openldap-bugs

openldap-bugs@openldap.org

1 participants
21003 discussions

Re: (ITS#8485) [PATCH] Adding support for encrypted server private keys
by ahnolds＠gmail.com 28 Aug '17

28 Aug '17

--94eb2c0477b011a5720557daad8c Content-Type: text/plain; charset="UTF-8" I take it that this enhancement on the client side API isn't something you think would be useful. If that's the case, feel free to close this ticket, and best of luck with your ongoing development! On Wed, Feb 22, 2017 at 8:49 PM, Alec C <ahnolds(a)gmail.com> wrote: > I completely agree that this doesn't add any security when running slapd. > However, when I originally wrote this patch, I was more targeting API > usage, and in particular, client-side API usage. My goal was to allow a > user to present an encrypted key (stored on disk) and a password (only held > in memory), and use these to query a secure LDAP server. The issue of how > the password got into memory is certainly beyond the scope of OpenLDAP in > this case, but it certainly could be done securely in a way that wouldn't > leave it exposed to a third-party with file-system access. > > For example (in the use case that motivated me originally), an sysadmin > could input the password through an online form, submit said form to a > Python webserver over HTTPS, the Python code could pass the password to > OpenLDAP through a Python interface like python-ldap ( > https://www.python-ldap.org/), and then use the LDAPS or STARTTLS > connection to talk securely to some LDAP server elsewhere. All without an > unencrypted keyfile or a password ever existing on disk, hence the added > security. > > If you feel that supporting encrypted keyfiles in slapd is a bad design > choice, I'm willing to rework the patch to drop that part and only keep the > API-level support. Personally, I would argue that it doesn't hurt to > support the feature, although perhaps my documentation changes could do a > better job emphasizing the inherent security limitations. Let me know what > you think (or if this discussion should take place on a list, let me know > which/where). > > > On Wed, Feb 22, 2017 at 1:11 PM, Howard Chu <hyc(a)symas.com> wrote: > >> ahnolds(a)gmail.com wrote: >> >>> Full_Name: Alec Cooper >>> Version: HEAD of master branch >>> OS: Ubuntu Linux 16.04 >>> URL: ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch >>> Submission from: (NULL) (73.134.243.211) >>> >>> >>> Adding support for encrypted server private keys. >>> >> >> Thank you for your submission. I must compliment you on providing such a >> comprehensive and well-written contribution. Unfortunately the feature >> itself is clearly not useful. Perhaps you should have raised this topic on >> the openldap-devel list for discussion before spending your time writing it. >> >> All your feature does is embed the encryption key in the filesystem, so >> an encrypted private key is still no more secure than an unencrypted one. >> It still just depends on setting proper file access permissions, and the >> current documentation already makes that point. >> >> Indeed, all it does is give the false illusion of enhancing security, and >> followups like balmerpeak92(a)gmail.com's shows that people will easily >> fall for such illusions. >> >> I regret having to reject such a well written contribution, but we cannot >> in good conscience accept a security feature that doesn't actually improve >> security. >> >>> >>> The meat of this patch is changes to tls2.c, tls_g.c, tls_m.c, and >>> tls_o.c to >>> send a password to the underlying TLS library. >>> >>> Changes to ldap.h, init.c and ldap-int.h expose the new >>> LDAP_OPT_X_TLS_KEYPASSWORD in the main API. >>> >>> Changes in the contrib/ldapc++ directory expose the corresponding >>> TlsOptions::KEYPASSWORD option in the C++ API. >>> >>> Changes in the servers directory expose equivalent options for servers as >>> configuration file entries or environment variables. >>> >>> Changes in the doc directory add documentation about the new options and >>> remove >>> statements that indicated that encrypted keyfiles are not supported. >>> >>> New files in the test directory are for testing TLS connections, both in >>> general >>> and with encrypted keyfiles. Tests pass for OpenSSL and GnuTLS using PEM >>> formatted certs and keys, and for MozNSS using cert/key databases. The >>> new unit >>> test (test065-tls) has been written to detect when using NSS, and use the >>> cert/key databases in this case. I have been unable to get a working >>> version of >>> libnsspem, so I cannot test MozNSS with (or without) encrypted keyfiles - >>> testing for this case would be welcome! >>> >>> Notice of origin: The attached patch file is derived from OpenLDAP >>> Software. All >>> of the modifications to OpenLDAP Software represented in the following >>> patch >>> were developed by Alec Cooper ahnolds(a)gmail.com. I have not assigned >>> rights >>> and/or interest in this work to any party. >>> Rights statement: I, Alec Cooper, hereby place the following >>> modifications to >>> OpenLDAP Software (and only these modifications) into the public domain. >>> Hence, >>> these modifications may be freely used and/or redistributed for any >>> purpose with >>> or without attribution and/or other notice. >>> >>> The patch has been uploaded to the OpenLDAP FTP server and can be found >>> at >>> ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch >>> >>> >>> >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ >> > > --94eb2c0477b011a5720557daad8c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I take it that this enhancement on the client side API isn= 't something you think would be useful. If that's the case, feel fr= ee to close this ticket, and best of luck with your ongoing development!</d= iv><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Wed, Feb 22= , 2017 at 8:49 PM, Alec C <span dir=3D"ltr"><<a href=3D"mailto:ahnolds@g= mail.com" target=3D"_blank">ahnolds(a)gmail.com</a>></span> wrote:<br><blo= ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c= cc solid;padding-left:1ex"><div dir=3D"ltr">I completely agree that this do= esn't add any security when running slapd. However, when I originally w= rote this patch, I was more targeting API usage, and in particular, client-= side API usage. My goal was to allow a user to present an encrypted key (st= ored on disk) and a password (only held in memory), and use these to query = a secure LDAP server. The issue of how the password got into memory is cert= ainly beyond the scope of OpenLDAP in this case, but it certainly could be = done securely in a way that wouldn't leave it exposed to a third-party = with file-system access.<div><br></div><div>For example (in the use case th= at motivated me originally), an sysadmin could input the password through a= n online form, submit said form to a Python webserver over HTTPS, the Pytho= n code could pass the password to OpenLDAP through a Python interface like = python-ldap (<a href=3D"https://www.python-ldap.org/" target=3D"_blank">htt= ps://www.python-ldap.org/</a>)<wbr>, and then use the LDAPS or STARTTLS con= nection to talk securely to some LDAP server elsewhere. All without an unen= crypted keyfile or a password ever existing on disk, hence the added securi= ty.<div><br></div><div>If you feel that supporting encrypted keyfiles in sl= apd is a bad design choice, I'm willing to rework the patch to drop tha= t part and only keep the API-level support. Personally, I would argue that = it doesn't hurt to support the feature, although perhaps my documentati= on changes could do a better job emphasizing the inherent security limitati= ons. Let me know what you think (or if this discussion should take place on= a list, let me know which/where).=C2=A0</div></div><div><br></div></div><d= iv class=3D"HOEnZb"><div class=3D"h5"><div class=3D"gmail_extra"><br><div c= lass=3D"gmail_quote">On Wed, Feb 22, 2017 at 1:11 PM, Howard Chu <span dir= =3D"ltr"><<a href=3D"mailto:hyc@symas.com" target=3D"_blank">hyc(a)symas.c= om</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"marg= in:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><a href=3D"mailt= o:ahnolds@gmail.com" target=3D"_blank">ahnolds(a)gmail.com</a> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> Full_Name: Alec Cooper<br> Version: HEAD of master branch<br> OS: Ubuntu Linux 16.04<br> URL: <a href=3D"ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch" r= el=3D"noreferrer" target=3D"_blank">ftp://ftp.openldap.org/incomin<wbr>g/Al= ec-Cooper-160827.patch</a><br> Submission from: (NULL) (73.134.243.211)<br> <br> <br> Adding support for encrypted server private keys.<br> </blockquote> <br> Thank you for your submission. I must compliment you on providing such a co= mprehensive and well-written contribution. Unfortunately the feature itself= is clearly not useful. Perhaps you should have raised this topic on the op= enldap-devel list for discussion before spending your time writing it.<br> <br> All your feature does is embed the encryption key in the filesystem, so an = encrypted private key is still no more secure than an unencrypted one. It s= till just depends on setting proper file access permissions, and the curren= t documentation already makes that point.<br> <br> Indeed, all it does is give the false illusion of enhancing security, and f= ollowups like <a href=3D"mailto:balmerpeak92@gmail.com" target=3D"_blank">b= almerpeak92(a)gmail.com</a>'s shows that people will easily fall for such= illusions.<br> <br> I regret having to reject such a well written contribution, but we cannot i= n good conscience accept a security feature that doesn't actually impro= ve security.<br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> <br> The meat of this patch is changes to tls2.c, tls_g.c, tls_m.c, and tls_o.c = to<br> send a password to the underlying TLS library.<br> <br> Changes to ldap.h, init.c and ldap-int.h expose the new<br> LDAP_OPT_X_TLS_KEYPASSWORD in the main API.<br> <br> Changes in the contrib/ldapc++ directory expose the corresponding<br> TlsOptions::KEYPASSWORD option in the C++ API.<br> <br> Changes in the servers directory expose equivalent options for servers as<b= r> configuration file entries or environment variables.<br> <br> Changes in the doc directory add documentation about the new options and re= move<br> statements that indicated that encrypted keyfiles are not supported.<br> <br> New files in the test directory are for testing TLS connections, both in ge= neral<br> and with encrypted keyfiles. Tests pass for OpenSSL and GnuTLS using PEM<br= > formatted certs and keys, and for MozNSS using cert/key databases. The new = unit<br> test (test065-tls) has been written to detect when using NSS, and use the<b= r> cert/key databases in this case. I have been unable to get a working versio= n of<br> libnsspem, so I cannot test MozNSS with (or without) encrypted keyfiles -<b= r> testing for this case would be welcome!<br> <br> Notice of origin: The attached patch file is derived from OpenLDAP Software= . All<br> of the modifications to OpenLDAP Software represented in the following patc= h<br> were developed by Alec Cooper <a href=3D"mailto:ahnolds@gmail.com" target= =3D"_blank">ahnolds(a)gmail.com</a>. I have not assigned rights<br> and/or interest in this work to any party.<br> Rights statement: I, Alec Cooper, hereby place the following modifications = to<br> OpenLDAP Software (and only these modifications) into the public domain. He= nce,<br> these modifications may be freely used and/or redistributed for any purpose= with<br> or without attribution and/or other notice.<br> <br> The patch has been uploaded to the OpenLDAP FTP server and can be found at<= br> <a href=3D"ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch" rel=3D= "noreferrer" target=3D"_blank">ftp://ftp.openldap.org/incomin<wbr>g/Alec-Co= oper-160827.patch</a><br> <br> <br><span class=3D"m_-1938021547848690298HOEnZb"><font color=3D"#888888"> </font></span></blockquote><span class=3D"m_-1938021547848690298HOEnZb"><fo= nt color=3D"#888888"> <br> <br> -- <br> =C2=A0 -- Howard Chu<br> =C2=A0 CTO, Symas Corp.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"= http://www.symas.com" rel=3D"noreferrer" target=3D"_blank">http://www.symas= .com</a><br> =C2=A0 Director, Highland Sun=C2=A0 =C2=A0 =C2=A0<a href=3D"http://highland= sun.com/hyc/" rel=3D"noreferrer" target=3D"_blank">http://highlandsun.com/h= yc/</a><br> =C2=A0 Chief Architect, OpenLDAP=C2=A0 <a href=3D"http://www.openldap.org/p= roject/" rel=3D"noreferrer" target=3D"_blank">http://www.openldap.org/proje= c<wbr>t/</a><br> </font></span></blockquote></div><br></div> </div></div></blockquote></div><br></div> --94eb2c0477b011a5720557daad8c--

1 0

Re: (ITS#8701) account usability control for password less logins
by benjamin.chang＠oracle.com 28 Aug '17

28 Aug '17

This is a multi-part message in MIME format. --------------6CCE37E19DCAC5B8EF15AF2F Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Please disregard the previous workaround proposal, it was incorrect. The corrected workaround proposal: The idea is to determine the account/password state on the client side (since there's no easy way to get the server to provide the state without using the user's password). This was accomplished in a prototype by retrieving the /pwdPolicySubentry/, the policy setting, other operational attributes such as /pwdChangedTime/, /pwdAccountLockedTime/, /pwdFailureTime/, and /pwdGraceUseTime/. These were used to determine the account/password state. Is this reasonable and safe to do? On 08/02/2017 07:31 AM, Ben Chang wrote: > Question about a proposed workaround: > > Would it be possible to use slapo-ppolicy to set the pwdPolicySubentry > attribute for each user to provide the desired > 1.3.6.1.4.1.42.2.27.9.5.8 control response (see > http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control), > i.e., can pwdPolicySubentry be used supply the sub-entry and related > operational attributes needed to validate users for password-less logins? > --------------6CCE37E19DCAC5B8EF15AF2F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> <p>Please disregard the previous workaround proposal, it was incorrect. The corrected workaround proposal:</p> <p> The idea is to determine the account/password state on the client side (since there's no easy way to get the server to provide the state without using the user's password). This was accomplished in a prototype by retrieving the <i>pwdPolicySubentry</i>, the policy setting, other operational attributes such as <i>pwdChangedTime</i>, <i>pwdAccountLockedTime</i>, <i>pwdFailureTime</i>, and <i>pwdGraceUseTime</i>. These were used to determine the account/password state.</p> <p>Is this reasonable and safe to do? </p> <br> <div class="moz-cite-prefix">On 08/02/2017 07:31 AM, Ben Chang wrote:<br> </div> <blockquote type="cite" cite="mid:52bb394d-41f9-746e-28d9-200370b94fbe@oracle.com">Question about a proposed workaround: <br> <br> Would it be possible to use slapo-ppolicy to set the pwdPolicySubentry attribute for each user to provide the desired 1.3.6.1.4.1.42.2.27.9.5.8 control response (see <a class="moz-txt-link-freetext" href="http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control">http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control</a>), i.e., can pwdPolicySubentry be used supply the sub-entry and related operational attributes needed to validate users for password-less logins? <br> <br> </blockquote> <br> </body> </html> --------------6CCE37E19DCAC5B8EF15AF2F--

1 0

Re: (ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by hyc＠symas.com 27 Aug '17

27 Aug '17

Michael Str=C3=B6der wrote: > Howard Chu wrote: >> michael(a)stroeder.com wrote: >>> + /* write out the request to the extended process */ >>> + fprintf( fp, "EXTENDED\n" ); >>> + fprintf( fp, "msgid: %ld\n", (long) op->o_msgid ); >>> + sock_print_conn( fp, op->o_conn, si ); >>> + sock_print_suffixes( fp, op->o_bd ); >>> + fprintf( fp, "oid: %s\n", op->ore_reqoid.bv_val ); >>> + if (op->ore_reqdata) { >>> + fprintf( fp, "valuelen: %lu\n", op->ore_reqdata->bv_len ); >>> + fprintf( fp, "value: %s\n", op->ore_reqdata->bv_val ); >>> + } >>> + fprintf( fp, "\n" ); >> >> This isn't safe. The reqdata is binary, not a nul-terminated C string.= I suppose you >> could hex or base64-encode it instead. >=20 > Frankly I don't understand. >=20 > I considered using base64 but I wanted to stick to what's already done = in back-sock. >=20 > See openldap/servers/slapd/back-sock/bind.c for the password value whic= h is also an > arbitrary OctetString: >=20 > /* write out the request to the bind process */ > [..] > fprintf( fp, "credlen: %lu\n", op->oq_bind.rb_cred.bv_len ); > fprintf( fp, "cred: %s\n", op->oq_bind.rb_cred.bv_val ); /* XXX */ > fprintf( fp, "\n" ); >=20 > The above should also work with null-bytes, shoudn't it? No, it's a bug. Probably a benign bug because it's difficult for users to= =20 create passwords with embedded NULs. --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by michael＠stroeder.com 27 Aug '17

27 Aug '17

Howard Chu wrote: > michael(a)stroeder.com wrote: >> + /* write out the request to the extended process */ >> + fprintf( fp, "EXTENDED\n" ); >> + fprintf( fp, "msgid: %ld\n", (long) op->o_msgid ); >> + sock_print_conn( fp, op->o_conn, si ); >> + sock_print_suffixes( fp, op->o_bd ); >> + fprintf( fp, "oid: %s\n", op->ore_reqoid.bv_val ); >> + if (op->ore_reqdata) { >> + fprintf( fp, "valuelen: %lu\n", op->ore_reqdata->bv_len ); >> + fprintf( fp, "value: %s\n", op->ore_reqdata->bv_val ); >> + } >> + fprintf( fp, "\n" ); > > This isn't safe. The reqdata is binary, not a nul-terminated C string. I suppose you > could hex or base64-encode it instead. Frankly I don't understand. I considered using base64 but I wanted to stick to what's already done in back-sock. See openldap/servers/slapd/back-sock/bind.c for the password value which is also an arbitrary OctetString: /* write out the request to the bind process */ [..] fprintf( fp, "credlen: %lu\n", op->oq_bind.rb_cred.bv_len ); fprintf( fp, "cred: %s\n", op->oq_bind.rb_cred.bv_val ); /* XXX */ fprintf( fp, "\n" ); The above should also work with null-bytes, shoudn't it? Ciao, Michael.

1 0

RE: (ITS#8717) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by ipuleston＠SonicWALL.com 25 Aug '17

25 Aug '17

I have uploaded the patch to ftp.openldap.org/incoming as ian-puleston-1708= 25.patch, and included it below. The code that it adds is pretty much copied from ldap_free_connection: diff --git libraries/libldap/open.c libraries/libldap/open.c index 11564f9..251289d 100644 --- libraries/libldap/open.c +++ libraries/libldap/open.c @@ -450,6 +450,31 @@ ldap_int_open_connection( --conn->lconn_refcnt; =20 if (rc !=3D LDAP_SUCCESS) { + /* report the failure to the connection callbacks *= / + { + struct ldapoptions *lo; + ldaplist *ll; + ldap_conncb *cb; + + lo =3D &ld->ld_options; + LDAP_MUTEX_LOCK( &lo->ldo_mutex ); + if ( lo->ldo_conn_cbs ) { + for ( ll=3Dlo->ldo_conn_cbs; ll; ll= =3Dll->ll_next ) { + cb =3D ll->ll_data; + cb->lc_del( ld, conn->lconn= _sb, cb ); + } + } + LDAP_MUTEX_UNLOCK( &lo->ldo_mutex ); + lo =3D LDAP_INT_GLOBAL_OPT(); + LDAP_MUTEX_LOCK( &lo->ldo_mutex ); + if ( lo->ldo_conn_cbs ) { + for ( ll=3Dlo->ldo_conn_cbs; ll; ll= =3Dll->ll_next ) { + cb =3D ll->ll_data; + cb->lc_del( ld, conn->lconn= _sb, cb ); + } + } + LDAP_MUTEX_UNLOCK( &lo->ldo_mutex ); + } return -1; } }

1 0

RE: (ITS#8718) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by ipuleston＠SonicWALL.com 25 Aug '17

25 Aug '17

Sorry, I refreshed my browser after creating #8717 and it re-posted and cre= ated this one. Please close it as a duplicate of #8717. > -----Original Message----- > From: openldap-its(a)OpenLDAP.org [mailto:openldap-its@OpenLDAP.org] > Sent: Friday, August 25, 2017 1:30 PM > To: Ian Puleston > Subject: Re: (ITS#8718) Connection delete callback registreed with > LDAP_OPT_CONNECT_CB is not called on TLS failure >=20 >=20 > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** >=20 > Thanks for your report to the OpenLDAP Issue Tracking System. Your repor= t > has been assigned the tracking number ITS#8718. >=20 > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers are > volunteers. They only work on OpenLDAP when they have spare time. >=20 > If you need to provide additional information in regards to your issue > report, you may do so by replying to this message. Note that any mail se= nt > to openldap-its(a)openldap.org with (ITS#8718) in the subject will > automatically be attached to the issue report. >=20 > mailto:openldap-its@openldap.org?subject=3D(ITS#8718) >=20 > You may follow the progress of this report by loading the following URL i= n > a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=3D8718 >=20 > Please remember to retain your issue tracking number (ITS#8718) on any > further messages you send to us regarding this report. If you don't then > you'll just waste our time and yours because we won't be able to properly > track the report. >=20 > Please note that the Issue Tracking System is not intended to be used to > seek help in the proper use of OpenLDAP Software. > Such requests will be closed. >=20 > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ >=20 > -------------- > Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved.

1 0

(ITS#8718) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by ipuleston＠sonicwall.com 25 Aug '17

25 Aug '17

Full_Name: Ian Puleston Version: 2.4.40 OS: VxWorks URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (204.118.31.9) If connect and delete callbacks are registered via LDAP_OPT_CONNECT_CB, then the lc_add callback is called when the TCP connects, but if TLS then fails to connect the lc_del does not get called. If these callbacks are doing something like allocating/freeing resources this can lead to a resource leak. When I am seeing this, the sequence of calls leading to the lc_add callback is as follows: ldap_new_connection -> ldap_int_open_connection -> ldap_connect_to_host -> ldap_int_connect_cbs() Then if ldap_connect_to_host returned 0 for synchronous success this call happens: ldap_new_connection -> ldap_int_open_connection -> ldap_int_tls_start And if that fails and returns something other than LDAP_SUCCESS then ldap_int_open_connection exits. So we got a call to lc_add but no corresponding call to lc_del. And note that there is not call to ldap_free_connection, presumably because ldap-new-connection did not succeed, hence the lc_del callback does not get called from there. In my case when I see this it is on a referral with the above calls made from ldap_chase_v3referrals, hence it is happening synchronously. Whether the same would happen with an asynchronous connect I don't know. I do have a working fix which is to make the lc_del callbacks directly from ldap_int_open_connection if ldap_int_tls_start fails. I will supply a patch for that shortly.

1 0

Re: (ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by hyc＠symas.com 25 Aug '17

25 Aug '17

michael(a)stroeder.com wrote: > + /* write out the request to the extended process */ > + fprintf( fp, "EXTENDED\n" ); > + fprintf( fp, "msgid: %ld\n", (long) op->o_msgid ); > + sock_print_conn( fp, op->o_conn, si ); > + sock_print_suffixes( fp, op->o_bd ); > + fprintf( fp, "oid: %s\n", op->ore_reqoid.bv_val ); > + if (op->ore_reqdata) { > + fprintf( fp, "valuelen: %lu\n", op->ore_reqdata->bv_len ); > + fprintf( fp, "value: %s\n", op->ore_reqdata->bv_val ); > + } > + fprintf( fp, "\n" ); This isn't safe. The reqdata is binary, not a nul-terminated C string. I suppose you could hex or base64-encode it instead. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8637) OpenLDAP crashing when defining multiple olcDbURI for chaining
by okuznik＠symas.com 25 Aug '17

25 Aug '17

This configuration should have been rejected by back-config just like it is rejected by slapd.conf. Patch to have this happen is at: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170825-ITS8637.patch This doesn't reject online modifications just touching olcDBURI, but I think back ldap has no idea when it's configured as a slave to the chain overlay, so it can't do much. --=20 Ond=C5=99ej Kuzn=C3=ADk Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#8444) Out-of-sync issue with memberOf overlay, Delta-syncrepl MMR and >2 nodes
by okuznik＠symas.com 25 Aug '17

25 Aug '17

On Thu, Aug 24, 2017 at 03:55:32PM +0100, Ond=C5=99ej Kuzn=C3=ADk wrote: > I think it looks like this: syncproc_checkpoint modifies the suffix > entry, that calls slap_graduate_commit_csn and the csn is removed from > be_pending_csn_list. accesslog_response then can't find the CSN there > and has nothing to insert into its own pending csn list. Strange that > changing the overlay order (accesslog vs. syncprov) doesn't change this > behaviour, something I'd expect if the above is the reason this happens= . In any case, having the checkpoint modification get its own CSN entry lets the main operation CSN entry persist, which fixes this issue and all operations that need a CSN seem to get it. Patch is available at: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170825-ITS8444.patch --=20 Ond=C5=99ej Kuzn=C3=ADk Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs