Full_Name: Guillaume Pujol Version: 2.4.11 (latest debian package) OS: Debian Lenny URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (193.251.11.120)

Hello,

I have an OpenLDAP test instance configured as a translucent proxy to an Active Directory server (the later running on W2k3).

The relevant database configuration (from slapd.conf) is as follows:

database hdb directory /var/lib/ldap-proxy suffix "dc=eds,dc=local"

index objectClass eq

overlay translucent uri ldap://192.168.65.130:389 lastmod off acl-bind bindmethod=simple binddn="CN=ldapsync,CN=Users,DC=EDS,DC=local" credentials="ldapsync" idassert-bind bindmethod=simple mode=self chase-referrals yes

The server loads and runs fine with this configuration, as long as no one binds. The credentials for acl-bind are valid.

When I connect to the server and bind with valid credentials, the server crashes with a SIG_ABRT due to an assertion failed (backtrace below).

Steps to reproduce:

root@debian:~# /etc/init.d/slapd start Starting OpenLDAP: slapd. root@debian:~# ps aux | grep slapd openldap 5978 0.2 2.0 25188 5364 ? Ssl 14:21 0:00 /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf root 5983 0.0 0.2 3144 760 pts/2 R+ 14:21 0:00 grep slapd root@debian:~# ldapsearch -H ldap://192.168.65.134 -x -b dc=eds,dc=local -D "cn=myuser,cn=Users,dc=eds,dc=local" -W -LL Enter LDAP Password: <input correct password here>

ldap_result: Can't contact LDAP server (-1) root@debian:~# ps aux | grep slapd root 5970 0.0 0.2 3144 764 pts/2 S+ 14:20 0:00 grep slapd

# TO MAKE SURE THE SERVER WORKS FINE, I TRY TO BIND WITH A WRONG PASSWORD: root@debian:~# /etc/init.d/slapd start Starting OpenLDAP: slapd. root@debian:~# ldapsearch -x -b dc=eds,dc=local -D "cn=myuser,cn=Users,dc=eds,dc=local" -W Enter LDAP Password: <input wrong password here> ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece root@debian:~# ps aux | grep slapd openldap 5982 0.2 2.0 25188 5364 ? Ssl 14:21 0:00 /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf root 5984 0.0 0.2 3144 760 pts/2 R+ 14:21 0:00 grep slapd

The backtrace of the SIG_ABRT is as follows:

#0 0xb7faf424 in __kernel_vsyscall () #1 0xb7bbb640 in raise () from /lib/i686/cmov/libc.so.6 #2 0xb7bbd018 in abort () from /lib/i686/cmov/libc.so.6 #3 0xb7bb45be in __assert_fail () from /lib/i686/cmov/libc.so.6 #4 0xb7f62d3b in ber_bvreplace_x (dst=0x8b3d458, src=0xb6981d48, ctx=0x0) at /build/buildd/openldap-2.4.11/libraries/liblber/memory.c:700 #5 0xb7f62d6c in ber_bvreplace (dst=0x8b3d458, src=0xb6981d48) at /build/buildd/openldap-2.4.11/libraries/liblber/memory.c:715 #6 0xb77c78ff in ldap_back_dobind_int (lcp=0xb6981e78, op=0x8b3d018, rs=0xb6983148, sendok=22, retries=0, dolock=1) at /build/buildd/openldap-2.4.11/servers/slapd/back-ldap/bind.c:2211 #7 0xb77c2ecd in ldap_back_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/back-ldap/search.c:166 #8 0xb77b65d2 in translucent_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/overlays/translucent.c:976 #9 0x080db6c6 in overlay_op_walk (op=0x8b3d018, rs=0xb6983148, which=op_search, oi=0x8ae4028, on=0x8ae4128) at /build/buildd/openldap-2.4.11/servers/slapd/backover.c:636 #10 0x080dc205 in over_op_func (op=0x8b3d018, rs=0xb6983148, which=op_search) at /build/buildd/openldap-2.4.11/servers/slapd/backover.c:698 #11 0x08078a23 in fe_op_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/search.c:366 #12 0x08079290 in do_search (op=0x8b3d018, rs=0xb6983148) at /build/buildd/openldap-2.4.11/servers/slapd/search.c:217 #13 0x08076436 in connection_operation (ctx=0xb6983238, arg_v=0x8b3d018) at /build/buildd/openldap-2.4.11/servers/slapd/connection.c:1084 #14 0x08076eb7 in connection_read_thread (ctx=0xb6983238, argv=0x13) at /build/buildd/openldap-2.4.11/servers/slapd/connection.c:1211 #15 0xb7f73fb8 in ldap_int_thread_pool_wrapper (xpool=0x8ab46f8) at /build/buildd/openldap-2.4.11/libraries/libldap_r/tpool.c:663 #16 0xb7cf14c0 in start_thread () from /lib/i686/cmov/libpthread.so.0 #17 0xb7c7061e in clone () from /lib/i686/cmov/libc.so.6

So it looks like this assert fails for some reason: at /build/buildd/openldap-2.4.11/libraries/liblber/memory.c:700 assert( !BER_BVISNULL( src ) );

Reproducible: always with the configuration above.

If I remove "mode=self" in the configuration above, the server loads and runs fine (no crash when binding), but I can't search anything in the database:

root@debian:~# ldapsearch -LL -x -b dc=eds,dc=local -D "cn=myuser,cn=Users,dc=eds,dc=local" -W Enter LDAP Password: <correct password>

result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece

I'm not sure if this crash is due to an incoherent configuration, or to an interaction problem with the Active Directory backend. In the former case, I think the server should output an error message when started. In the later case, it is probably a bug.

Please let me know if you need more specific information.

Regards,