openldap-bugs

openldap-bugs@openldap.org

1 participants
20961 discussions

Re: (ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by andrew.findlay＠skills-1st.co.uk 18 May '15

18 May '15

On Mon, May 18, 2015 at 04:58:29PM +0000, Howard Chu wrote: > > (On my laptop, "all possible" is 2^64 - 1 so yes, this will spin for .. a while.) 584942 years at 1M tests/sec - I am not waiting around for the timeout :-) (or the electricity bill: over £10M at todays prices) > Fixed now in git master. Thanks Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Re: (ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by hyc＠symas.com 18 May '15

18 May '15

hyc(a)symas.com wrote: > Andrew Findlay wrote: >> On Mon, May 18, 2015 at 04:48:13PM +0100, Howard Chu wrote: >> >>> ITS#8103 fix crash with more than 65535 aliases in a scope >> >> Ah - my test case does not have any aliases at all so it may be an >> unrelated issue. > > I see, your issue is caused by the fact you haven't indexed the objectClass > attribute. When back-mdb does a search to find all the alias objects in the > DB, instead of returning zero, it returns unknown which causes it to loop > through all possible entryIDs looking for alias entries. > > (On my laptop, "all possible" is 2^64 - 1 so yes, this will spin for .. a while.) > Fixed now in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by hyc＠symas.com 18 May '15

18 May '15

Andrew Findlay wrote: > On Mon, May 18, 2015 at 04:48:13PM +0100, Howard Chu wrote: > >> ITS#8103 fix crash with more than 65535 aliases in a scope > > Ah - my test case does not have any aliases at all so it may be an > unrelated issue. I see, your issue is caused by the fact you haven't indexed the objectClass attribute. When back-mdb does a search to find all the alias objects in the DB, instead of returning zero, it returns unknown which causes it to loop through all possible entryIDs looking for alias entries. (On my laptop, "all possible" is 2^64 - 1 so yes, this will spin for .. a while.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by andrew.findlay＠skills-1st.co.uk 18 May '15

18 May '15

On Mon, May 18, 2015 at 04:48:13PM +0100, Howard Chu wrote: > ITS#8103 fix crash with more than 65535 aliases in a scope Ah - my test case does not have any aliases at all so it may be an unrelated issue. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Re: (ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by hyc＠symas.com 18 May '15

18 May '15

Andrew Findlay wrote: > On Mon, May 18, 2015 at 12:39:17PM +0100, Howard Chu wrote: > >> Already fixed in RE24. > > Not in the version that I pulled 10 minutes ago... > > openldap-OPENLDAP_REL_ENG_2_4-e445af3 Hmm. violino:~/OD/gr24/servers/slapd> git log -1 back-mdb commit e1fdac9db59e4677b9a2403a072558bd89e44321 Author: Howard Chu <hyc(a)openldap.org> Date: Mon Apr 13 13:11:29 2015 -0700 ITS#8103 fix crash with more than 65535 aliases in a scope I'll look at your test case shortly, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by andrew.findlay＠skills-1st.co.uk 18 May '15

18 May '15

On Mon, May 18, 2015 at 12:39:17PM +0100, Howard Chu wrote: > Already fixed in RE24. Not in the version that I pulled 10 minutes ago... openldap-OPENLDAP_REL_ENG_2_4-e445af3 Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Re: (ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by hyc＠symas.com 18 May '15

18 May '15

andrew.findlay(a)skills-1st.co.uk wrote: > Full_Name: Andrew Findlay > Version: 2.4.40 > OS: Linux: OpenSuSE 13.2 > URL: ftp://ftp.openldap.org/incoming/openldap-mdb-spin-bug.tgz > Submission from: (NULL) (2001:8b0:8d0:f7e1:61a6:169e:b4ba:9954) > > > Some client programs (such as Apache Directory Studio) request alias > dereferencing by default. This puts slapd with mdb into a spin where it consumes > 100% of a CPU. Other threads continue to work and new connections are accepted. > Timeouts do not terminate the spin. Disconnecting the client does not terminate > the spin. Already fixed in RE24. > To reproduce: start slapd and issue a search of the form: > > ldapsearch -a search -x -b dc=example,dc=org objectclass=person > > I have placed a tarball on the FTP server containing: > > slapd.conf > sample data in LDIF > gdb output showing thread trace after breaking in > script of client commands > > The build options were: > > CFLAGS=-g > export CFLAGS > > ./configure --prefix=/meme/andrew/test/openldap-2.4.40 \ > --enable-spasswd \ > --enable-crypt \ > --enable-slapi \ > --enable-overlays \ > --enable-hdb=no \ > --enable-bdb=no \ > --enable-ldap \ > --enable-rewrite \ > --enable-meta \ > --enable-null \ > --enable-monitor \ > --enable-relay \ > --enable-sock \ > --with-cyrus-sasl \ > --with-tls > > > For those that need it, the workaround with Apache Directory Studio is to > disable alias dereferencing in the Browser Options tab for the connection. > > Andrew > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8146) Slapd with mdb consumes 100% CPU if deref aliases is requested
by andrew.findlay＠skills-1st.co.uk 18 May '15

18 May '15

Full_Name: Andrew Findlay Version: 2.4.40 OS: Linux: OpenSuSE 13.2 URL: ftp://ftp.openldap.org/incoming/openldap-mdb-spin-bug.tgz Submission from: (NULL) (2001:8b0:8d0:f7e1:61a6:169e:b4ba:9954) Some client programs (such as Apache Directory Studio) request alias dereferencing by default. This puts slapd with mdb into a spin where it consumes 100% of a CPU. Other threads continue to work and new connections are accepted. Timeouts do not terminate the spin. Disconnecting the client does not terminate the spin. To reproduce: start slapd and issue a search of the form: ldapsearch -a search -x -b dc=example,dc=org objectclass=person I have placed a tarball on the FTP server containing: slapd.conf sample data in LDIF gdb output showing thread trace after breaking in script of client commands The build options were: CFLAGS=-g export CFLAGS ./configure --prefix=/meme/andrew/test/openldap-2.4.40 \ --enable-spasswd \ --enable-crypt \ --enable-slapi \ --enable-overlays \ --enable-hdb=no \ --enable-bdb=no \ --enable-ldap \ --enable-rewrite \ --enable-meta \ --enable-null \ --enable-monitor \ --enable-relay \ --enable-sock \ --with-cyrus-sasl \ --with-tls For those that need it, the workaround with Apache Directory Studio is to disable alias dereferencing in the Browser Options tab for the connection. Andrew

1 0

Re: (ITS#8145) The olcThreadQueues config element is not documented
by elecharny＠gmail.com 16 May '15

16 May '15

Le 15/05/15 19:14, Howard Chu a écrit : > Emmanuel Lécharny wrote: >> Le 15/05/15 13:40, Howard Chu a écrit : >>> elecharny(a)apache.org wrote: >>>> Full_Name: Emmanuel L.charny >>>> Version: 2.4.40 >>>> OS: >>>> URL: ftp://ftp.openldap.org/incoming/ >>>> Submission from: (NULL) (83.202.0.248) >>>> >>>> >>>> The olcThreadQueues AttributeType is part of the olcGlobal >>>> OvjectClass since >>>> 2.4.36, where it's has been added. >>>> A man slapd-config provides no information on this parameter. >>> >>> You're mistaken. The olcThreadQueues feature has not been included in >>> any official 2.4 release, it is a 2.5 feature. >>> >> Sadly, I can't comment on an ITS. So here it is : >> >> "It may not be official, but it's present in the code base since 2.4.36, >> it's also present as a MAY attribute in the olcGlobal ObjectClass. > > No. You misunderstand - it is *NOT* present in the 2.4 source tree. It > has *never* been present in the 2.4 source tree. > It's present in HEAD, which I suppose is now the 2.5 branch : http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl… The web browser is kind of confusing... And, no, it's not present in tag 2.4.40. The ITS can be closed, sorry for the noise.

1 0

Re: (ITS#8125) MMR throws away valid changes causing drift
by quanah＠zimbra.com 15 May '15

15 May '15

--On Friday, May 15, 2015 7:45 PM +0000 quanah(a)zimbra.com wrote: > --On Friday, May 15, 2015 8:39 PM +0100 Howard Chu <hyc(a)symas.com> wrote: > >> quanah(a)zimbra.com wrote: >>> This is caused by modify ops: >>> >>> [zimbra@ldap02-dc01 xx]$ grep $20$ /var/log/zimbra.log >>> May 15 08:35:46 ldap02-dc01 slapd[18167]: syncrepl_message_to_op: >>> rid=201 be_modify uid=xxx,ou=people,dc=xxx,dc=com (20) >> >> Multiple TYPE_OR_VALUE_EXISTS errors indicate you're sending a lot of >> mods that were already performed. Sounds more like a serverID or URL >> misconfig here if there are actually only 2 servers talking. > > ServerID's are unique (2 & 3). There is no URL portion to the config, as > we're not replicating cn=config. In 6 days, the servers have gotten > totally out of sync with one another, and REFRESH mode isn't fixing it > either. Note that the drift is occurring on an attribute that is multi-valued: zimbraPasswordLockoutFailureTime The values stored in the attribute are only granular down to the second, so it's not uncommon for multiple writes of the same value (add/mod/delete) to occur for this attribute. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs