openldap-bugs

openldap-bugs@openldap.org

1 participants
21001 discussions

Re: (ITS#5344) Wrong check for bad Modify DN
by h.b.furuseth＠usit.uio.no 11 Feb '08

11 Feb '08

Pierangelo Masarati writes: > You should apply your initial patch (to HEAD, 2.4), Done. > then modify HEAD to pass dest_dn/dest_ndn Later. -- Hallvard

1 0

Re: (ITS#5328) backends sending/setting results
by h.b.furuseth＠usit.uio.no 11 Feb '08

11 Feb '08

Some fixed in HEAD. Remaining bugs: > Looking at the code, some overlays also send results when used as > be_extended: pcache:pcache_op_privdb(), retcode, rwm, slapi_overlay. Hmm - back-ldap does send_ldap_extended() too. I don't know any of that code well though. Might have a look later, if nobody else does. > * be->be_fetch() (bi->bi_entry_get_rw()): > The LDAP result code matters (...) It can return just a boolean > in (...) back-relay. I haven't looked at what it should return when not forwarding to the backend. relay_back_has_subordinates() is also broken. It should return an LDAP result code, and if returning LDAP_SUCCESS it must also set *hasSubs to LDAP_COMPARE_FALSE or LDAP_COMPARE_TRUE. See bdb_hasSubordinates() for an example. However: slapd's be_has_subordinates() API seems broken: It has no way to return "don't know" or normal errors which slapd will pay attention to. If it returns non-success, test_ava_filter(,,,LDAP_FILTER_EQUALITY) returns LDAP_OTHER. Looks abit excessive. OTOH test_presence_filter() assumes that if the backend function exists then attr hasSubordinates does too. > back-ldap:ldap_back_entry_get() can return LDAP_NO_MEMORY. > Maybe that's OK and instead send_ldap_response() should change > negative negative result codes to LDAP_OTHER? Awaiting opinions - will do the smallest change and patch back-ldap if nobody says anything. -- Hallvard

1 0

Re: (ITS#5369) GSSAPI support for client library
by mimir＠samba.org 11 Feb '08

11 Feb '08

--UugvWAfsgieZRqgk Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Kurt, On Mon, Feb 11, 2008 at 09:06:19AM -0800, Kurt Zeilenga wrote: > On Feb 11, 2008, at 1:09 AM, mimir(a)samba.org wrote: > >> Full_Name: Rafal Szczesniak >> Version: HEAD >> OS: GNU/Linux >> URL: http://www.samba.org/~mimir/gssapi-head.diff > > The submitted patch file does not contain (at the top of the file, not = =20 > as part of the diffs) the required notices. I'm sorry about that. I was submitting it late yesterday and must have miss= ed that. I'll update the diff and let you know soon. > Please review=20 > http://www.openldap.org/devel/contributing.html and insert appropriate=20 > notices. Also, please don't include in the diffs derived files (e.g.,=20 > configure). Of course. My mistake. cheers, --=20 Rafal Szczesniak Samba Team member http://www.samba.org Likewise Software http://www.likewisesoftware.com --UugvWAfsgieZRqgk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFHsK9nHvdfyv3qiKkRAiusAKChoX739lSkfFFRSqXxZG9ht5l3oQCghVrP mWR71B2o2KIifs5uaiMzH58= =SPnD -----END PGP SIGNATURE----- --UugvWAfsgieZRqgk--

1 0

Re: (ITS#5370) race condition in slap_op_time()
by hyc＠symas.com 11 Feb '08

11 Feb '08

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: HEAD, RE23, RE24 > OS: > URL: > Submission from: (NULL) (129.240.6.233) > Submitted by: hallvard > > > slapd/operation.c:slap_op_time() can decrease last_time: > > thread 1: *t = slap_get_time(); > <clock: increment time()> > thread 2: *t = slap_get_time(); > thread 2: with mutex lock: increment last_time, set last_incr = 0; > thread 1: with mutex lock: decrement last_time, set last_incr = 0; > > The simplest fix is to move the slap_get_time() call inside the > (global) slap_op_mutex lock. > > However as far as I can tell, only the accesslog overlay uses > op->o_tincr, the value which needs the mutex. And accesslog > calls slap_op_time() itself when it needs that value. > So maybe we should remove the op->o_tincr field. Other calls > to slap_op_time() can be replaced with slap_get_time(). Sounds like a good idea. It was somewhat redundant with the CSN counter (except that this was for all operations, and CSN was only for write operations) and it never became generally useful. (Shifted to microsecond timestamps in 2.4, because tincr isn't useful across multiple servers.) I guess it makes more sense to make it specific to accesslog. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5369) GSSAPI support for client library
by kurt＠OpenLDAP.org 11 Feb '08

11 Feb '08

On Feb 11, 2008, at 1:09 AM, mimir(a)samba.org wrote: > Full_Name: Rafal Szczesniak > Version: HEAD > OS: GNU/Linux > URL: http://www.samba.org/~mimir/gssapi-head.diff The submitted patch file does not contain (at the top of the file, not as part of the diffs) the required notices. Please review http://www.openldap.org/devel/contributing.html and insert appropriate notices. Also, please don't include in the diffs derived files (e.g., configure). -- Kurt

1 0

(ITS#5370) race condition in slap_op_time()
by h.b.furuseth＠usit.uio.no 11 Feb '08

11 Feb '08

Full_Name: Hallvard B Furuseth Version: HEAD, RE23, RE24 OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard slapd/operation.c:slap_op_time() can decrease last_time: thread 1: *t = slap_get_time(); <clock: increment time()> thread 2: *t = slap_get_time(); thread 2: with mutex lock: increment last_time, set last_incr = 0; thread 1: with mutex lock: decrement last_time, set last_incr = 0; The simplest fix is to move the slap_get_time() call inside the (global) slap_op_mutex lock. However as far as I can tell, only the accesslog overlay uses op->o_tincr, the value which needs the mutex. And accesslog calls slap_op_time() itself when it needs that value. So maybe we should remove the op->o_tincr field. Other calls to slap_op_time() can be replaced with slap_get_time().

1 0

Re: (ITS#5339) wrong referral from back-bdb
by h.b.furuseth＠usit.uio.no 11 Feb '08

11 Feb '08

h.b.furuseth(a)usit.uio.no writes: > Also, now that I think of it, back-hdb/ldif subtree rename is broken if > there are referral objects with DNs in the subtree. Duh, that's a feature, not a bug. If a referral entry gets renamed, that does not magically rename the entry it refers to. It gets to be a bug if one has cooperating servers where they all rename the entry. Anyway, getting back to back-bdb - once the database has a ref attribute with a DN, I don't see how rewriting it is worse than not rewriting. So I think the fix for now is to to follow the RFCs. -- Hallvard

1 0

(ITS#5369) GSSAPI support for client library
by mimir＠samba.org 11 Feb '08

11 Feb '08

Full_Name: Rafal Szczesniak Version: HEAD OS: GNU/Linux URL: http://www.samba.org/~mimir/gssapi-head.diff Submission from: (NULL) (12.104.75.4) OpenLDAP client libraries do not implement convenient mechanisms for interfacing to MS Active Directory with minimum necessary configuration. Also, SASL implementation is tightly connected with Cyrus SASL libs. Submitted patch modifies the library to provide more generic SASL layer used both by Cyrus SASL and contributed GSSAPI mechanism. The GSSAPI itself is limited to Kerberos 5, at the moment, but the goal is to provide complete SASL layer for easy connecting to MS servers.

1 0

Re: (ITS#5368) s/strncasecmp/ber_bvstrncasecmp/ broke substring check for {CLEARTEXT}
by hyc＠symas.com 10 Feb '08

10 Feb '08

steve.langasek(a)canonical.com wrote: > Full_Name: Steve Langasek > Version: 2.4.7 > OS: Debian > URL: http://people.ubuntu.com/~vorlon/sasl-cleartext-strncasecmp.patch > Submission from: (NULL) (2001:4830:1244:0:219:d2ff:fe76:2acb) > > > A regression was introduced in revision 1.239 of servers/slapd/sasl.c. > Previously, sasl_ap_lookup() would check for a leading string of {CLEARTEXT} and > trim it from the userPassword value returned to SASL; but in revision 1.239, the > strncasecmp() was replaced with ber_bvstrcasecmp() which instead looks for an > exact match of the whole string, causing passwords to be handed back to SASL > with the leading "{CLEARTEXT}" attached. > > The referenced patch is verified to correct this regression. Thanks, this is now fixed in HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5368) s/strncasecmp/ber_bvstrncasecmp/ broke substring check for {CLEARTEXT}
by steve.langasek＠canonical.com 10 Feb '08

10 Feb '08

Full_Name: Steve Langasek Version: 2.4.7 OS: Debian URL: http://people.ubuntu.com/~vorlon/sasl-cleartext-strncasecmp.patch Submission from: (NULL) (2001:4830:1244:0:219:d2ff:fe76:2acb) A regression was introduced in revision 1.239 of servers/slapd/sasl.c. Previously, sasl_ap_lookup() would check for a leading string of {CLEARTEXT} and trim it from the userPassword value returned to SASL; but in revision 1.239, the strncasecmp() was replaced with ber_bvstrcasecmp() which instead looks for an exact match of the whole string, causing passwords to be handed back to SASL with the leading "{CLEARTEXT}" attached. The referenced patch is verified to correct this regression.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs