openldap-devel April 2017

openldap-devel@openldap.org

8 participants
25 discussions

test062 segfault with back-mdb
by Quanah Gibson-Mount 20 Apr '17

20 Apr '17

This doesn't occur with back-bdb/hdb, and it doesn't happen if I insert a sleep after the ldapsearch to see if slapd is running, before the modification to cn=config is done. Thread 3 "lt-slapd" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fae46748700 (LWP 11239)] 0x00007fae4553abab in syncprov_free_syncop (so=0x7fae3c102cc0, unlink=1) at syncprov.c:811 811 for ( sop = &so->s_si->si_ops; *sop; sop = &(*sop)->s_next ) { Here's the full backtrace: Thread 4 (Thread 0x7fae45f47700 (LWP 11240)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 No locals. #1 0x00007fae4b48af69 in ldap_pvt_thread_cond_wait (cond=0x2529138, mutex=0x2529110) at thr_posix.c:281 No locals. #2 0x00007fae4b4896e5 in ldap_int_thread_pool_wrapper (xpool=0x2529100) at tpool.c:945 pq = 0x2529100 pool = 0x2529000 task = 0x0 work_list = 0x2529170 ctx = {ltu_pq = 0x2529100, ltu_id = 140386474686208, ltu_key = {{ltk_key = 0x440674 <conn_counter_init+224>, ltk_data = 0x7fae3c000db0, ltk_free = 0x4404c5 <conn_counter_destroy+224>}, {ltk_key = 0x4bc7fd <slap_sl_mem_create+197>, ltk_data = 0x7fae3c000ec0, ltk_free = 0x4bc621 <slap_sl_mem_destroy+224>}, { ltk_key = 0x45d2c1 <slap_op_free+224>, ltk_data = 0x7fae3c000950, ltk_free = 0x45d212 <slap_op_free+49>}, {ltk_key = 0x0, ltk_data = 0x7fae38108550, ltk_free = 0x0}, { ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0x0} <repeats 28 times>}} kctx = 0x0 i = 32 keyslot = 349 hash = 3903429981 pool_lock = 0 freeme = 0 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #3 0x00007fae4ae496ba in start_thread (arg=0x7fae45f47700) at pthread_create.c:333 __res = <optimized out> pd = 0x7fae45f47700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140386474686208, 8789157664068107475, 0, 140386491460639, 140386474686912, 0, -8744345895670219565, -8744361424428172077}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> __PRETTY_FUNCTION__ = "start_thread" #4 0x00007fae4a23f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 No locals. Thread 3 (Thread 0x7fae46748700 (LWP 11239)): #0 0x00007fae4553abab in syncprov_free_syncop (so=0x7fae3c102cc0, unlink=1) at syncprov.c:811 sop = 0x6f637d307b3d6573 sr = 0x0 srnext = 0x240907c38f1c2800 ga = 0x0 gnext = 0x7fae46747960 #1 0x00007fae4553b6ec in syncprov_qtask (ctx=0x7fae46747c30, arg=0x7fae3c102cc0) at syncprov.c:1005 so = 0x7fae3c102cc0 opbuf = {ob_op = {o_hdr = 0x7fae46747960, o_tag = 99, o_time = 1492715516, o_tincr = 0, o_tusec = 0, o_qtime = {tv_sec = 0, tv_usec = 0}, o_bd = 0x7fae46747650, o_req_dn = { bv_len = 9, bv_val = 0x7fae3c103032 "cn=config"}, o_req_ndn = {bv_len = 9, bv_val = 0x7fae3c10303c "cn=config"}, o_request = {oq_add = {rs_modlist = 0x2, rs_e = 0xffffffffffffffff}, oq_bind = {rb_method = 2, rb_cred = {bv_len = 18446744073709551615, bv_val = 0x0}, rb_edn = {bv_len = 0, bv_val = 0x0}, rb_ssf = 1007690928, rb_mech = {bv_len = 15, bv_val = 0x7fae3c103046 "(objectClass=*)"}}, oq_compare = {rs_ava = 0x2}, oq_modify = {rs_mods = {rs_modlist = 0x2, rs_no_opattrs = -1 '\377'}, rs_increment = 0}, oq_modrdn = {rs_mods = {rs_modlist = 0x2, rs_no_opattrs = -1 '\377'}, rs_deleteoldrdn = 0, rs_newrdn = {bv_len = 0, bv_val = 0x0}, rs_nnewrdn = { bv_len = 140386308727984, bv_val = 0xf <error: Cannot access memory at address 0xf>}, rs_newSup = 0x7fae3c103046, rs_nnewSup = 0x0}, oq_search = {rs_scope = 2, rs_deref = 0, rs_slimit = -1, rs_tlimit = -1, rs_limit = 0x0, rs_attrsonly = 0, rs_attrs = 0x0, rs_filter = 0x7fae3c1024b0, rs_filterstr = {bv_len = 15, bv_val = 0x7fae3c103046 "(objectClass=*)"}}, oq_abandon = {rs_msgid = 2}, oq_cancel = {rs_msgid = 2}, oq_extended = {rs_reqoid = {bv_len = 2, bv_val = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>}, rs_flags = 0, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended = {rs_reqoid = { bv_len = 2, bv_val = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>}, rs_flags = 0, rs_reqdata = 0x0}, rs_old = {bv_len = 0, bv_val = 0x7fae3c1024b0 "\207"}, rs_new = {bv_len = 15, bv_val = 0x7fae3c103046 "(objectClass=*)"}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon = 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 1 '\001', o_is_auth_check = 0 '\000', o_dont_replicate = 0 '\000', o_acl_priv = ACL_NONE, o_nocaching = 0 '\000', o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000', o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 20 times>, "\001\000\000\000\000\000\000\000\000\000\000", o_controls = 0x7fae46747aa8, o_authz = {sai_method = 128, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 9, bv_val = 0x7fae3c103028 "cn=config"}, sai_ndn = {bv_len = 9, bv_val = 0x7fae3c103028 "cn=config"}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x0, o_ctrls = 0x0, o_csn = {bv_len = 0, bv_val = 0x0}, o_private = 0x0, o_extra = { slh_first = 0x0}, o_next = {stqe_next = 0x0}}, ob_hdr = {oh_opid = 1, oh_connid = 1003, oh_conn = 0x257ad10, oh_msgid = 2, oh_protocol = 3, oh_tid = 140386474686208, oh_threadctx = 0x7fae46747c30, oh_tmpmemctx = 0x7fae38002bb0, oh_tmpmfuncs = 0x773b20 <slap_sl_mfuncs>, oh_counters = 0x7fae3c000db0, oh_log_prefix = "conn=1003 op=1", '\000' <repeats 241 times>}, ob_controls = {0x0 <repeats 32 times>}} op = 0x7fae467477e0 be = {bd_info = 0x76eec0 <slap_binfo>, bd_self = 0x254c6c0, be_ctrls = '\000' <repeats 15 times>, "\001", '\000' <repeats 16 times>, "\001", be_flags = 131328, be_restrictops = 0, be_requires = 0, be_ssf_set = {sss_ssf = 0, sss_transport = 0, sss_tls = 0, sss_sasl = 0, sss_update_ssf = 0, sss_update_transport = 0, sss_update_tls = 0, sss_update_sasl = 0, sss_simple_bind = 0}, be_suffix = 0x254c8c0, be_nsuffix = 0x254c910, be_schemadn = {bv_len = 0, bv_val = 0x0}, be_schemandn = {bv_len = 0, bv_val = 0x0}, be_rootdn = { bv_len = 9, bv_val = 0x254c860 "cn=config"}, be_rootndn = {bv_len = 9, bv_val = 0x254c880 "cn=config"}, be_rootpw = {bv_len = 8, bv_val = 0x254cad0 "yE1UpCg5"}, be_max_deref_depth = 15, be_def_limit = {lms_t_soft = 3600, lms_t_hard = 0, lms_s_soft = 500, lms_s_hard = 0, lms_s_unchecked = -1, lms_s_pr = 0, lms_s_pr_hide = 0, lms_s_pr_total = 0}, be_limits = 0x0, be_acl = 0x2633600, be_dfltaccess = ACL_NONE, be_extra_anlist = 0x0, be_update_ndn = {bv_len = 0, bv_val = 0x0}, be_update_refs = 0x0, be_pending_csn_list = 0x26335e0, be_pcl_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, be_syncinfo = 0x0, be_pb = 0x0, be_cf_ocs = 0x0, be_private = 0x774880 <cfBackInfo>, be_next = { stqe_next = 0x0}} rc = 0 #2 0x00007fae4b4897f9 in ldap_int_thread_pool_wrapper (xpool=0x2529100) at tpool.c:963 pq = 0x2529100 pool = 0x2529000 task = 0x7fae400008c0 work_list = 0x2529170 ctx = {ltu_pq = 0x2529100, ltu_id = 140386483078912, ltu_key = {{ltk_key = 0x440674 <conn_counter_init+224>, ltk_data = 0x7fae38002aa0, ltk_free = 0x4404c5 <conn_counter_destroy+224>}, {ltk_key = 0x4bc7fd <slap_sl_mem_create+197>, ltk_data = 0x7fae38002bb0, ltk_free = 0x4bc621 <slap_sl_mem_destroy+224>}, { ltk_key = 0x45d2c1 <slap_op_free+224>, ltk_data = 0x7fae38002670, ltk_free = 0x45d212 <slap_op_free+49>}, {ltk_key = 0x0, ltk_data = 0x7fae3c101040, ltk_free = 0x0}, { ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0x0} <repeats 28 times>}} kctx = 0x0 i = 32 keyslot = 494 hash = 3805260270 pool_lock = 0 freeme = 0 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #3 0x00007fae4ae496ba in start_thread (arg=0x7fae46748700) at pthread_create.c:333 __res = <optimized out> pd = 0x7fae46748700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140386483078912, 8789157664068107475, 0, 140386491460639, 140386483079616, 0, -8744353591714743085, -8744361424428172077}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> __PRETTY_FUNCTION__ = "start_thread" #4 0x00007fae4a23f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 No locals. Thread 2 (Thread 0x7fae46f49700 (LWP 11211)): #0 0x00007fae4a23fe23 in epoll_wait () at ../sysdeps/unix/syscall-template.S:84 No locals. #1 0x000000000043c6ac in slapd_daemon_task (ptr=0x2737b40) at daemon.c:2527 err = 4 ns = 1 at = 0 nfds = 2 revents = 0x24fccc0 tvp = 0x0 cat = {tv_sec = 0, tv_usec = 0} i = 1 nwriters = 0 now = 1492715518 tv = {tv_sec = 0, tv_usec = 0} tdelta = 1 rtask = 0x0 l = 1 last_idle_check = 1492715506 ebadf = 0 tid = 0 #2 0x00007fae4ae496ba in start_thread (arg=0x7fae46f49700) at pthread_create.c:333 __res = <optimized out> pd = 0x7fae46f49700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140386491471616, 8789157664068107475, 0, 140720937019743, 140386491472320, 0, -8744352491666244397, -8744361424428172077}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> __PRETTY_FUNCTION__ = "start_thread" #3 0x00007fae4a23f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 No locals. Thread 1 (Thread 0x7fae4b8f8700 (LWP 11196)): #0 0x00007fae4ae4a98d in pthread_join (threadid=140386491471616, thread_return=0x0) at pthread_join.c:90 __tid = 17259 _buffer = {__routine = 0x7fae4ae4a8b0 <cleanup>, __arg = 0x7fae46f49d28, __canceltype = 0, __prev = 0x0} oldtype = 0 pd = 0x7fae46f49700 self = 0x7fae4b8f8700 result = 0 #1 0x00007fae4b48aeaa in ldap_pvt_thread_join (thread=140386491471616, thread_return=0x0) at thr_posix.c:201 No locals. #2 0x000000000043d949 in slap_sig_wake (sig=0) at daemon.c:3012 save_errno = 0 #3 0x0000000000415e5f in main (argc=8, argv=0x7ffc2576ac68) at main.c:1058 i = -1 no_detach = 1 rc = -12 urls = 0x24f80b0 "ldap://localhost:9011/" username = 0x0 groupname = 0x0 sandbox = 0x0 syslogUser = 160 pid = 16711680 waitfds = {5294400, 0} g_argc = 8 g_argv = 0x7ffc2576ac68 configfile = 0x0 configdir = 0x24f8090 "./slapd.d" serverName = 0x7ffc2576b51a "lt-slapd" serverMode = 1 scp = 0x0 scp_entry = 0x0 debug_unknowns = 0x0 syslog_unknowns = 0x0 serverNamePrefix = 0x50ce18 "" l = 0 slapd_pid_file_unlink = 0 slapd_args_file_unlink = 0 firstopt = 0 __PRETTY_FUNCTION__ = "\000\000\000\000" -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Compile failed when configure --without-thread on git master branch
by Qun-Ying 20 Apr '17

20 Apr '17

Hi, When configure with ./configure --without-thread The code in master branch will failed with: thr_stub.c:170:1: error: conflicting types for 'ldap_pvt_thread_pool_retract' ldap_pvt_thread_pool_retract ( ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from thr_stub.c:21:0: ../../include/ldap_pvt_thread.h:237:1: note: previous declaration of 'ldap_pvt_thread_pool_retract' was here ldap_pvt_thread_pool_retract LDAP_P(( ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ thr_stub.c:254:1: warning: return type defaults to 'int' [-Wimplicit-int] ldap_pvt_thread_pool_pausecheck( ldap_pvt_thread_pool_t *tpool ) It seems the check in e12ca8b6fed6b8a2526 for "Fixes for multiple threadpool queues" change the API but does not update the thr_stub.c definition. -- Qun-Ying

1 0

Re: autoca SEGV with OpenSSL 1.1
by Howard Chu 19 Apr '17

19 Apr '17

Quanah Gibson-Mount wrote: > The new autoca overlay is broken with OpenSSL 1.1 after fixing the code to > pull in the correct headers. Specifically, we get a segfault in the OpenSSL's > libcrypto. Looking at the docs, it appears the code is correct on the > OpenLDAP side of things? So perhaps a bug in OpenSSL (I'm using 1.1.0e, the > latest release). Backtrace shows: OpenSSL 1.1.0e works fine for me. Self-compiled from OpenSSL git repo. Just to be sure, do an "info shared" in gdb and show which shared libraries slapd is running with. > Program received signal SIGSEGV, Segmentation fault. > [Switching to Thread 0x7f797716d700 (LWP 8432)] > bn_wexpand (a=0x68134c60, words=1) at crypto/bn/bn_lib.c:1018 > 1018 return (words <= a->dmax) ? a : bn_expand2(a, words); > (gdb) bt full > #0 bn_wexpand (a=0x68134c60, words=1) at crypto/bn/bn_lib.c:1018 > No locals. > #1 0x00007f797b1cd14e in BN_bin2bn (s=0x7f796824eff0 > "\271ct\035\200T\330,\210", len=<optimized out>, ret=0x68134c60) at > crypto/bn/bn_lib.c:497 > i = 1 > m = 7 > n = <optimized out> > l = <optimized out> > bn = <optimized out> > #2 0x00007f797b1d2e67 in bnrand (bottom=<optimized out>, top=0, > bits=<optimized out>, rnd=0x68134c60, pseudorand=<optimized out>) at > crypto/bn/bn_rand.c:83 > buf = 0x7f796824eff0 "\271ct\035\200T\330,\210" > ret = <optimized out> > bit = <optimized out> > bytes = 8 > mask = <optimized out> > tim = 1492622208 > #3 bnrand (pseudorand=<optimized out>, rnd=0x68134c60, bits=<optimized out>, > top=0, bottom=<optimized out>) at crypto/bn/bn_rand.c:17 > No locals. > #4 0x00007f797597a1a8 in autoca_gencert (op=0x7f797716a9d0, > args=0x7f797716a8e0) at autoca.c:319 > bn = 0x68134c60 > subj_name = 0x7f7968134a20 > issuer_name = 0x7f797716a9d0 > subj_cert = 0x7f79681344d0 > derdn = {bv_len = 48, > bv_val = 0x7f79680030d8 > "\035;\261\323\363\256\250\257\024\357^\353\367feaN\202\355UE\363\nY\255\217r\v\254\a\333\025\331\325\372E`\302\217S\tL\t`\003\261\005\233\372{\223\351\231=Z\361\362<\343\352\250j\262\024\256\344[^\237\224t\\qF\262\272\235\b$\306R\211\335^\364\024\377\063C\\5\314\330T\fyM\237B\366\311a\254\231\034\353*\224\275\240u\266W&T\255\021\202j"} > > pp = 0x7f7968003408 "\020" > evpk = 0x7f7968134d20 > rc = 1 > #5 0x00007f797597c3d3 in autoca_db_open (be=0x7f7968001a90, > cr=0x7f797716c414) at autoca.c:1037 > args = {issuer_cert = 0x0, issuer_pkey = 0x0, subjectDN = > 0x7f796810c370, cert_exts = 0x7f7975b7e380, more_exts = 0x0, newcert = > 0x7f797716aa00, newpkey = 0x7f7968134d20, > dercert = {bv_len = 140159726786010, bv_val = 0x7f79ffffffff <Address > 0x7f79ffffffff out of bounds>}, derpkey = {bv_len = 1216, bv_val = > 0x7f7968002f48 "0\202\004\274\002\001"}, > keybits = 2048, days = 3652} > arg2 = {oc = 0x3c, dercert = 0x7f797aba208e, derpkey = 0x7f797aee1180, > on = 0x3c, dn = 0x7f797716aa00, ndn = 0x7f797716d9c0, isca = 4} > gotoc = 0 > gotat = 0 > on = 0x7f7968133e00 > ai = 0x7f796824a6a0 > conn = {c_struct_state = SLAP_C_UNINITIALIZED, c_conn_state = > SLAP_C_INVALID, c_conn_idx = -1, c_sd = 0, c_close_reason = 0x0, c_mutex = > {__data = {__lock = 0, __count = 0, > __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = > {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = > 0}, c_sb = 0x0, c_starttime = 0, > c_activitytime = 0, c_connid = 18446744073709551615, c_peer_domain = > {bv_len = 0, bv_val = 0x5073c0 ""}, c_peer_name = {bv_len = 0, bv_val = > 0x5073c0 ""}, c_listener = 0x50fe80, > c_sasl_bind_mech = {bv_len = 0, bv_val = 0x0}, c_sasl_dn = {bv_len = > 0, bv_val = 0x0}, c_sasl_authz_dn = {bv_len = 0, bv_val = 0x0}, > c_authz_backend = 0x0, c_authz_cookie = 0x0, > c_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, > sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn = {bv_len = 0, bv_val = 0x0}, > sai_ssf = 0, sai_transport_ssf = 0, > sai_tls_ssf = 0, sai_sasl_ssf = 0}, c_protocol = 0, c_ops = > {stqh_first = 0x0, stqh_last = 0x0}, c_pending_ops = {stqh_first = 0x0, > stqh_last = 0x0}, c_write1_mutex = { > __data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, > __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = > '\000' <repeats 39 times>, > __align = 0}, c_write1_cv = {__data = {__lock = 0, __futex = 0, > __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters > = 0, __broadcast_seq = 0}, > __size = '\000' <repeats 47 times>, __align = 0}, c_write2_mutex = > {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, > __spins = 0, __list = { > __prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 > times>, __align = 0}, c_write2_cv = {__data = {__lock = 0, __futex = 0, > __total_seq = 0, __wakeup_seq = 0, > __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = > 0}, __size = '\000' <repeats 47 times>, __align = 0}, c_currentber = 0x0, > c_writers = 0, > c_writing = 0 '\000', c_sasl_bind_in_progress = 0 '\000', > c_writewaiter = 0 '\000', c_is_tls = 0 '\000', c_needs_tls_accept = 0 '\000', > c_sasl_layers = 0 '\000', > c_sasl_done = 0 '\000', c_sasl_authctx = 0x0, c_sasl_sockctx = 0x0, > c_sasl_extra = 0x0, c_sasl_cbind = 0x0, c_sasl_bindop = 0x0, c_txn = 0, > c_txn_backend = 0x0, c_txn_ops = { > stqh_first = 0x0, stqh_last = 0x0}, c_pagedresults_state = {ps_be = > 0x0, ps_size = 0, ps_count = 0, ps_cookie = 0, ps_cookieval = {bv_len = 0, > bv_val = 0x0}}, > c_n_ops_received = 0, c_n_ops_executing = 0, c_n_ops_pending = 0, > c_n_ops_completed = 0, c_n_get = 0, c_n_read = 0, c_n_write = 0, c_extensions > = 0x0, c_clientfunc = 0, > c_clientarg = 0x0, c_send_ldap_result = 0x457014 > <slap_send_ldap_result+224>, c_send_search_entry = 0x45806a > <slap_send_search_entry+224>, > c_send_search_reference = 0x45a327 <slap_send_search_reference+224>, > c_send_ldap_extended = 0x457b0b <slap_send_ldap_extended+224>, > c_send_ldap_intermediate = 0x457e55 <slap_send_ldap_intermediate+224>} > opbuf = {ob_op = {o_hdr = 0x7f797716ab50, o_tag = 0, o_time = > 1492622208, o_tincr = 22, o_tusec = 614988, o_qtime = {tv_sec = 0, tv_usec = > 0}, o_bd = 0x7f7968001a90, o_req_dn = { > bv_len = 0, bv_val = 0x0}, o_req_ndn = {bv_len = 0, bv_val = > 0x0}, o_request = {oq_add = {rs_modlist = 0x0, rs_e = 0x0}, oq_bind = > {rb_method = 0, rb_cred = {bv_len = 0, > bv_val = 0x0}, rb_edn = {bv_len = 0, bv_val = 0x0}, rb_ssf = > 0, rb_mech = {bv_len = 0, bv_val = 0x0}}, oq_compare = {rs_ava = 0x0}, > oq_modify = {rs_mods = { > rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_increment = > 0}, oq_modrdn = {rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, > rs_deleteoldrdn = 0, rs_newrdn = { > bv_len = 0, bv_val = 0x0}, rs_nnewrdn = {bv_len = 0, bv_val = > 0x0}, rs_newSup = 0x0, rs_nnewSup = 0x0}, oq_search = {rs_scope = 0, rs_deref > = 0, rs_slimit = 0, > rs_tlimit = 0, rs_limit = 0x0, rs_attrsonly = 0, rs_attrs = > 0x0, rs_filter = 0x0, rs_filterstr = {bv_len = 0, bv_val = 0x0}}, oq_abandon = > {rs_msgid = 0}, oq_cancel = { > rs_msgid = 0}, oq_extended = {rs_reqoid = {bv_len = 0, bv_val = > 0x0}, rs_flags = 0, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended = {rs_reqoid > = {bv_len = 0, bv_val = 0x0}, > rs_flags = 0, rs_reqdata = 0x0}, rs_old = {bv_len = 0, bv_val > = 0x0}, rs_new = {bv_len = 0, bv_val = 0x0}, rs_mods = 0x0, rs_modtail = > 0x0}}, o_abandon = 0, > o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', > o_is_auth_check = 0 '\000', o_dont_replicate = 0 '\000', o_acl_priv = > ACL_NONE, o_nocaching = 0 '\000', > o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000', > o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 31 times>, > o_controls = 0x7f797716ac98, > o_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, > sai_dn = {bv_len = 28, bv_val = 0x7f7968109640 > "cn=Manager,dc=example,dc=com"}, sai_ndn = {bv_len = 28, > bv_val = 0x7f7968104150 "cn=manager,dc=example,dc=com"}, > sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, o_ber > = 0x0, o_res_ber = 0x0, > o_callback = 0x0, o_ctrls = 0x0, o_csn = {bv_len = 0, bv_val = > 0x0}, o_private = 0x0, o_extra = {slh_first = 0x0}, o_next = {stqe_next = > 0x0}}, ob_hdr = {oh_opid = 0, > oh_connid = 18446744073709551615, oh_conn = 0x7f797716ada0, > oh_msgid = 0, oh_protocol = 0, oh_tid = 140159665755904, oh_threadctx = > 0x7f797716cb80, > oh_tmpmemctx = 0x7f7968002bb0, oh_tmpmfuncs = 0x76eb20, oh_counters > = 0x7721a0, oh_log_prefix = "conn=-1 op=0", '\000' <repeats 243 times>}, > ob_controls = { > 0x0 <repeats 32 times>}} > op = 0x7f797716a9d0 > thrctx = 0x7f797716cb80 > e = 0x18cbed8 > a = 0x7f797716aec0 > rc = 0 > #6 0x000000000042659f in config_add_internal (cfb=0x76f860, e=0x7f796814ad78, > ca=0x7f797716b3c0, rs=0x7f797716ca40, renum=0x7f797716b3b4, op=0x7f7968002670) > at bconfig.c:5536 > ce = 0x0 > last = 0x7f7968137850 > co = {co_def = 0x7f797716b200 "\017", co_type = 1747231856, co_table = > 0x7f7968002bb0, co_ldadd = 0x7f796824a470, co_cfadd = 0x7f797716b120, > co_lddel = 0x7f797bbdc476 <ber_dupbv+40>, co_oc = 0x7f797716b200, > co_name = 0x7f7968134400} > coptr = 0x768e40 > colst = 0x7f796824a4c0 > a = 0x0 > oc_at = 0x7f7968162378 > soc_at = 0x7f79681622e8 > i = 1 > ibase = 0 > nocs = 3 > rc = 0 > pdn = {bv_len = 28, bv_val = 0x7f796813c432 > "olcDatabase={1}bdb,cn=config"} > ct = 0x0 > ptr = 0x7f7968249a62 "}autoca" > log_prefix = 0x7f7968002838 "conn=1008 op=1" > #7 0x0000000000427081 in config_back_add (op=0x7f7968002670, > rs=0x7f797716ca40) at bconfig.c:5749 > ce = 0x7f797716b3e0 > addr = {rs_modlist = 0x9, rs_e = 0x7f796813bd90} > cfb = 0x76f860 > renumber = 0 > dopause = 1 > ca = {argc = 2, argv = 0x7f796824a7f0, argv_size = 513, line = > 0x7f796812f7a0 "cn=localhost,ou=Servers,dc=example,dc=com", tline = > 0x7f796824b800 "", fname = 0x50c925 "slapd", > lineno = 0, linelen = 41, log = "olcACAlocalDN: value #0", '\000' > <repeats 4100 times>, reply = {err = 0, msg = '\000' <repeats 255 times>}, > depth = 0, valx = 0, values = { > v_int = 41, v_uint = 41, v_long = 41, v_ulong = 41, v_ber_t = 41, > v_string = 0x29 <Address 0x29 out of bounds>, v_bv = {bv_len = 41, > bv_val = 0x7f796824a340 > "cn=localhost,ou=Servers,dc=example,dc=com"}, v_dn = {vdn_dn = {bv_len = 41, > bv_val = 0x7f796824a340 "cn=localhost,ou=Servers,dc=example,dc=com"}, > vdn_ndn = {bv_len = 41, bv_val = 0x7f796812f730 > "cn=localhost,ou=servers,dc=example,dc=com"}}, v_ad = 0x29}, rvalue_vals = > 0x0, rvalue_nvals = 0x0, op = 0, type = 9, > ca_op = 0x7f7968002670, be = 0x7f7968001a90, bi = 0x7f7968133e00, > ca_entry = 0x0, ca_private = 0x0, cleanup = 0, table = Cft_Overlay} > #8 0x0000000000449e01 in fe_op_add (op=0x7f7968002670, rs=0x7f797716ca40) at > add.c:356 > defref = 0xffffffffffffffff > repl_user = 0 > modtail = 0x7f796824e170 > rc = 0 > op_be = 0x18cb6f0 > bd = 0x771660 > textbuf = > "`\275\023hy\177\000\000\320\375\210\001\000\000\000\000\000D\023hy\177\000\000%{F\000\000\000\000\000\220\307\026wy\177", > '\000' <repeats 18 times>"\320, > \307\026wy\177\000\000`\275\023hy\177\000\000\360'\000hy\177\000\000\220\307\026wy\177\000\000`\274\226wy\177\000\000\300\331\026wy\177\000\000\346L\337{y\177\000\000\a\000\000\000\000\000\000\000`\nw\000\000\000\000\000\260\307\026wy\177\000\000b\277D\000\000\000\000\000\020\310\026wy\177\000\000 > \335$hy\177\000\000 > \335$hy\177\000\000\030#\026hy\177\000\000\020\310\026wy\177\000\000{\244D", > '\000' <repeats 13 times>, > "\020\311\026wy\177\000\000`\312\026wy\177\000\000\000\000\000\000\001\000\000\000\320&\000hy\177\000\000\000\000\000\000\000\000\000\000"... > > textlen = 256 > __PRETTY_FUNCTION__ = "esc != ((v" > #9 0x000000000044967e in do_add (op=0x7f7968002670, rs=0x7f797716ca40) at > add.c:205 > bd = 0x7f797716c960 > ber = 0x7f796c104f70 > last = 0x7f796824a2a0 "" > dn = {bv_len = 46, bv_val = 0x7f796824a1e8 > "olcOverlay=autoca,olcDatabase={1}bdb,cn=config"} > len = 60 > tag = 18446744073709551615 > modlist = 0x7f796813bbc0 > modtail = 0x7f796824e170 > tmp = {sml_mod = {sm_desc = 0x7f7968133b7f, sm_values = 0x7f796813bd60, > sm_nvalues = 0x0, sm_numvals = 0, sm_op = 0, sm_flags = 0, sm_type = {bv_len = > 13, > bv_val = 0x7f796824a266 "olcACAlocalDN"}}, sml_next = 0x0} > textbuf = > "\177;\023hy\177\000\000\360\067\022ly\177\000\000\a\000\000\000\000\000\000\000\377\377\377\377\377\377\377\377\300\311\026wy\177\000\000\223\252\275{y\177\000\000P\000\000\000\000\000\000\000p;\023hy\177\000\000\260+\000hy\177", > '\000' <repeats 18 times>"\260, > +\000hy\177\000\000+|K\000\000\000\000\000\200\313\026wy\177\000\000\200\313\026wy\177\000\000\376\241\275{\001\000\000\000 > \312\026wy\177\000\000\n}K\000\000\000\000\000\001\000\000\000\002\000\000\000\200\313\026wy\177\000\000\001\000\000\000\001\000\000\000\000\000\020", > '\000' <repeats 13 times>"\260, > +\000hy\177\000\000\260+\000hy\177\000\000\200\313\026wy\177\000\000\360+\000hy\177\000\000_\036{\257\000\000\000\000 > \312\026wy\177\000\000\v\371C\000\000\000\000\000\200\313\026wy\177\000\000\346"... > > textlen = 256 > rc = 0 > freevals = 0 > oex = {oe = {oe_next = {sle_next = 0x0}, oe_key = 0x448988}, oe_db = 0x0} > #10 0x000000000043fe42 in connection_operation (ctx=0x7f797716cb80, > arg_v=0x7f7968002670) at connection.c:1163 > rc = 80 > cancel = 152257809 > op = 0x7f7968002670 > rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = 0, > sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = > {sru_search = {r_entry = 0x0, > r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, > r_nentries = 0, r_v2ref = 0x0}, sru_sasl = {r_sasldata = 0x0}, sru_extended = > {r_rspoid = 0x0, r_rspdata = 0x0}}, > sr_flags = 0} > tag = 104 > opidx = SLAP_OP_ADD > conn = 0x18f9e10 > memctx = 0x7f7968002bb0 > memctx_null = 0x0 > memsiz = 1048576 > __PRETTY_FUNCTION__ = "on_write(%ld): no con" > #11 0x00000000004403ea in connection_read_activate (s=0) at connection.c:1321 > rc = 32633 > #12 0x0000000000000008 in ?? () > No symbol table info available. > #13 0x00007f797716cb80 in ?? () > No symbol table info available. > #14 0x00007f7968002670 in ?? () > No symbol table info available. > #15 0x0000000000000000 in ?? () > No symbol table info available. > (gdb) > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

autoca SEGV with OpenSSL 1.1
by Quanah Gibson-Mount 19 Apr '17

19 Apr '17

The new autoca overlay is broken with OpenSSL 1.1 after fixing the code to pull in the correct headers. Specifically, we get a segfault in the OpenSSL's libcrypto. Looking at the docs, it appears the code is correct on the OpenLDAP side of things? So perhaps a bug in OpenSSL (I'm using 1.1.0e, the latest release). Backtrace shows: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f797716d700 (LWP 8432)] bn_wexpand (a=0x68134c60, words=1) at crypto/bn/bn_lib.c:1018 1018 return (words <= a->dmax) ? a : bn_expand2(a, words); (gdb) bt full #0 bn_wexpand (a=0x68134c60, words=1) at crypto/bn/bn_lib.c:1018 No locals. #1 0x00007f797b1cd14e in BN_bin2bn (s=0x7f796824eff0 "\271ct\035\200T\330,\210", len=<optimized out>, ret=0x68134c60) at crypto/bn/bn_lib.c:497 i = 1 m = 7 n = <optimized out> l = <optimized out> bn = <optimized out> #2 0x00007f797b1d2e67 in bnrand (bottom=<optimized out>, top=0, bits=<optimized out>, rnd=0x68134c60, pseudorand=<optimized out>) at crypto/bn/bn_rand.c:83 buf = 0x7f796824eff0 "\271ct\035\200T\330,\210" ret = <optimized out> bit = <optimized out> bytes = 8 mask = <optimized out> tim = 1492622208 #3 bnrand (pseudorand=<optimized out>, rnd=0x68134c60, bits=<optimized out>, top=0, bottom=<optimized out>) at crypto/bn/bn_rand.c:17 No locals. #4 0x00007f797597a1a8 in autoca_gencert (op=0x7f797716a9d0, args=0x7f797716a8e0) at autoca.c:319 bn = 0x68134c60 subj_name = 0x7f7968134a20 issuer_name = 0x7f797716a9d0 subj_cert = 0x7f79681344d0 derdn = {bv_len = 48, bv_val = 0x7f79680030d8 "\035;\261\323\363\256\250\257\024\357^\353\367feaN\202\355UE\363\nY\255\217r\v\254\a\333\025\331\325\372E`\302\217S\tL\t`\003\261\005\233\372{\223\351\231=Z\361\362<\343\352\250j\262\024\256\344[^\237\224t\\qF\262\272\235\b$\306R\211\335^\364\024\377\063C\\5\314\330T\fyM\237B\366\311a\254\231\034\353*\224\275\240u\266W&T\255\021\202j"} pp = 0x7f7968003408 "\020" evpk = 0x7f7968134d20 rc = 1 #5 0x00007f797597c3d3 in autoca_db_open (be=0x7f7968001a90, cr=0x7f797716c414) at autoca.c:1037 args = {issuer_cert = 0x0, issuer_pkey = 0x0, subjectDN = 0x7f796810c370, cert_exts = 0x7f7975b7e380, more_exts = 0x0, newcert = 0x7f797716aa00, newpkey = 0x7f7968134d20, dercert = {bv_len = 140159726786010, bv_val = 0x7f79ffffffff <Address 0x7f79ffffffff out of bounds>}, derpkey = {bv_len = 1216, bv_val = 0x7f7968002f48 "0\202\004\274\002\001"}, keybits = 2048, days = 3652} arg2 = {oc = 0x3c, dercert = 0x7f797aba208e, derpkey = 0x7f797aee1180, on = 0x3c, dn = 0x7f797716aa00, ndn = 0x7f797716d9c0, isca = 4} gotoc = 0 gotat = 0 on = 0x7f7968133e00 ai = 0x7f796824a6a0 conn = {c_struct_state = SLAP_C_UNINITIALIZED, c_conn_state = SLAP_C_INVALID, c_conn_idx = -1, c_sd = 0, c_close_reason = 0x0, c_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_sb = 0x0, c_starttime = 0, c_activitytime = 0, c_connid = 18446744073709551615, c_peer_domain = {bv_len = 0, bv_val = 0x5073c0 ""}, c_peer_name = {bv_len = 0, bv_val = 0x5073c0 ""}, c_listener = 0x50fe80, c_sasl_bind_mech = {bv_len = 0, bv_val = 0x0}, c_sasl_dn = {bv_len = 0, bv_val = 0x0}, c_sasl_authz_dn = {bv_len = 0, bv_val = 0x0}, c_authz_backend = 0x0, c_authz_cookie = 0x0, c_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn = {bv_len = 0, bv_val = 0x0}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, c_protocol = 0, c_ops = {stqh_first = 0x0, stqh_last = 0x0}, c_pending_ops = {stqh_first = 0x0, stqh_last = 0x0}, c_write1_mutex = { __data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_write1_cv = {__data = {__lock = 0, __futex = 0, __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 times>, __align = 0}, c_write2_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = { __prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_write2_cv = {__data = {__lock = 0, __futex = 0, __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 times>, __align = 0}, c_currentber = 0x0, c_writers = 0, c_writing = 0 '\000', c_sasl_bind_in_progress = 0 '\000', c_writewaiter = 0 '\000', c_is_tls = 0 '\000', c_needs_tls_accept = 0 '\000', c_sasl_layers = 0 '\000', c_sasl_done = 0 '\000', c_sasl_authctx = 0x0, c_sasl_sockctx = 0x0, c_sasl_extra = 0x0, c_sasl_cbind = 0x0, c_sasl_bindop = 0x0, c_txn = 0, c_txn_backend = 0x0, c_txn_ops = { stqh_first = 0x0, stqh_last = 0x0}, c_pagedresults_state = {ps_be = 0x0, ps_size = 0, ps_count = 0, ps_cookie = 0, ps_cookieval = {bv_len = 0, bv_val = 0x0}}, c_n_ops_received = 0, c_n_ops_executing = 0, c_n_ops_pending = 0, c_n_ops_completed = 0, c_n_get = 0, c_n_read = 0, c_n_write = 0, c_extensions = 0x0, c_clientfunc = 0, c_clientarg = 0x0, c_send_ldap_result = 0x457014 <slap_send_ldap_result+224>, c_send_search_entry = 0x45806a <slap_send_search_entry+224>, c_send_search_reference = 0x45a327 <slap_send_search_reference+224>, c_send_ldap_extended = 0x457b0b <slap_send_ldap_extended+224>, c_send_ldap_intermediate = 0x457e55 <slap_send_ldap_intermediate+224>} opbuf = {ob_op = {o_hdr = 0x7f797716ab50, o_tag = 0, o_time = 1492622208, o_tincr = 22, o_tusec = 614988, o_qtime = {tv_sec = 0, tv_usec = 0}, o_bd = 0x7f7968001a90, o_req_dn = { bv_len = 0, bv_val = 0x0}, o_req_ndn = {bv_len = 0, bv_val = 0x0}, o_request = {oq_add = {rs_modlist = 0x0, rs_e = 0x0}, oq_bind = {rb_method = 0, rb_cred = {bv_len = 0, bv_val = 0x0}, rb_edn = {bv_len = 0, bv_val = 0x0}, rb_ssf = 0, rb_mech = {bv_len = 0, bv_val = 0x0}}, oq_compare = {rs_ava = 0x0}, oq_modify = {rs_mods = { rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_increment = 0}, oq_modrdn = {rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_deleteoldrdn = 0, rs_newrdn = { bv_len = 0, bv_val = 0x0}, rs_nnewrdn = {bv_len = 0, bv_val = 0x0}, rs_newSup = 0x0, rs_nnewSup = 0x0}, oq_search = {rs_scope = 0, rs_deref = 0, rs_slimit = 0, rs_tlimit = 0, rs_limit = 0x0, rs_attrsonly = 0, rs_attrs = 0x0, rs_filter = 0x0, rs_filterstr = {bv_len = 0, bv_val = 0x0}}, oq_abandon = {rs_msgid = 0}, oq_cancel = { rs_msgid = 0}, oq_extended = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = 0x0}, rs_old = {bv_len = 0, bv_val = 0x0}, rs_new = {bv_len = 0, bv_val = 0x0}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon = 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', o_is_auth_check = 0 '\000', o_dont_replicate = 0 '\000', o_acl_priv = ACL_NONE, o_nocaching = 0 '\000', o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000', o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 31 times>, o_controls = 0x7f797716ac98, o_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 28, bv_val = 0x7f7968109640 "cn=Manager,dc=example,dc=com"}, sai_ndn = {bv_len = 28, bv_val = 0x7f7968104150 "cn=manager,dc=example,dc=com"}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x0, o_ctrls = 0x0, o_csn = {bv_len = 0, bv_val = 0x0}, o_private = 0x0, o_extra = {slh_first = 0x0}, o_next = {stqe_next = 0x0}}, ob_hdr = {oh_opid = 0, oh_connid = 18446744073709551615, oh_conn = 0x7f797716ada0, oh_msgid = 0, oh_protocol = 0, oh_tid = 140159665755904, oh_threadctx = 0x7f797716cb80, oh_tmpmemctx = 0x7f7968002bb0, oh_tmpmfuncs = 0x76eb20, oh_counters = 0x7721a0, oh_log_prefix = "conn=-1 op=0", '\000' <repeats 243 times>}, ob_controls = { 0x0 <repeats 32 times>}} op = 0x7f797716a9d0 thrctx = 0x7f797716cb80 e = 0x18cbed8 a = 0x7f797716aec0 rc = 0 #6 0x000000000042659f in config_add_internal (cfb=0x76f860, e=0x7f796814ad78, ca=0x7f797716b3c0, rs=0x7f797716ca40, renum=0x7f797716b3b4, op=0x7f7968002670) at bconfig.c:5536 ce = 0x0 last = 0x7f7968137850 co = {co_def = 0x7f797716b200 "\017", co_type = 1747231856, co_table = 0x7f7968002bb0, co_ldadd = 0x7f796824a470, co_cfadd = 0x7f797716b120, co_lddel = 0x7f797bbdc476 <ber_dupbv+40>, co_oc = 0x7f797716b200, co_name = 0x7f7968134400} coptr = 0x768e40 colst = 0x7f796824a4c0 a = 0x0 oc_at = 0x7f7968162378 soc_at = 0x7f79681622e8 i = 1 ibase = 0 nocs = 3 rc = 0 pdn = {bv_len = 28, bv_val = 0x7f796813c432 "olcDatabase={1}bdb,cn=config"} ct = 0x0 ptr = 0x7f7968249a62 "}autoca" log_prefix = 0x7f7968002838 "conn=1008 op=1" #7 0x0000000000427081 in config_back_add (op=0x7f7968002670, rs=0x7f797716ca40) at bconfig.c:5749 ce = 0x7f797716b3e0 addr = {rs_modlist = 0x9, rs_e = 0x7f796813bd90} cfb = 0x76f860 renumber = 0 dopause = 1 ca = {argc = 2, argv = 0x7f796824a7f0, argv_size = 513, line = 0x7f796812f7a0 "cn=localhost,ou=Servers,dc=example,dc=com", tline = 0x7f796824b800 "", fname = 0x50c925 "slapd", lineno = 0, linelen = 41, log = "olcACAlocalDN: value #0", '\000' <repeats 4100 times>, reply = {err = 0, msg = '\000' <repeats 255 times>}, depth = 0, valx = 0, values = { v_int = 41, v_uint = 41, v_long = 41, v_ulong = 41, v_ber_t = 41, v_string = 0x29 <Address 0x29 out of bounds>, v_bv = {bv_len = 41, bv_val = 0x7f796824a340 "cn=localhost,ou=Servers,dc=example,dc=com"}, v_dn = {vdn_dn = {bv_len = 41, bv_val = 0x7f796824a340 "cn=localhost,ou=Servers,dc=example,dc=com"}, vdn_ndn = {bv_len = 41, bv_val = 0x7f796812f730 "cn=localhost,ou=servers,dc=example,dc=com"}}, v_ad = 0x29}, rvalue_vals = 0x0, rvalue_nvals = 0x0, op = 0, type = 9, ca_op = 0x7f7968002670, be = 0x7f7968001a90, bi = 0x7f7968133e00, ca_entry = 0x0, ca_private = 0x0, cleanup = 0, table = Cft_Overlay} #8 0x0000000000449e01 in fe_op_add (op=0x7f7968002670, rs=0x7f797716ca40) at add.c:356 defref = 0xffffffffffffffff repl_user = 0 modtail = 0x7f796824e170 rc = 0 op_be = 0x18cb6f0 bd = 0x771660 textbuf = "`\275\023hy\177\000\000\320\375\210\001\000\000\000\000\000D\023hy\177\000\000%{F\000\000\000\000\000\220\307\026wy\177", '\000' <repeats 18 times>"\320, \307\026wy\177\000\000`\275\023hy\177\000\000\360'\000hy\177\000\000\220\307\026wy\177\000\000`\274\226wy\177\000\000\300\331\026wy\177\000\000\346L\337{y\177\000\000\a\000\000\000\000\000\000\000`\nw\000\000\000\000\000\260\307\026wy\177\000\000b\277D\000\000\000\000\000\020\310\026wy\177\000\000 \335$hy\177\000\000 \335$hy\177\000\000\030#\026hy\177\000\000\020\310\026wy\177\000\000{\244D", '\000' <repeats 13 times>, "\020\311\026wy\177\000\000`\312\026wy\177\000\000\000\000\000\000\001\000\000\000\320&\000hy\177\000\000\000\000\000\000\000\000\000\000"... textlen = 256 __PRETTY_FUNCTION__ = "esc != ((v" #9 0x000000000044967e in do_add (op=0x7f7968002670, rs=0x7f797716ca40) at add.c:205 bd = 0x7f797716c960 ber = 0x7f796c104f70 last = 0x7f796824a2a0 "" dn = {bv_len = 46, bv_val = 0x7f796824a1e8 "olcOverlay=autoca,olcDatabase={1}bdb,cn=config"} len = 60 tag = 18446744073709551615 modlist = 0x7f796813bbc0 modtail = 0x7f796824e170 tmp = {sml_mod = {sm_desc = 0x7f7968133b7f, sm_values = 0x7f796813bd60, sm_nvalues = 0x0, sm_numvals = 0, sm_op = 0, sm_flags = 0, sm_type = {bv_len = 13, bv_val = 0x7f796824a266 "olcACAlocalDN"}}, sml_next = 0x0} textbuf = "\177;\023hy\177\000\000\360\067\022ly\177\000\000\a\000\000\000\000\000\000\000\377\377\377\377\377\377\377\377\300\311\026wy\177\000\000\223\252\275{y\177\000\000P\000\000\000\000\000\000\000p;\023hy\177\000\000\260+\000hy\177", '\000' <repeats 18 times>"\260, +\000hy\177\000\000+|K\000\000\000\000\000\200\313\026wy\177\000\000\200\313\026wy\177\000\000\376\241\275{\001\000\000\000 \312\026wy\177\000\000\n}K\000\000\000\000\000\001\000\000\000\002\000\000\000\200\313\026wy\177\000\000\001\000\000\000\001\000\000\000\000\000\020", '\000' <repeats 13 times>"\260, +\000hy\177\000\000\260+\000hy\177\000\000\200\313\026wy\177\000\000\360+\000hy\177\000\000_\036{\257\000\000\000\000 \312\026wy\177\000\000\v\371C\000\000\000\000\000\200\313\026wy\177\000\000\346"... textlen = 256 rc = 0 freevals = 0 oex = {oe = {oe_next = {sle_next = 0x0}, oe_key = 0x448988}, oe_db = 0x0} #10 0x000000000043fe42 in connection_operation (ctx=0x7f797716cb80, arg_v=0x7f7968002670) at connection.c:1163 rc = 80 cancel = 152257809 op = 0x7f7968002670 rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = 0, sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}, sru_sasl = {r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} tag = 104 opidx = SLAP_OP_ADD conn = 0x18f9e10 memctx = 0x7f7968002bb0 memctx_null = 0x0 memsiz = 1048576 __PRETTY_FUNCTION__ = "on_write(%ld): no con" #11 0x00000000004403ea in connection_read_activate (s=0) at connection.c:1321 rc = 32633 #12 0x0000000000000008 in ?? () No symbol table info available. #13 0x00007f797716cb80 in ?? () No symbol table info available. #14 0x00007f7968002670 in ?? () No symbol table info available. #15 0x0000000000000000 in ?? () No symbol table info available. (gdb) -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Status of ldap_init_fd and LDAP_PROTO_EXT?
by Volker Lendecke 15 Apr '17

15 Apr '17

Hi! What's the status of those two? They are mentioned in the manpages of for example Debian Jessie and FreeBSD 11 (maybe from ports?), but the manpage explicitly says you have to #include <ldap_pvt.h>, which is not shipped. What's the reason of them being in ldap_pvt.h? Are they supposed to change in the future? The function is now more than 10 years old, without too much change in that decade. Not being able to fully asynchronously connect to a server was my main reason to start my own little ldap library a few years ago, so I think this can be useful code :-) Thanks, Volker

1 0

ITSes to review for 2.4.45
by Quanah Gibson-Mount 14 Apr '17

14 Apr '17

The following ITSes look like candidates for 2.4.45, and have patches provided: 8427 8376 (Patch URL <ftp://ftp.openldap.org/incoming/howard-guo-160222.patch>) 8349 8037 7721 7520 (Patch no longer on dropbox, but Symas still has it available) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Storing TLS credentials in the directory
by Howard Chu 11 Apr '17

11 Apr '17

Quanah Gibson-Mount wrote: > --On Sunday, April 09, 2017 9:57 PM +0100 Howard Chu <hyc(a)symas.com> wrote: > >> You cannot write a decent design from scratch. It's important to have a >> baseline of functionality to get an idea of scope. The current overlay >> provides that baseline. > > Some immediate things I see after reading the man page for the current autoca > are: > > a) Not going to work well for databases that use "" as a suffix, and then > support multiple domains beneath that (Zimbra had many customers that did > this. One customer handled 10k unique top level domains.) > > b) Related to the above, importing CA's for those customer domains would fail > (because they aren't located in the suffix) I figured you would mention that. None of those are a target use case. If you're running infrastructure for a lot of different domains, you are probably already using some other full-blown CA. My primary use for this is quick setup within a single domain. Typically for private networks. No web browser is going to recognize an auto-generated CA cert, so it's not really suited for (nor intended for) certificates that will be used by a general public. > c) While there is an option to specify the keysize, there is no option to > specify the digest to use. There should be a note on what the default digest > is, and an option to use other digests. With Zimbra, we had a default of > sha256, and options of ripemd160, sha, sha1, sha224, sha256, sha384, sha512 Could add that. It uses whatever the OpenSSL default algorithm is, currently sha256. > d) I don't see a mechanism for creating star certs, which can be fairly > critical. I also don't see a mechanism for doing multiple DNS names, which > can be critical for a server with several CNAMES names. Again, unlikely for private setups. But if you can suggest an attribute that the overlay can read to retrieve multiple DNS names it could of course be added. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Storing TLS credentials in the directory
by Quanah Gibson-Mount 11 Apr '17

11 Apr '17

--On Sunday, April 09, 2017 9:57 PM +0100 Howard Chu <hyc(a)symas.com> wrote: > You cannot write a decent design from scratch. It's important to have a > baseline of functionality to get an idea of scope. The current overlay > provides that baseline. Some immediate things I see after reading the man page for the current autoca are: a) Not going to work well for databases that use "" as a suffix, and then support multiple domains beneath that (Zimbra had many customers that did this. One customer handled 10k unique top level domains.) b) Related to the above, importing CA's for those customer domains would fail (because they aren't located in the suffix) c) While there is an option to specify the keysize, there is no option to specify the digest to use. There should be a note on what the default digest is, and an option to use other digests. With Zimbra, we had a default of sha256, and options of ripemd160, sha, sha1, sha224, sha256, sha384, sha512 d) I don't see a mechanism for creating star certs, which can be fairly critical. I also don't see a mechanism for doing multiple DNS names, which can be critical for a server with several CNAMES names. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Storing TLS credentials in the directory
by Howard Chu 10 Apr '17

10 Apr '17

Michael Ströder wrote: > Howard Chu wrote: >> Turbo Fredriksson wrote: >>> Everything I’ve seen about the subject is so darn _complex_! It shouldn’t HAVE >>> to be. >> >> Indeed, there's no reason for it. > > Hmm, every time in a customer encryption/PKI project the customer requested that it > should be secure *and* easy to use. This is kind of a contradiction to begin with. Bootstrapping is usually the hardest part. That's the part I've focused on making easier. > > Also this short discussion already oversimplifys all the possible use-cases and > considerations when talking about storing/using/protecting private keys. Personally I'd > never use such a autoca overlay running on the "normal" directory server. (Over)simplification is exactly what is needed, most of the time. > So every technical design should start with a decent description of the use-cases or will > blatantly fail. This will lead to reviewing which name spaces have to be put in which > naming extension for which usage and who is authorized to use the keys and issue certs. > Simply starting with schema for private key storage is putting the cart before the horse. You cannot write a decent design from scratch. It's important to have a baseline of functionality to get an idea of scope. The current overlay provides that baseline. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 2

Re: Storing TLS credentials in the directory
by Howard Chu 10 Apr '17

10 Apr '17

Turbo Fredriksson wrote: > On 9 Apr 2017, at 17:55, Howard Chu <hyc(a)symas.com> wrote: >>> 2) What if I want a new certificate for that RDN? >>> Such as the previous one is [about to] expire and it needs to be >>> refreshed (preferably (?) without destroying/removing the old one). >> >> Currently you would have to delete the old one first. > > Ok, thanx. Not that big a’ deal I guess. I've noted this in the manpage now. > >>> 3) Is the CAs _public_ key available as well? >>> Same reason as point 1. >> >> If the overlay generated it, then it is stored in cACertificate;binary in the suffix entry of the database. > > Awesome! Update the man page about this as well then :) Done. > >>> 4) If I already have a CA “on premises” and that have created an >>> intermediate CA I’d like to use for “autoca”, could this be done? >> >> You can replace cACertificate;binary and cAPrivateKey;binary of the suffix entry to force this. > > I see, that’s quite smart! So they’re writable, not just read-only then. > This should probably also be documented. > > Is that true for userCertificate and userPrivateKey as well? Yes. Also noted in the manpage. If you're running git master, you can look at test066-autoca and see how it works. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel April 2017