openldap-bugs

openldap-bugs@openldap.org

1 participants
21065 discussions

(ITS#8204) rfc2782 shuffle implementation doesn't treat equal-weight records equally
by Sergio.Gelato＠astro.su.se 25 Jul '15

25 Jul '15

Full_Name: Sergio Gelato Version: 2.4.40 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (85.225.123.9) As currently implemented (since ITS#7027, 5de85b922aaa5bfa6eb53db6000adf01ebdb0736) the algorithm to shuffle DNS SRV records of a given priority according to their weights is flawed: if all records have the same weight, the implementation is biased towards the first record and against the last. In the most extreme case of two records of weight 1, the current implementation will never swap them (whereas one would have hoped for a swap 50% of the time). The problem can be cured by changing (r <= 0) to (r < 0). (The wording of the RFC may have contributed to this error; I suspect it was written with real random deviates in mind, not integer ones. In any event, the principle that records of equal weight should have the same probability of being picked trumps the RFC since the latter only says what algorithm SHOULD be used.) I've written and tested a patch for this and found it to solve the above problem. My patch also addresses another (operationally minor, which is why I'm not reporting it separately) issue in the same piece of code: what if at least two, but not all, of the records of a given priority have weight zero? One should be prepared to switch to a Fisher-Yates shuffle if "total" becomes zero during the iteration. (Yet another potential issue is overflow of "total" on platforms where INT_MAX==32767 if the sum of the weights exceeds that value. Consider declaring it uint32_t or u_long.)

1 0

Fix in ITS#8036 is incomplete
by hyc＠openldap.org 24 Jul '15

24 Jul '15

Full_Name: Howard Chu Version: 2.4.41 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.231.122) Submitted by: hyc The fix in ITS#8036 only corrects the situation for candidate-based searches, not for scope-based searches. In scope-based searches the "fix" treats the scopes array incorrectly and can overwrite the heap. A new fix is coming shortly.

1 0

Re: (ITS#8202) openldap assumes printf has %z
by h.b.furuseth＠usit.uio.no 22 Jul '15

22 Jul '15

On 22. juli 2015 17:54, Howard Chu wrote: > h.b.furuseth(a)usit.uio.no wrote: >> If we require C99 library features like this, then I >> think we should add a configure test for them. Strange >> breakage at runtime is rather worse than a failed build. >> >> (That's not the same as testing for a C99 compiler, since >> one can have a C99 compiler like gcc with a C90 library.) > > The fewer configure tests we need, the better. Happy to replace %zu with %llu > and forget about it. It's not worth a fuss. Right. Looks like it should be %ld and (long) though, we don't use long long either except inside HAVE_LONG_LONG etc and mdb.c -- Hallvard

1 0

Re: (ITS#8202) openldap assumes printf has %z
by hyc＠symas.com 22 Jul '15

22 Jul '15

h.b.furuseth(a)usit.uio.no wrote: > If we require C99 library features like this, then I > think we should add a configure test for them. Strange > breakage at runtime is rather worse than a failed build. > > (That's not the same as testing for a C99 compiler, since > one can have a C99 compiler like gcc with a C90 library.) The fewer configure tests we need, the better. Happy to replace %zu with %llu and forget about it. It's not worth a fuss. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8202) openldap assumes printf has %z
by iand＠ekit-inc.com 21 Jul '15

21 Jul '15

Hi Howard, Yes I'm well aware of the state of Solaris 9 support and we support key components of the OS ourselves. However that doesn't mean that people don't still run it, like we do on some systems yet to be upgraded. (yes we have Sun systems purchased over 15 years ago that are still happily running; the hardware is very reliable; many are well overdue for upgrade though; its a resource/priority thing just look at how many people are running WinXP still) However this issue is a portability of openldap issue, not a OS support/patch thing (the C library in this case is not broken; its doing as the man page says, which doesn't mention %z), and the %z support is only a recent thing in the lifetime of unix (well last ~15 years it started to appear... C99 I think) There will be other legacy OS's that don't support %z too; no idea what ones though. Anyway I've got an (ugly) patch for me to use now and it passes 'make check' on Solaris 9; it was hard to find the cause of the problem though. Ian D On 07/22/15 04:01, Howard Chu wrote: > Howard Chu wrote: >> iand(a)ekit-inc.com wrote: >>> Full_Name: Ian Donaldson >>> Version: 2.4.41 >>> OS: Solaris 9 >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (60.241.85.68) >>> >>> >>> Built 2.4.41 on Solaris 9; ran 'make check' which failed to start slapd with >>> the following errors: >> >> Thanks for the report. Not sure that it's worth our taking any action though. >> The last release of Solaris 9 was 10 years ago, and it has been end-of-life'd >> by Oracle. > > For reference: Solaris 9 EOL > http://www.oracle.com/technetwork/server-storage/solaris10/overview/index-1… > > In short it means Solaris 9 is no longer eligible for any Oracle updates including security updates, fixes, patches or any other changes. Solaris 9 went into sustaining support in October 2014. > > Since Oracle is no longer providing any patches for this OS, I don't see much reason for us to either. Fortunately you are free to patch and build OpenLDAP for yourself for as long as you wish. >

1 0

Re: (ITS#8202) openldap assumes printf has %z
by h.b.furuseth＠usit.uio.no 21 Jul '15

21 Jul '15

If we require C99 library features like this, then I think we should add a configure test for them. Strange breakage at runtime is rather worse than a failed build. (That's not the same as testing for a C99 compiler, since one can have a C99 compiler like gcc with a C90 library.)

1 0

Re: (ITS#8202) openldap assumes printf has %z
by hyc＠symas.com 21 Jul '15

21 Jul '15

Howard Chu wrote: > iand(a)ekit-inc.com wrote: >> Full_Name: Ian Donaldson >> Version: 2.4.41 >> OS: Solaris 9 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (60.241.85.68) >> >> >> Built 2.4.41 on Solaris 9; ran 'make check' which failed to start slapd with >> the following errors: > > Thanks for the report. Not sure that it's worth our taking any action though. > The last release of Solaris 9 was 10 years ago, and it has been end-of-life'd > by Oracle. For reference: Solaris 9 EOL http://www.oracle.com/technetwork/server-storage/solaris10/overview/index-1… In short it means Solaris 9 is no longer eligible for any Oracle updates including security updates, fixes, patches or any other changes. Solaris 9 went into sustaining support in October 2014. Since Oracle is no longer providing any patches for this OS, I don't see much reason for us to either. Fortunately you are free to patch and build OpenLDAP for yourself for as long as you wish. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8199) Crash when modifying the first olcAttributeTypes element in olcSchemaConfig objectClass
by luca.bruno＠rocket-internet.de 19 Jul '15

19 Jul '15

On Friday 17 July 2015 16:19:16 Ryan Tandy wrote: > On Tue, Jul 14, 2015 at 11:13:56AM +0000, luca.bruno(a)rocket-internet.de wrote: > >slapd 2.4.40 realiably crashes when modifying the 0th olcAttributeTypes > >element in a olcSchemaConfig object. > > This doesn't match my experience exactly, but if you were editing the > config with some tool, it might reflect how that tool implements > modifications. For a more specific background, this was Apache Directory Studio (pre-)2 doing schema changes on the debian backports 2.4.40 on wheezy (amd64). IIRC it does in fact synthesize a batch-modify of schema entries. > This was already fixed for olcObjectClasses in ITS#5388. I've pushed a > patch doing the same for at_next, can you please verify it? > > http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=patch;h=b48d0169d0 > 4824f83c0e0855eea4d6429740cf08 I'll try to apply that patch on top of my current setup and see if it stops crashing without any other regression. Thanks, Luca -- Luca Bruno (kaeso) Security Engineer Rocket Internet SE -> GPG: 0xBB1A3A854F3BBEBF

1 0

Re: (ITS#8202) openldap assumes printf has %z
by hyc＠symas.com 19 Jul '15

19 Jul '15

iand(a)ekit-inc.com wrote: > Full_Name: Ian Donaldson > Version: 2.4.41 > OS: Solaris 9 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (60.241.85.68) > > > Built 2.4.41 on Solaris 9; ran 'make check' which failed to start slapd with > the following errors: Thanks for the report. Not sure that it's worth our taking any action though. The last release of Solaris 9 was 10 years ago, and it has been end-of-life'd by Oracle. > 55ab70f0 config_build_entry: "olcDatabase={-1}frontend" > 55ab70f0 config_build_entry: "olcDatabase={0}config" > 55ab70f0 config_build_entry: "olcDatabase={1}bdb" > 55ab70f0 config_build_attrs: error 21 on olcDbCacheSize value #0 > 55ab70f0 config_build_entry: build "zu" failed: "" > > Eventually found this to be due to the assumption that %z format > works in printf; this is not the case on Solaris 9. (Solaris 10 has %z) > > Found the following code that makes this assumption (there may be others): > > ./libraries/liblmdb/mdb_load.c > ./libraries/liblmdb/mdb_dump.c > ./libraries/liblmdb/mdb_stat.c > ./libraries/liblmdb/mdb.c > ./servers/slapd/overlays/constraint.c > ./servers/slapd/config.c > > My workaround was to use %l instead of %z which works for me; may not > be 100% fix though. > > See http://stackoverflow.com/questions/2524611/how-to-print-size-t-variable-por… > > > I previously built 2.4.33 which has some %z'isms too but not in places > that cause 'make check' to fail. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8202) openldap assumes printf has %z
by iand＠ekit-inc.com 19 Jul '15

19 Jul '15

Full_Name: Ian Donaldson Version: 2.4.41 OS: Solaris 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (60.241.85.68) Built 2.4.41 on Solaris 9; ran 'make check' which failed to start slapd with the following errors: 55ab70f0 config_build_entry: "olcDatabase={-1}frontend" 55ab70f0 config_build_entry: "olcDatabase={0}config" 55ab70f0 config_build_entry: "olcDatabase={1}bdb" 55ab70f0 config_build_attrs: error 21 on olcDbCacheSize value #0 55ab70f0 config_build_entry: build "zu" failed: "" Eventually found this to be due to the assumption that %z format works in printf; this is not the case on Solaris 9. (Solaris 10 has %z) Found the following code that makes this assumption (there may be others): ./libraries/liblmdb/mdb_load.c ./libraries/liblmdb/mdb_dump.c ./libraries/liblmdb/mdb_stat.c ./libraries/liblmdb/mdb.c ./servers/slapd/overlays/constraint.c ./servers/slapd/config.c My workaround was to use %l instead of %z which works for me; may not be 100% fix though. See http://stackoverflow.com/questions/2524611/how-to-print-size-t-variable-por… I previously built 2.4.33 which has some %z'isms too but not in places that cause 'make check' to fail.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs