openldap-bugs

openldap-bugs@openldap.org

1 participants
20959 discussions

Re: (ITS#4966) OpenLDAP 2.3.35 crashes on valsort overlay
by ando＠sys-net.it 18 May '07

18 May '07

digant(a)stanford.edu wrote: > When modding an entry, valsort seems to have crashed the server. I've uploaded > the stack trace and informaiton I was able to gather out of the core dump. In your upload: > #0 valsort_modify (op=0x2aabaeac0058, rs=0x417fef10) at valsort.c:455 > 455 for (i=0; !BER_BVISNULL( &ml->sml_values[i] ); i++) { can you detail what operation caused this? Can you print: ml, i, ml->sml_mod.sm_values, ml->sml_mod.sm_values[i] ? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4959) replica seg faults if syncrepl searchbase =""
by ando＠sys-net.it 18 May '07

18 May '07

ali.pouya(a)free.fr wrote: > The HEAD misses the definition of 'oids' 'oid_name', etc. So I get the following > error at build time : You probably caught HEAD in some inconsistent state during the addition of GNUTLS support; it's working just fine for me. Can you retry? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4961) If database suffix is ""
by ando＠sys-net.it 18 May '07

18 May '07

ali.pouya(a)free.fr wrote: > Unfortunately the problem has not been completely fixed in the HEAD. > With the fix in the head the error message disappears but the contextCSN ins NOT > ACTUALLY written to the disk. So at the next slapd startup the ContextCSN is > missing. An the servers hav to resynchronize. > > Below you find the log extract. Makes sense: the empty entry "" is not persistent... p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4971) patch for OpenLDAP 2-3-32
by ando＠sys-net.it 18 May '07

18 May '07

jemeterisan(a)mail.ru wrote: > I had noticed, that the patch, used for 'schema-map.c' doesn't work > correct. I hope, You also had checked it up. So what had I found in > the function 'backsql_ad2at': > The attribute name is stored in 'struct berval' structure, so if > You change '.bv_val' from 'userCertificate;binary' to > 'userCertificate', You should change '.bv_len' in accordance to > strlen(aaa.bv_val) without strlen(";binary"). I assume you refer to a patch that was submitted along with ITS#4868; that patch is absolutely incorrect and in fact it has been rejected. A consistent fix has been applied to hEAD code. It has never been backported to OpenLDAP 2.3 because nobody fed back about it. If you wish to test HEAD code and report success, I'll be happy to backport it to OpenLDAP 2.3 so that it gets released with the next release. > And by the way I want to store 'userCertificate' attribute type in PostrgreSQL. > > What type of the field in the table should I use? Any blob-like format would be fine (although I haven't tested it with PostgreSQL yet). > Just another question to the developers: > I've heared that OpenLDAP is sensible to DOS attacks, so, how can I avoid this > trouble? And I want to know more about this problem, if possible. Please direct software use related questions to the openldap-software mailing list. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#4972) thr_debug problems
by h.b.furuseth＠usit.uio.no 18 May '07

18 May '07

Full_Name: Hallvard B Furuseth Version: HEAD, RE23 OS: URL: Submission from: (NULL) (129.240.202.105) Submitted by: hallvard $LDAP_THREAD_DEBUG parsing is bogus, code in the inner loop should be outside it. Detached threads can validly exit after ldap_debug_thread_destroy() (fixed in HEAD). Valgrind carries the 'uninialized' state out of debug_already_initialized(). RE23/thr_debug.c has some other problems that are fixed in HEAD, but take a bit more work to fix and test. I'll align it with HEAD if anyone is interested.

1 0

Re: (ITS#4961) If database suffix is ""
by ali.pouya＠free.fr 18 May '07

18 May '07

Unfortunately the problem has not been completely fixed in the HEAD. With the fix in the head the error message disappears but the contextCSN ins NOT ACTUALLY written to the disk. So at the next slapd startup the ContextCSN is missing. An the servers hav to resynchronize. Below you find the log extract. Thanks Best regards Ali ============================ Log extract : daemon: shutdown requested and initiated. daemon: closing 7 connection_closing: readying conn=0 sd=11 for close connection_close: conn=0 sd=11 daemon: removing 11 conn=0 fd=11 closed (slapd shutdown) =>do_syncrepl rid=123 connection_get(12) connection_get(12): got connid=0 daemon: removing 12r slapd shutdown: waiting for 1 threads to terminate ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 12 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed slapd shutdown: initiated bdb_modify: bdb_dn2entry("") bdb_modify_internal: 0x00000000: <= acl_access_allowed: granted to database root bdb_modify_internal: replace contextCSN is_entry_objectclass("", "2.5.17.0") no objectClass attribute => entry_encode(0x00000000): bdb_modify: updated id=00000000 dn="" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" ====> bdb_cache_release_all slapd destroy: freeing system resources. slapd stopped.

1 0

Re: (ITS#4965) slapd stops if access to cn=monitor is restricted
by ali.pouya＠free.fr 18 May '07

18 May '07

Hi Pierangelo; The HEAD misses some new definitions (see followup 5 in ITS 4959) so I reproduced the problem with OPENLDAP_REL_ENG_2_4. I feel that the problem has not been fixed in this release. Thanks and best regards Ali

1 0

Re: (ITS#4959) replica seg faults if syncrepl searchbase =""
by ali.pouya＠free.fr 18 May '07

18 May '07

Hi Pierangelo; The HEAD misses some new definitions (see below) so I reproduced the problem with OPENLDAP_REL_ENG_2_4. The backtrace is the same as before : #0 0x00179d5a in strcmp () from /lib/tls/libc.so.6 #1 0x08068ede in select_backend (dn=0xb78bef5c, manageDSAit=0, noSubs=0) at backend.c:684 #2 0x0806a8ac in fe_aux_operational (op=0xb78bef40, rs=0xb78bee80) at backend.c:1779 #3 0x0806a01b in backend_operational (op=0xb78bef40, rs=0xb78bee80) at backend.c:1801 #4 0x080a7d06 in do_syncrepl (ctx=0xb78bf2a0, arg=0x88ab2e0) at syncrepl.c:547 #5 0x081281c3 in ldap_int_thread_pool_wrapper (xpool=0x886fd78) at tpool.c:704 #6 0x00907371 in start_thread () from /lib/tls/libpthread.so.0 #7 0x001d8ffe in clone () from /lib/tls/libc.so.6 =============== N.B. The HEAD misses the definition of 'oids' 'oid_name', etc. So I get the following error at build time : tls.c:2908: error: syntax error before '*' token tls.c: In function `find_oid': tls.c:2913: error: `oids' undeclared (first use in this function) tls.c:2913: error: (Each undeclared identifier is reported only once tls.c:2913: error: for each function it appears in.) tls.c: In function `ldap_X509dn2bv': tls.c:2946: error: `oid_name' undeclared (first use in this function) tls.c:2946: error: `oidname' undeclared (first use in this function) make[2]: *** [tls.lo] Erreur 1 make[2]: Leaving directory `/var/ali/openldap-2.4/head-170507/libraries/libldap' make[1]: *** [all-common] Erreur 1 make[1]: Leaving directory `/var/ali/openldap-2.4/head-170507/libraries' make: *** [all-common] Erreur 1 Thanks Best Regards Ali

1 0

(ITS#4971) patch for OpenLDAP 2-3-32
by jemeterisan＠mail.ru 18 May '07

18 May '07

Full_Name: Petrov Dmitry Version: 2-3-32 OS: Red Hat 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.195.208.66) Hi, guys! I had noticed, that the patch, used for 'schema-map.c' doesn't work correct. I hope, You also had checked it up. So what had I found in the function 'backsql_ad2at': The attribute name is stored in 'struct berval' structure, so if You change '.bv_val' from 'userCertificate;binary' to 'userCertificate', You should change '.bv_len' in accordance to strlen(aaa.bv_val) without strlen(";binary"). And by the way I want to store 'userCertificate' attribute type in PostrgreSQL. What type of the field in the table should I use? Just another question to the developers: I've heared that OpenLDAP is sensible to DOS attacks, so, how can I avoid this trouble? And I want to know more about this problem, if possible. With best wishes, Dmitry...

1 0

(ITS#4970) Problem between pwdReset and pwdMinAge
by py.bonnetain＠ba-consultants.fr 17 May '07

17 May '07

Full_Name: Pierre-Yves Bonnetain Version: 2.3.35 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.41.162.162) There is something "forgotten" in ppolicy overlay code. When pwdReset is set to TRUE, the user is properly asked to change his password. BUT if the (admin-made) previous password change is newer than pwdMinAge, the requested password change will be rejected with a "password too young" message : ----------- $ ssh somehost -l someuser Password: You are required to change your LDAP password immediately. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation Password is too young to change ----------- The pwdMinAge parameter should be ignored when pwdReset is set, otherwise the user will effectively be locked out of his account while waiting for the minimum delay to expire. Here is a patch to correct this behavior. Proposed patch may not adhere to coding standards and such, so feel free to enhance it as needed . *** ppolicy.old 2007-02-08 13:31:24.000000000 +0100 --- ppolicy.c 2007-05-17 17:10:39.000000000 +0200 *************** *** 1696,1710 **** time_t pwtime = (time_t)-1, now; int age; ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; } } --- 1696,1716 ---- time_t pwtime = (time_t)-1, now; int age; ! /* Py Bonnetain, B&A Consultants : We DON'T CARE for minAge if pwdReset ! is set. */ ! if ((pa = attr_find( e->e_attrs, ad_pwdReset )) == NULL || ! ! bvmatch( &pa->a_nvals[0], &slap_true_bv) ) { ! ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; ! } } }

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs