tls_cacert=/etc/CA/cacert.pem type=refreshAndPersist retry="5 + 5 +" searchbase="dc=mydomain,dc=hk" schemachecking=off bindmethod=simple binddn="cn=srAdmin,ou=People,dc=mydomain,dc=hk" credentials=youguess interval=00:00:00:05 mirrormode true overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 limits dn.exact="cn=srAdmin,ou=People,dc=cuhk,dc=edu,dc=hk" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ====================== cut here ======================

1 0

Re: (ITS#5462) Allow setting of RANDOM_FILE for gnutls
by hyc＠symas.com 10 Jun '08

10 Jun '08

pogma(a)thewrittenword.com wrote: > Full_Name: Peter O'Gorman > Version: 2.4.8 > OS: multiple > URL: ftp://ftp.openldap.org/incoming/the-written-word-080410.patch > Submission from: (NULL) (24.76.165.223) > > > gcrypt-1.4.x and later allow the egd socket path to be set. This patch allows > the conf file option to work when building openldap with gnutls on systems that > do not have a /dev/random. Hm, this patch is a silent no-op if the gcrypt function is missing. Currently the randfile option is already documented as being ignored by GNUtls. I would prefer that the behavior is absolutely consistent - either the feature always works or is always ignored. Perhaps we should require gcrypt 1.4 or newer? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5464) ucred guarded by __USE_GNU in glibc 2.8
by hyc＠symas.com 06 Jun '08

06 Jun '08

rhafer(a)suse.de wrote: > Full_Name: Ralf Haferkamp > Version: Any > OS: Linux (glibc 2.8) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (85.8.71.17) > > > Newer glibc Version guards the definition of struct ucred (e.g. used in > liblutil/getpeereid.c) by __USE_GNU, hence it is only available when _GNU_SOURCE > is defined. > > The matching glibc changelog only say "Cleanup namespace.". Here's the diff: > > http://sourceware.org/cgi-bin/cvsweb.cgi/libc/sysdeps/unix/sysv/linux/bits/… This is a bug in glibc. Luca Scamoni reported it upstream here http://sources.redhat.com/bugzilla/show_bug.cgi?id=6545 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5517) add superclass of existing class fails
by Kurt＠OpenLDAP.org 05 Jun '08

05 Jun '08

On Jun 5, 2008, at 6:31 AM, h.b.furuseth(a)usit.uio.no wrote: > And when they add the absent A and that fails, but we can fix that. I think the best is option is disallow addition of an unlisted subject and disallow the removal of a unlisted subclass (except by replace). This will provide more a more consistent and symmetric behavior. In your initial report, it was this inconsistent and non-symmetric behavior that was your most significant concern. As far as RFC conformance goes, I argue that with this change, the behavior would be fully conformant. No where in the RFCs does it require servers to return implicitly added values, no where in the RFCs does it preclude servers from removing implicitly added values upon removal of values which caused there addition. The concern I have is impact on clients which add a class and then delete that class, expecting it just to work. But if that class is subclass, and the add causes the insertion of some other class, then the delete will either leave that other class there or lead to an error, both undesirable and unexpected behaviors. I think the mistake that LDAP designers made (long ago) was not to require LDAP CLIENTS to provide all (non-top) classes, as is required of DAP clients. Regarding objectClass being special (especially with regard to its equality matching rule): consider (objectClass=top) and X.500 "top may be omitted" statement. -- Kurt

1 0

Re: (ITS#5517) add superclass of existing class fails
by h.b.furuseth＠usit.uio.no 05 Jun '08

05 Jun '08

(I seem to be arguing myself into two different corners here, but anyway...) Kurt(a)OpenLDAP.org writes: >On May 24, 2008, at 2:37 PM, h.b.furuseth(a)usit.uio.no wrote: >> ando(a)sys-net.it writes: >>> The issue right now is caused by the fact that comparing present >>> values with the asserted one causes objectSubClassMatch() to check >>> for match including superiors. >> >> This looks like a bug to me. > > Maybe in the RFCs. Yes, to my eyes it cleary says what you say was not intended. >> objectClass has EQUALITY matching rule >> objectIdentifierMatch, which does not follow the object class >> inheritance chain. > > Yes, but objectClass is quite special (despite being a > userApplications attribute). Hpmh. Not very, according to RFCs 4511-12. Maybe we all "knew" it so well that we never noticed, during several IETF WGs. > For instance, (objectClass=*) is to match DSEs which don't have an > objectClass attribute. That's explicitly mentioned in RFC 4512 for the root DSE, as is the (objectClass=subschema) special case. Section RFC 4512 section 3.3 says each entry in the DIT has an 'objectClass' attribute. Are other DSEs not in the DIT? There is RFC 4511 section 4.5.1 (Search Request)'s statement that List and Read operations can be emulated with a search for (objectClass=*). Nowhere else can I find that (objectClass=*) is special. > Likewise, objectClass=foo can match objectClass attributes which > don't explicitly contain foo. Not according what the RFCs say to my eyes, (below): >> See RFC 4517 section 4.2.26. RFC 4512 section 3.3 >> (the 'objectClass' attribute) does not special-case this. >> >> What makes slapd work is that it also disobeys RFC 4512 section 3.3: >> "When creating an entry or adding an 'objectClass' value to an >> entry, >> all superclasses of the named classes SHALL be implicitly added as >> well if not already present." > >> This doesn't say the classes shall be considered to be implicitly >> present, like slapd does. > > You are reading 3.3 as if it said "SHALL be added (by the server)". > It doesn't say "SHALL be added (by the server). It says "SHALL be > implicitly added" (presumedly by the server). I don't see how that changes anything, but then I'm not a native English speaker. > This was discussed during LDAPbis discussions. As the Editor of RFC > 4512, I can say that it was my intent to allow servers to merely treat > superclasses as being present. Hard do argue with that. I couldn't find these discussions though. Do you remember where/when? All I found was this, which seems to imply the opposite: http://www.openldap.org/lists/ietf-ldapbis/200403/msg00023.html >> Instead slapd should add the missing classes to the actual object, > > Doing so is problematic. A client which adds B then deletes B would > be surprised by non-net-zero result of the operation(s). Clients will be surprised anyway. Currently clients are being surprised when (objectClass=A) matches even though A is absent. And when they add the absent A and that fails, but we can fix that. >> just like it adds some other attribute/values >> implicitly (createTimestamp, subschemaSubentry, etc). > > These are operational attributes. ObjectClass is an userApplications > attribute. Servers should not muck with the values of userApplication > attributes. Well, it does when it adds missing naming attributes (since RFC4511, ITS#5412). I guess that is a better example. And it "mucks with" objectClass in a different way anyway, as you've just pointed out. -- Hallvard

1 0

Re: (ITS#5540) Normalization assertion in attr.c
by unix.gurus＠gmail.com 04 Jun '08

04 Jun '08

Hi, On Wed, Jun 4, 2008 at 2:20 PM, Hallvard B Furuseth <h.b.furuseth(a)usit.uio.no> wrote: > I haven't follwed this ITS, but a few notes anyway: > > unix.gurus(a)gmail.com writes: >> monitorCounter >> monitorCounter does not have an equality matching rule, > > Yes it does. back-monitor/init.c line 1710. What are you looking at? > (Hmm, I too had the impression it had no EQUALITY rule...) I'm working with OpenLDAP 2.4.9. You're right. integerMatch has an equality rule but no normalizing function. The logic that determines whether a normalized value should exist says: have_norm = a->a_desc->ad_type->sat_equality != NULL && a->a_desc->ad_type->sat_equality->smr_normalize != NULL; ... new_nval = nvals != NULL; ... if ( have_norm != new_nval ) { assert() So we don't need nvals for integers. For this reason I was right to remove the nval for monitorCounter, monitorOpInitiated, monitorOpCompleted, but my reasoning was wrong. >> monitorOpCompleted >> monitorOpInitiated >> These attributes do not have equality matching rules, > > These do too, inherited from monitorCounter. See above. > it doesn't work right in 2.3 however: > > ldapsearch -LLL -bcn=monitor -s one '(monitorCounter=0)' monitorCounter > dn: cn=Operations,cn=Monitor > monitorOpInitiated: 231542983 > monitorOpCompleted: 231542982 I wonder if val is being maintained and nval is being left at 0. The code at the end of monitor_subsys_ops_update() maintains a_vals but not a_nvals, so that is probably the problem: /* NOTE: no minus sign is allowed in the counters... */ UI2BV( &a->a_vals[ 0 ], nInitiated ); ldap_pvt_mp_clear( nInitiated ); ... /* NOTE: no minus sign is allowed in the counters... */ UI2BV( &a->a_vals[ 0 ], nCompleted ); ldap_pvt_mp_clear( nCompleted ); >> namingContexts >> configContext >> dynamicSubtrees >> >> These attributes do not have equality matching rules, but probably >> should. I add 'EQUALITY distinguishedNameMatch' to them in >> schema_prep.c. > > No, that breaks the definitions in the RFCs they come from. (See their > DESC strings.) I don't know why they lack EQUALITY rules, maybe we just > forgot when we defined them, but that's the way it is. Same with > supportedControl. Ok, so we should not define nvals for them? > monitorContext, readOnly and the olc* attributes are defined by OpenLDAP > (their OIDs start with 1.3.6.1.4.1.4203) and can be modified if we feel > like it. Personally I prefer attrs to have the matching rules they can > have unless there is a reason not to, but I didn't write these modules > so I don't know if there _is_ a reason not to. -- Thanks, Sean Burford

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs