openldap-bugs

openldap-bugs@openldap.org

1 participants
21065 discussions

Re: (ITS#8350) lmdb SIGBUS error on full partition and possible double free issue
by vladimir.cunat＠nic.cz 01 Sep '17

01 Sep '17

On 09/01/2017 02:38 PM, Howard Chu wrote: > vladimir.cunat(a)nic.cz wrote: >> The documentation of txn_commit did confuse me (as well). >> https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/lmdb.h#L994 >> >> Would you consider adding a line stressing that the txn gets released >> even in case any error is returned? (or something similar) I'm >> personally used to failing operations not "having externally observable >> effects" unless explicitly stated. > > The very first words on the line you highlight are "The transaction > handle is freed." I don't know how to state that any more explicitly. Well, okay. (I knew the line stated it and still it somehow didn't make me sure, but it's perhaps just me.)

1 0

Re: (ITS#8350) lmdb SIGBUS error on full partition and possible double free issue
by hyc＠symas.com 01 Sep '17

01 Sep '17

vladimir.cunat(a)nic.cz wrote: > Hello! > >> The docs say quite clearly, after txn_commit the txn must not be used > again. > > The documentation of txn_commit did confuse me (as well). > https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/lmdb.h#L994 > Would you consider adding a line stressing that the txn gets released > even in case any error is returned? (or something similar) I'm > personally used to failing operations not "having externally observable > effects" unless explicitly stated. The very first words on the line you highlight are "The transaction handle is freed." I don't know how to state that any more explicitly. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 01 Sep '17

01 Sep '17

Howard Chu wrote: > Yoshinori Nishino wrote: >> Dear Howard-san, >> >> >> Thanks to your advice, I could create the attached tentative patches. >=20 > Thanks, this looks much better. >> >> They modifies servers/slapd/passwd.c and configure.in >> so that running "./configure" can check whether or not crypt_r() exist= s >> and use the function in slapd_crypt() if possible. >> >> I am going to check whether or not "calloc()/free()" causes >> unacceptable=E3=80=80memory fragmentation. >=20 > Never use calloc/malloc/free directly in slapd code. Always use=20 > ch_calloc/ch_malloc/ch_free. >=20 > In this particular case, there's no reason to allocate at all. Just def= ine=20 > "struct crypt_data data" as a local variable. Also there's no reason to lock the passwd_mutex at all. That would comple= tely=20 defeat the purpose of using crypt_r() in the first place. >> >> >> Best Regards, >> ------------------------------------------------ >> On 2017/09/01 20:23, Yoshinori Nishino wrote: >>> >>> >>> On 2017/08/30 20:46, Yoshinori Nishino wrote: >>>> Dear Howard-san, >>>> >>>> >>>> Thank you so much for your prompt advice. >>>> >>>> As you told, I need to check whether or not crypt_r() exists. >>>> I am going to consider including the check. >>>> >>>> Would it be possible to let me know whether there are any other >>>> concerns about the fix if we can use crypt_r()? >>>> >>>> The implementation that "both calloc() and free() occur every time >>>> slapd_crypt() is called" does not seem to look good. >>>> The callers of slapd_crypt() might be able to get the memory for >>>> "struct crypt_data" before they call it. >>>> However, I think it causes the changes of other source codes. >>>> So, I think the aforementioned implementation is a workaround for th= e >>>> slowdown if the risk of memory fragmentation can be acceptable. >>>> >>>> On the other hands, I think we do not need to care about strcmp() >>>> because it is thread-safe. >>>> >>>> >>>> Best Regards, >>>> ---------------------------------------- >>>> On 2017/08/30 19:26, Howard Chu wrote: >>>>> yos-nishino(a)ys.jp.nec.com wrote: >>>>>> Full_Name: Yoshinori Nishino >>>>>> Version: 2.4.45 >>>>>> OS: CentOS 7 >>>>>> URL: ftp://ftp.openldap.org/incoming/ >>>>>> Submission from: (NULL) (210.143.35.20) >>>>>> >>>>>> >>>>>> Dear sir, >>>>>> >>>>>> The function slapd_crypt() in servers/slapd/passwd.c seems to beco= me >>>>>> slow when >>>>>> many ldap client connections occur. >>>>>> It seems it is because the function uses crypt()(non thread-safe >>>>>> function) and >>>>>> pthread_mutex_lock(), which results in the slowdown. >>>>>> #Besides, we need to use {CRYPT} hash as users' password hash. >>>>>> >>>>>> So, I modified servers/slapd/passwd.c like the following. >>>>>> As a result, slapd_crypt() becomes much faster under the same >>>>>> condition. >>>>>> Would you let me know whether or not the fix is appropriate for sl= apd? >>>>> >>>>> No it is not an appropriate fix. >>>>> >>>>> You should add an autoconf test to check for the existence of the >>>>> crypt_r function, and use an #ifdef here based on the result of tha= t >>>>> test, since crypt_r is a non-standard function. >>>>>> >> >> >=20 >=20 --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 01 Sep '17

01 Sep '17

Yoshinori Nishino wrote: > Dear Howard-san, >=20 >=20 > Thanks to your advice, I could create the attached tentative patches. Thanks, this looks much better. >=20 > They modifies servers/slapd/passwd.c and configure.in > so that running "./configure" can check whether or not crypt_r() exists > and use the function in slapd_crypt() if possible. >=20 > I am going to check whether or not "calloc()/free()" causes > unacceptable=E3=80=80memory fragmentation. Never use calloc/malloc/free directly in slapd code. Always use=20 ch_calloc/ch_malloc/ch_free. In this particular case, there's no reason to allocate at all. Just defin= e=20 "struct crypt_data data" as a local variable. >=20 >=20 > Best Regards, > ------------------------------------------------ > On 2017/09/01 20:23, Yoshinori Nishino wrote: >> >> >> On 2017/08/30 20:46, Yoshinori Nishino wrote: >>> Dear Howard-san, >>> >>> >>> Thank you so much for your prompt advice. >>> >>> As you told, I need to check whether or not crypt_r() exists. >>> I am going to consider including the check. >>> >>> Would it be possible to let me know whether there are any other >>> concerns about the fix if we can use crypt_r()? >>> >>> The implementation that "both calloc() and free() occur every time >>> slapd_crypt() is called" does not seem to look good. >>> The callers of slapd_crypt() might be able to get the memory for >>> "struct crypt_data" before they call it. >>> However, I think it causes the changes of other source codes. >>> So, I think the aforementioned implementation is a workaround for the >>> slowdown if the risk of memory fragmentation can be acceptable. >>> >>> On the other hands, I think we do not need to care about strcmp() >>> because it is thread-safe. >>> >>> >>> Best Regards, >>> ---------------------------------------- >>> On 2017/08/30 19:26, Howard Chu wrote: >>>> yos-nishino(a)ys.jp.nec.com wrote: >>>>> Full_Name: Yoshinori Nishino >>>>> Version: 2.4.45 >>>>> OS: CentOS 7 >>>>> URL: ftp://ftp.openldap.org/incoming/ >>>>> Submission from: (NULL) (210.143.35.20) >>>>> >>>>> >>>>> Dear sir, >>>>> >>>>> The function slapd_crypt() in servers/slapd/passwd.c seems to becom= e >>>>> slow when >>>>> many ldap client connections occur. >>>>> It seems it is because the function uses crypt()(non thread-safe >>>>> function) and >>>>> pthread_mutex_lock(), which results in the slowdown. >>>>> #Besides, we need to use {CRYPT} hash as users' password hash. >>>>> >>>>> So, I modified servers/slapd/passwd.c like the following. >>>>> As a result, slapd_crypt() becomes much faster under the same >>>>> condition. >>>>> Would you let me know whether or not the fix is appropriate for sla= pd? >>>> >>>> No it is not an appropriate fix. >>>> >>>> You should add an autoconf test to check for the existence of the >>>> crypt_r function, and use an #ifdef here based on the result of that >>>> test, since crypt_r is a non-standard function. >>>>> >=20 >=20 --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8350) lmdb SIGBUS error on full partition and possible double free issue
by vladimir.cunat＠nic.cz 01 Sep '17

01 Sep '17

Hello! > The docs say quite clearly, after txn_commit the txn must not be used again. The documentation of txn_commit did confuse me (as well). https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/lmdb.h#L994 Would you consider adding a line stressing that the txn gets released even in case any error is returned? (or something similar) I'm personally used to failing operations not "having externally observable effects" unless explicitly stated. Thanks. --Vladimir

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 01 Sep '17

01 Sep '17

--_003_ae98b5ab2c831747beb16297218b350eysjpneccom_ Content-Type: text/plain; charset="utf-8" Content-ID: <514C194789057D4F9AD83D779D27265A(a)gisp.nec.co.jp> Content-Transfer-Encoding: base64 RGVhciBIb3dhcmQtc2FuLA0KDQoNClRoYW5rcyB0byB5b3VyIGFkdmljZSwgSSBjb3VsZCBjcmVh dGUgdGhlIGF0dGFjaGVkIHRlbnRhdGl2ZSBwYXRjaGVzLg0KDQpUaGV5IG1vZGlmaWVzIHNlcnZl cnMvc2xhcGQvcGFzc3dkLmMgYW5kIGNvbmZpZ3VyZS5pbg0Kc28gdGhhdCBydW5uaW5nICIuL2Nv bmZpZ3VyZSIgY2FuIGNoZWNrIHdoZXRoZXIgb3Igbm90IGNyeXB0X3IoKSBleGlzdHMNCmFuZCB1 c2UgdGhlIGZ1bmN0aW9uIGluIHNsYXBkX2NyeXB0KCkgaWYgcG9zc2libGUuDQoNCkkgYW0gZ29p bmcgdG8gY2hlY2sgd2hldGhlciBvciBub3QgImNhbGxvYygpL2ZyZWUoKSIgY2F1c2VzIA0KdW5h Y2NlcHRhYmxl44CAbWVtb3J5IGZyYWdtZW50YXRpb24uDQoNCg0KQmVzdCBSZWdhcmRzLA0KLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpPbiAyMDE3LzA5 LzAxIDIwOjIzLCBZb3NoaW5vcmkgTmlzaGlubyB3cm90ZToNCj4gDQo+IA0KPiBPbiAyMDE3LzA4 LzMwIDIwOjQ2LCBZb3NoaW5vcmkgTmlzaGlubyB3cm90ZToNCj4+IERlYXIgSG93YXJkLXNhbiwN Cj4+DQo+Pg0KPj4gVGhhbmsgeW91IHNvIG11Y2ggZm9yIHlvdXIgcHJvbXB0IGFkdmljZS4NCj4+ DQo+PiBBcyB5b3UgdG9sZCwgSSBuZWVkIHRvIGNoZWNrIHdoZXRoZXIgb3Igbm90IGNyeXB0X3Io KSBleGlzdHMuDQo+PiBJIGFtIGdvaW5nIHRvIGNvbnNpZGVyIGluY2x1ZGluZyB0aGUgY2hlY2su DQo+Pg0KPj4gV291bGQgaXQgYmUgcG9zc2libGUgdG8gbGV0IG1lIGtub3cgd2hldGhlciB0aGVy ZSBhcmUgYW55IG90aGVyIA0KPj4gY29uY2VybnMgYWJvdXQgdGhlIGZpeCBpZiB3ZSBjYW4gdXNl IGNyeXB0X3IoKT8NCj4+DQo+PiBUaGUgaW1wbGVtZW50YXRpb24gdGhhdCAiYm90aCBjYWxsb2Mo KSBhbmQgZnJlZSgpIG9jY3VyIGV2ZXJ5IHRpbWUgDQo+PiBzbGFwZF9jcnlwdCgpIGlzIGNhbGxl ZCIgZG9lcyBub3Qgc2VlbSB0byBsb29rIGdvb2QuDQo+PiBUaGUgY2FsbGVycyBvZiBzbGFwZF9j cnlwdCgpIG1pZ2h0IGJlIGFibGUgdG8gZ2V0IHRoZSBtZW1vcnkgZm9yIA0KPj4gInN0cnVjdCBj cnlwdF9kYXRhIiBiZWZvcmUgdGhleSBjYWxsIGl0Lg0KPj4gSG93ZXZlciwgSSB0aGluayBpdCBj YXVzZXMgdGhlIGNoYW5nZXMgb2Ygb3RoZXIgc291cmNlIGNvZGVzLg0KPj4gU28sIEkgdGhpbmsg dGhlIGFmb3JlbWVudGlvbmVkIGltcGxlbWVudGF0aW9uIGlzIGEgd29ya2Fyb3VuZCBmb3IgdGhl IA0KPj4gc2xvd2Rvd24gaWYgdGhlIHJpc2sgb2YgbWVtb3J5IGZyYWdtZW50YXRpb24gY2FuIGJl IGFjY2VwdGFibGUuDQo+Pg0KPj4gT24gdGhlIG90aGVyIGhhbmRzLCBJIHRoaW5rIHdlIGRvIG5v dCBuZWVkIHRvIGNhcmUgYWJvdXQgc3RyY21wKCkgDQo+PiBiZWNhdXNlIGl0IGlzIHRocmVhZC1z YWZlLg0KPj4NCj4+DQo+PiBCZXN0IFJlZ2FyZHMsDQo+PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tDQo+PiBPbiAyMDE3LzA4LzMwIDE5OjI2LCBIb3dhcmQgQ2h1IHdy b3RlOg0KPj4+IHlvcy1uaXNoaW5vQHlzLmpwLm5lYy5jb20gd3JvdGU6DQo+Pj4+IEZ1bGxfTmFt ZTogWW9zaGlub3JpIE5pc2hpbm8NCj4+Pj4gVmVyc2lvbjogMi40LjQ1DQo+Pj4+IE9TOiBDZW50 T1MgNw0KPj4+PiBVUkw6IGZ0cDovL2Z0cC5vcGVubGRhcC5vcmcvaW5jb21pbmcvDQo+Pj4+IFN1 Ym1pc3Npb24gZnJvbTogKE5VTEwpICgyMTAuMTQzLjM1LjIwKQ0KPj4+Pg0KPj4+Pg0KPj4+PiBE ZWFyIHNpciwNCj4+Pj4NCj4+Pj4gVGhlIGZ1bmN0aW9uIHNsYXBkX2NyeXB0KCkgaW4gc2VydmVy cy9zbGFwZC9wYXNzd2QuYyBzZWVtcyB0byBiZWNvbWUgDQo+Pj4+IHNsb3cgd2hlbg0KPj4+PiBt YW55IGxkYXAgY2xpZW50IGNvbm5lY3Rpb25zIG9jY3VyLg0KPj4+PiBJdCBzZWVtcyBpdCBpcyBi ZWNhdXNlIHRoZSBmdW5jdGlvbiB1c2VzIGNyeXB0KCkobm9uIHRocmVhZC1zYWZlIA0KPj4+PiBm dW5jdGlvbikgYW5kDQo+Pj4+IHB0aHJlYWRfbXV0ZXhfbG9jaygpLCB3aGljaCByZXN1bHRzIGlu IHRoZSBzbG93ZG93bi4NCj4+Pj4gI0Jlc2lkZXMsIHdlIG5lZWQgdG8gdXNlIHtDUllQVH0gaGFz aCBhcyB1c2VycycgcGFzc3dvcmQgaGFzaC4NCj4+Pj4NCj4+Pj4gU28sIEkgbW9kaWZpZWQgc2Vy dmVycy9zbGFwZC9wYXNzd2QuYyBsaWtlIHRoZSBmb2xsb3dpbmcuDQo+Pj4+IEFzIGEgcmVzdWx0 LCBzbGFwZF9jcnlwdCgpIGJlY29tZXMgbXVjaCBmYXN0ZXIgdW5kZXIgdGhlIHNhbWUgDQo+Pj4+ IGNvbmRpdGlvbi4NCj4+Pj4gV291bGQgeW91IGxldCBtZSBrbm93IHdoZXRoZXIgb3Igbm90IHRo ZSBmaXggaXMgYXBwcm9wcmlhdGUgZm9yIHNsYXBkPw0KPj4+DQo+Pj4gTm8gaXQgaXMgbm90IGFu IGFwcHJvcHJpYXRlIGZpeC4NCj4+Pg0KPj4+IFlvdSBzaG91bGQgYWRkIGFuIGF1dG9jb25mIHRl c3QgdG8gY2hlY2sgZm9yIHRoZSBleGlzdGVuY2Ugb2YgdGhlIA0KPj4+IGNyeXB0X3IgZnVuY3Rp b24sIGFuZCB1c2UgYW4gI2lmZGVmIGhlcmUgYmFzZWQgb24gdGhlIHJlc3VsdCBvZiB0aGF0IA0K Pj4+IHRlc3QsIHNpbmNlIGNyeXB0X3IgaXMgYSBub24tc3RhbmRhcmQgZnVuY3Rpb24uDQo+Pj4+ DQoNCg0KLS0gDQoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioNCllvc2hpbm9yaSBOaXNoaW5vDQoNCk5FQyBTb2x1dGlvbiBJbm5vdmF0b3JzLCBMdGQuDQox LTE4LTcgU2hpbmtpYmEsIEtvdG8ta3UsIFRva3lvLCAxMzYtODYyNyBKYXBhbg0KRS1NQUlMOiB5 b3MtbmlzaGlub0B5cy5qcC5uZWMuY29tDQoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioNCg== --_003_ae98b5ab2c831747beb16297218b350eysjpneccom_ Content-Type: text/plain; name="openldap-slapd_crypt.patch" Content-Description: openldap-slapd_crypt.patch Content-Disposition: attachment; filename="openldap-slapd_crypt.patch"; size=1542; creation-date="Fri, 01 Sep 2017 11:42:36 GMT"; modification-date="Fri, 01 Sep 2017 11:42:36 GMT" Content-ID: <529021D243717746A9BA512F0ED0DA1A(a)gisp.nec.co.jp> Content-Transfer-Encoding: base64 bW9kaWZ5IHBhc3N3ZC5jIHNvIHRoYXQgc2xhcGRfY3J5cHQoKSB1c2VzIGNyeXB0X3IoKS4KCmRp ZmYgLS1naXQgYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3ZC5jIGIvc2VydmVycy9zbGFwZC9wYXNzd2Qu YwppbmRleCBkZmEzNzBjLi45YTUyM2VlIDEwMDY0NAotLS0gYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3 ZC5jCisrKyBiL3NlcnZlcnMvc2xhcGQvcGFzc3dkLmMKQEAgLTIzLDggKzIzLDExIEBACiAjaW5j bHVkZSA8YWMvdW5pc3RkLmg+CiAKICNpZmRlZiBTTEFQRF9DUllQVAorI2lmZGVmIEhBVkVfQ1JZ UFRfUgorI2RlZmluZSBfX1VTRV9HTlUKKyNlbmRpZiAvKiBIQVZFX0NSWVBUX1IgKi8KICNpbmNs dWRlIDxhYy9jcnlwdC5oPgotI2VuZGlmCisjZW5kaWYgLyogU0xBUERfQ1JZUFQgKi8KIAogI2lu Y2x1ZGUgInNsYXAuaCIKIApAQCAtNTkwLDYgKzU5MywzNCBAQCBzbGFwX3Bhc3N3ZF9oYXNoKAog c3RhdGljIGxkYXBfcHZ0X3RocmVhZF9tdXRleF90IHBhc3N3ZF9tdXRleDsKIHN0YXRpYyBsdXRp bF9jcnlwdGZ1bmMgc2xhcGRfY3J5cHQ7CiAKKyNpZmRlZiBIQVZFX0NSWVBUX1IKK3N0YXRpYyBp bnQgc2xhcGRfY3J5cHQoIGNvbnN0IGNoYXIgKmtleSwgY29uc3QgY2hhciAqc2FsdCwgY2hhciAq Kmhhc2ggKQoreworCWNoYXIgKmNyOworCWludCByYzsKKwlzdHJ1Y3QgY3J5cHRfZGF0YSAqZGF0 YTsKKworCWRhdGEgPSAoc3RydWN0IGNyeXB0X2RhdGEgKiljYWxsb2MoMSwgc2l6ZW9mKHN0cnVj dCBjcnlwdF9kYXRhKSk7CisKKwljciA9IGNyeXB0X3IoIGtleSwgc2FsdCwgZGF0YSApOworCWlm ICggY3IgPT0gTlVMTCB8fCBjclswXSA9PSAnXDAnICkgeworCQkvKiBzYWx0IG11c3QgaGF2ZSBi ZWVuIGludmFsaWQgKi8KKwkJcmMgPSBMVVRJTF9QQVNTV0RfRVJSOworCX0gZWxzZSB7CisJCWlm ICggaGFzaCApIHsKKwkJCWxkYXBfcHZ0X3RocmVhZF9tdXRleF9sb2NrKCAmcGFzc3dkX211dGV4 ICk7CisJCQkqaGFzaCA9IGJlcl9zdHJkdXAoIGNyICk7CisJCQlsZGFwX3B2dF90aHJlYWRfbXV0 ZXhfdW5sb2NrKCAmcGFzc3dkX211dGV4ICk7CisJCQlyYyA9IExVVElMX1BBU1NXRF9PSzsKKwkJ fSBlbHNlIHsKKwkJCXJjID0gc3RyY21wKCBzYWx0LCBjciApID8gTFVUSUxfUEFTU1dEX0VSUiA6 IExVVElMX1BBU1NXRF9PSzsKKwkJfQorCX0KKyAKKyAgICBmcmVlKGRhdGEpOworICAgIHJldHVy biByYzsKK30KKyNlbHNlCiBzdGF0aWMgaW50IHNsYXBkX2NyeXB0KCBjb25zdCBjaGFyICprZXks IGNvbnN0IGNoYXIgKnNhbHQsIGNoYXIgKipoYXNoICkKIHsKIAljaGFyICpjcjsKQEAgLTYxNCw2 ICs2NDUsOCBAQCBzdGF0aWMgaW50IHNsYXBkX2NyeXB0KCBjb25zdCBjaGFyICprZXksIGNvbnN0 IGNoYXIgKnNhbHQsIGNoYXIgKipoYXNoICkKIAlsZGFwX3B2dF90aHJlYWRfbXV0ZXhfdW5sb2Nr KCAmcGFzc3dkX211dGV4ICk7CiAJcmV0dXJuIHJjOwogfQorI2VuZGlmIC8qIEhBVkVfQ1JZUFRf UiAqLworCiAjZW5kaWYgLyogU0xBUERfQ1JZUFQgKi8KIAogdm9pZCBzbGFwX3Bhc3N3ZF9pbml0 KCkK --_003_ae98b5ab2c831747beb16297218b350eysjpneccom_ Content-Type: text/plain; name="openldap-slapd_crypt-configure.patch" Content-Description: openldap-slapd_crypt-configure.patch Content-Disposition: attachment; filename="openldap-slapd_crypt-configure.patch"; size=756; creation-date="Fri, 01 Sep 2017 11:42:36 GMT"; modification-date="Fri, 01 Sep 2017 11:42:36 GMT" Content-ID: <4C143CD72661D741AAEA56FC06DE3DE1(a)gisp.nec.co.jp> Content-Transfer-Encoding: base64 bW9kaWZ5IGNvbmZpZ3VyZS5pbiBzbyB0aGF0IHNsYXBkX2NyeXB0KCkgdXNlcyBjcnlwdF9yKCku CgoKZGlmZiAtLWdpdCBhL2NvbmZpZ3VyZS5pbiBiL2NvbmZpZ3VyZS5pbgppbmRleCAzYzE4MTU0 Li5iZDc1M2U1IDEwMDY0NAotLS0gYS9jb25maWd1cmUuaW4KKysrIGIvY29uZmlndXJlLmluCkBA IC0yMTk3LDEwICsyMTk3LDE2IEBAIGlmIHRlc3QgJG9sX2VuYWJsZV9jcnlwdCAhPSBubyA7IHRo ZW4KIAkJQUNfQ0hFQ0tfTElCKGNyeXB0LCBjcnlwdCwgW0xVVElMX0xJQlM9IiRMVVRJTF9MSUJT IC1sY3J5cHQiCiAJCQloYXZlX2NyeXB0PXllc10sIFtoYXZlX2NyeXB0PW5vXSldKQogCisJTElC Uz0iJFRMU19MSUJTICRMSUJTIgorCUFDX0NIRUNLX0xJQihjcnlwdCwgY3J5cHRfciwgW2hhdmVf Y3J5cHRfcj15ZXNdLCBbaGF2ZV9jcnlwdF9yPW5vXSkKKwogCUxJQlM9IiRzYXZlX0xJQlMiCiAK IAlpZiB0ZXN0ICRoYXZlX2NyeXB0ID0geWVzIDsgdGhlbgogCQlBQ19ERUZJTkUoSEFWRV9DUllQ VCwxLCBbZGVmaW5lIGlmIGNyeXB0KDMpIGlzIGF2YWlsYWJsZV0pCisJCWlmIHRlc3QgJGhhdmVf Y3J5cHRfciA9IHllcyA7IHRoZW4KKwkJCUFDX0RFRklORShIQVZFX0NSWVBUX1IsIDEsIFtkZWZp bmUgaWYgY3J5cHRfcigpIGlzIGFsc28gYXZhaWxhYmxlXSkKKwkJZmkKIAllbHNlCiAJCUFDX01T R19XQVJOKFtjb3VsZCBub3QgZmluZCBjcnlwdF0pCiAJCWlmIHRlc3QgJG9sX2VuYWJsZV9jcnlw dCA9IHllcyA7IHRoZW4K --_003_ae98b5ab2c831747beb16297218b350eysjpneccom_--

1 0

Re: (ITS#8720) back_ldap result timeout failure on high latency connections (TLS ONLY)
by hyc＠symas.com 31 Aug '17

31 Aug '17

mikedotjackson(a)gmail.com wrote: > Full_Name: Mike Jackson > Version: 2.4.45 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (194.157.185.162) > > > Push replication via TLS fails to remote servers where the TCP/IP round-trip > time is greater than 100ms. When the return packets finally arrive, the > initiating server will close the connection with RST RST RST, which results in > TLS NEGOTIATION FAILURE. If TLS is not used, then the high-latency connection > will function normally and replication will occur. > > The 100ms time limit comes from here: > > servers/slapd/back-ldap/back-ldap.h: #define LDAP_BACK_RESULT_UTIMEOUT > (100000) > > Reference commit 112be0118e43c161d44de6e852cca9f517bb653d from 2005. > > HYC: "Ando ported timeout code from back-meta into back-ldap but he never ported > the config keyword that sets the timeout number of retries" > > In addition, the back_ldap man page is not up to date. > > > My temporary workaround was to set LDAP_BACK_RESULT_UTIMEOUT (900000) (900ms) > and recompile. Problem immediately went away, but this is not a correct approach > and the retry counter should be runtime configurable. back-ldap has been fixed to use the configured timeout for exops here. Fix is in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8720) back_ldap result timeout failure on high latency connections (TLS ONLY)
by mikedotjackson＠gmail.com 31 Aug '17

31 Aug '17

Full_Name: Mike Jackson Version: 2.4.45 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.157.185.162) Push replication via TLS fails to remote servers where the TCP/IP round-trip time is greater than 100ms. When the return packets finally arrive, the initiating server will close the connection with RST RST RST, which results in TLS NEGOTIATION FAILURE. If TLS is not used, then the high-latency connection will function normally and replication will occur. The 100ms time limit comes from here: servers/slapd/back-ldap/back-ldap.h: #define LDAP_BACK_RESULT_UTIMEOUT (100000) Reference commit 112be0118e43c161d44de6e852cca9f517bb653d from 2005. HYC: "Ando ported timeout code from back-meta into back-ldap but he never ported the config keyword that sets the timeout number of retries" In addition, the back_ldap man page is not up to date. My temporary workaround was to set LDAP_BACK_RESULT_UTIMEOUT (900000) (900ms) and recompile. Problem immediately went away, but this is not a correct approach and the retry counter should be runtime configurable.

1 0

Re: (ITS#6835) extend pwFailureTime timestamp to microsecond resolution to improve pwdMaxFailure enforcement
by quanah＠symas.com 30 Aug '17

30 Aug '17

Hi Brian, I just wanted to follow up and let you know this was taken care of in ITS#7161 and the fix was part of the OpenLDAP 2.4.40 release. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 30 Aug '17

30 Aug '17

RGVhciBIb3dhcmQtc2FuLA0KDQoNClRoYW5rIHlvdSBzbyBtdWNoIGZvciB5b3VyIHByb21wdCBh ZHZpY2UuDQoNCkFzIHlvdSB0b2xkLCBJIG5lZWQgdG8gY2hlY2sgd2hldGhlciBvciBub3QgY3J5 cHRfcigpIGV4aXN0cy4NCkkgYW0gZ29pbmcgdG8gY29uc2lkZXIgaW5jbHVkaW5nIHRoZSBjaGVj ay4NCg0KV291bGQgaXQgYmUgcG9zc2libGUgdG8gbGV0IG1lIGtub3cgd2hldGhlciB0aGVyZSBh cmUgYW55IG90aGVyIGNvbmNlcm5zIA0KYWJvdXQgdGhlIGZpeCBpZiB3ZSBjYW4gdXNlIGNyeXB0 X3IoKT8NCg0KVGhlIGltcGxlbWVudGF0aW9uIHRoYXQgImJvdGggY2FsbG9jKCkgYW5kIGZyZWUo KSBvY2N1ciBldmVyeSB0aW1lIA0Kc2xhcGRfY3J5cHQoKSBpcyBjYWxsZWQiIGRvZXMgbm90IHNl ZW0gdG8gbG9vayBnb29kLg0KVGhlIGNhbGxlcnMgb2Ygc2xhcGRfY3J5cHQoKSBtaWdodCBiZSBh YmxlIHRvIGdldCB0aGUgbWVtb3J5IGZvciAic3RydWN0IA0KY3J5cHRfZGF0YSIgYmVmb3JlIHRo ZXkgY2FsbCBpdC4NCkhvd2V2ZXIsIEkgdGhpbmsgaXQgY2F1c2VzIHRoZSBjaGFuZ2VzIG9mIG90 aGVyIHNvdXJjZSBjb2Rlcy4NClNvLCBJIHRoaW5rIHRoZSBhZm9yZW1lbnRpb25lZCBpbXBsZW1l bnRhdGlvbiBpcyBhIHdvcmthcm91bmQgZm9yIHRoZSANCnNsb3dkb3duIGlmIHRoZSByaXNrIG9m IG1lbW9yeSBmcmFnbWVudGF0aW9uIGNhbiBiZSBhY2NlcHRhYmxlLg0KDQpPbiB0aGUgb3RoZXIg aGFuZHMsIEkgdGhpbmsgd2UgZG8gbm90IG5lZWQgdG8gY2FyZSBhYm91dCBzdHJjbXAoKSANCmJl Y2F1c2UgaXQgaXMgdGhyZWFkLXNhZmUuDQoNCg0KQmVzdCBSZWdhcmRzLA0KLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KT24gMjAxNy8wOC8zMCAxOToyNiwgSG93YXJk IENodSB3cm90ZToNCj4geW9zLW5pc2hpbm9AeXMuanAubmVjLmNvbSB3cm90ZToNCj4+IEZ1bGxf TmFtZTogWW9zaGlub3JpIE5pc2hpbm8NCj4+IFZlcnNpb246IDIuNC40NQ0KPj4gT1M6IENlbnRP UyA3DQo+PiBVUkw6IGZ0cDovL2Z0cC5vcGVubGRhcC5vcmcvaW5jb21pbmcvDQo+PiBTdWJtaXNz aW9uIGZyb206IChOVUxMKSAoMjEwLjE0My4zNS4yMCkNCj4+DQo+Pg0KPj4gRGVhciBzaXIsDQo+ Pg0KPj4gVGhlIGZ1bmN0aW9uIHNsYXBkX2NyeXB0KCkgaW4gc2VydmVycy9zbGFwZC9wYXNzd2Qu YyBzZWVtcyB0byBiZWNvbWUgDQo+PiBzbG93IHdoZW4NCj4+IG1hbnkgbGRhcCBjbGllbnQgY29u bmVjdGlvbnMgb2NjdXIuDQo+PiBJdCBzZWVtcyBpdCBpcyBiZWNhdXNlIHRoZSBmdW5jdGlvbiB1 c2VzIGNyeXB0KCkobm9uIHRocmVhZC1zYWZlIA0KPj4gZnVuY3Rpb24pIGFuZA0KPj4gcHRocmVh ZF9tdXRleF9sb2NrKCksIHdoaWNoIHJlc3VsdHMgaW4gdGhlIHNsb3dkb3duLg0KPj4gI0Jlc2lk ZXMsIHdlIG5lZWQgdG8gdXNlIHtDUllQVH0gaGFzaCBhcyB1c2VycycgcGFzc3dvcmQgaGFzaC4N Cj4+DQo+PiBTbywgSSBtb2RpZmllZCBzZXJ2ZXJzL3NsYXBkL3Bhc3N3ZC5jIGxpa2UgdGhlIGZv bGxvd2luZy4NCj4+IEFzIGEgcmVzdWx0LCBzbGFwZF9jcnlwdCgpIGJlY29tZXMgbXVjaCBmYXN0 ZXIgdW5kZXIgdGhlIHNhbWUgY29uZGl0aW9uLg0KPj4gV291bGQgeW91IGxldCBtZSBrbm93IHdo ZXRoZXIgb3Igbm90IHRoZSBmaXggaXMgYXBwcm9wcmlhdGUgZm9yIHNsYXBkPw0KPiANCj4gTm8g aXQgaXMgbm90IGFuIGFwcHJvcHJpYXRlIGZpeC4NCj4gDQo+IFlvdSBzaG91bGQgYWRkIGFuIGF1 dG9jb25mIHRlc3QgdG8gY2hlY2sgZm9yIHRoZSBleGlzdGVuY2Ugb2YgdGhlIA0KPiBjcnlwdF9y IGZ1bmN0aW9uLCBhbmQgdXNlIGFuICNpZmRlZiBoZXJlIGJhc2VkIG9uIHRoZSByZXN1bHQgb2Yg dGhhdCANCj4gdGVzdCwgc2luY2UgY3J5cHRfciBpcyBhIG5vbi1zdGFuZGFyZCBmdW5jdGlvbi4N Cj4+DQo+PiA9PT09PQ0KPj4gc3RhdGljIGludCBzbGFwZF9jcnlwdCggY29uc3QgY2hhciAqa2V5 LCBjb25zdCBjaGFyICpzYWx0LCBjaGFyICoqaGFzaCApDQo+PiB7DQo+PiDCoMKgwqDCoGNoYXIg KmNyOw0KPj4gwqDCoMKgwqBpbnQgcmM7DQo+PiDCoMKgwqDCoMKgwqDCoMKgIHN0cnVjdCBjcnlw dF9kYXRhICpkYXRhOw0KPj4NCj4+IMKgwqDCoMKgwqDCoMKgwqAgZGF0YSA9IChzdHJ1Y3QgY3J5 cHRfZGF0YSAqKWNhbGxvYygxLCBzaXplb2Yoc3RydWN0IA0KPj4gY3J5cHRfZGF0YSkpOw0KPj4g wqDCoMKgwqAvKiBsZGFwX3B2dF90aHJlYWRfbXV0ZXhfbG9jayggJnBhc3N3ZF9tdXRleCApOyAq Lw0KPj4NCj4+IMKgwqDCoMKgLyogY3IgPSBjcnlwdCgga2V5LCBzYWx0ICk7ICovDQo+PiDCoMKg wqDCoGNyID0gY3J5cHRfcigga2V5LCBzYWx0LCBkYXRhICk7DQo+PiDCoMKgwqDCoGlmICggY3Ig PT0gTlVMTCB8fCBjclswXSA9PSAnXDAnICkgew0KPj4gwqDCoMKgwqDCoMKgwqAgLyogc2FsdCBt dXN0IGhhdmUgYmVlbiBpbnZhbGlkICovDQo+PiDCoMKgwqDCoMKgwqDCoCByYyA9IExVVElMX1BB U1NXRF9FUlI7DQo+PiDCoMKgwqDCoH0gZWxzZSB7DQo+PiDCoMKgwqDCoMKgwqDCoCBpZiAoIGhh c2ggKSB7DQo+PiDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIGxkYXBfcHZ0X3RocmVhZF9tdXRleF9s b2NrKCAmcGFzc3dkX211dGV4ICk7DQo+PiDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgICpoYXNoID0g YmVyX3N0cmR1cCggY3IgKTsNCj4+IMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgbGRhcF9wdnRfdGhy ZWFkX211dGV4X3VubG9jayggJnBhc3N3ZF9tdXRleCApOw0KPj4gwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCByYyA9IExVVElMX1BBU1NXRF9PSzsNCj4+DQo+PiDCoMKgwqDCoMKgwqDCoCB9IGVsc2Ug ew0KPj4gwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCByYyA9IHN0cmNtcCggc2FsdCwgY3IgKSA/IExV VElMX1BBU1NXRF9FUlIgOiBMVVRJTF9QQVNTV0RfT0s7DQo+PiDCoMKgwqDCoMKgwqDCoCB9DQo+ PiDCoMKgwqDCoH0NCj4+DQo+PiDCoMKgwqDCoMKgwqDCoMKgIGZyZWUoZGF0YSk7DQo+PiDCoMKg wqDCoC8qIGxkYXBfcHZ0X3RocmVhZF9tdXRleF91bmxvY2soICZwYXNzd2RfbXV0ZXggKTsgKi8N Cj4+IMKgwqDCoMKgcmV0dXJuIHJjOw0KPj4gfQ0KPj4NCj4+ID09PT0NCj4+DQo+PiAjICIjZGVm aW5lIF9fVVNFX0dOVSIgaXMgYWxzbyByZXF1aXJlZCB0byBidWlsZCBzbGFwZC4NCj4+DQo+Pg0K Pj4gQmVzdCBSZWdhcmRzLA0KPj4NCj4+DQo+Pg0KPiANCj4gDQoNCi0tIA0KKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqDQpZb3NoaW5vcmkgTmlzaGlubw0K DQpORUMgU29sdXRpb24gSW5ub3ZhdG9ycywgTHRkLg0KMS0xOC03IFNoaW5raWJhLCBLb3RvLWt1 LCBUb2t5bywgMTM2LTg2MjcgSmFwYW4NCkUtTUFJTDogeW9zLW5pc2hpbm9AeXMuanAubmVjLmNv bQ0KKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs