hyc(a)symas.com wrote in ITS#8240:
> Our patch response was too hasty. There is no OpenLDAP bug here, the real
> issue is production binaries being built with asserts enabled instead of
> compiling with -DNDEBUG. That's an issue for packagers and distros to resolve.
> Closing this ITS, not an OpenLDAP bug.
Maybe I missed something. But this is the first time I've heard about -DNDEBUG
being mandatory when compiling binary packages for production use. Does it
have other effects?
…
[View More]And what are general rules for assert statements in OpenLDAP code?
In my own (Python) code assert statements are supposed to be only triggered if
something goes wrong *internally* (type issues etc.). If somebody manages to
trigger an assert statement with invalid input from "outside" I always
consider this to be a serious bug revealing insufficient error handling even
though e.g. web2ldap just logs the exception but won't crash. YMMV, but please
clarify.
I also wonder whether there are more mandatory rules for building packages and
where I can find them.
Please don't get me wrong: My inquiry is in good faith to avoid unnecessary
ITS based on misunderstanding.
Ciao, Michael.
[View Less]
Dealing with ITS#9015 has lead me to question part of the ITS#8281 fix
in cd8ff37629012c1676ef79de164a159da9b2ae89 - the part that refuses to
generate a contextCSN on a DB without one.
When syncprov is adopting a database that has never been managed by it,
it will only generate a new contexCSN if it's a standalone master (its
serverID is zero and replicates from noone). But people can and do add a
new database on a multimaster node expecting things to work OK, not
something that happens now, …
[View More]even worse, we can lie to the consumer and
say the DB is empty just because its contextCSN is.
AFAIK, the root cause of ITS#8281 (as reported) was diagnosed to be two
servers with the same serverID - not something we can or want to
support.
So my reaction is to make sure we always have a contextCSN (doesn't have
to contain our own serverID yet), generating it if not unless we're
running with SLAP_SINGLE_SHADOW(be) which means we might be a cascading
replica.
Is there a scenario that would break things? How about starting with an
empty DB, should we still put a contextCSN there?
Thanks,
--
Ondřej Kuzník
Senior Software Engineer
Symas Corporation http://www.symas.com
Packaged, certified, and supported LDAP solutions powered by OpenLDAP
[View Less]
Hi Quanah,
On Sun, 21 Apr 2019 at 8:26 am, Quanah Gibson-Mount wrote:
> As it is a feature request and not a bug fix, it may be a while as we're
> currently working on getting the OpenLDAP 2.4 series (feature frozen)
> wrapped up. At that point we can spend a bit more time on planning what
> open feature requests will make their way into the next release series
> (2.5).
Thank you for the update. I had no idea the project was in a feature
freeze, as the information doesn’t …
[View More]seem to be anywhere on the website.
On that point, are there any plans/ideas to move to bugzilla or even
github/gitlab for development? The ITS isn’t the most user friendly
platform around.
> Hugh
[View Less]
Hi Michael,
I'm looking at the patches SuSE applies to OpenLDAP, and it would be nice
to have some engagement from SuSE on kicking some of these back,
particularly something like 0017-Fix-segfault-in-nops.patch, which it
appears is to address ITS#8759. Do you know what we need to do on our end
to encourage SuSE to contribute back to the community?
--Quanah
--
Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
Some of these items are RE24 + master, a couple are master only. Some are
for LMDB, not sure if they should be 0.9+master or master only.
-------------------------------------------------------------------
The following ITSes have a patch or have been committed already.
-------------------------------------------------------------------
ITS#8875 - back-mdb - fix performance problems with large DIT and many
aliases (has patch)
ITS#8864 - liblber - fix ber_flush
(…
[View More]fb49d486a35fd4b2e993398c1eea0c8f7bc6ac40)
ITS#8508 - liblunicode - Fix ucgendat
(cc99da182f53d3d4f3874703643b277773717af3)
ITS#8167 - libldap - fix non-blocking TLS
(46c93e41f43da7f16270179c6eff75e450617329)
ITS#8037 - slapd - Fix delta-syncrepl with relax
(cb9a4d01bc1ecf1eeb3fb7ef39067b2b30b6c545)
ITS#7721 - contrib/lastbind - allow authtimestamp forwarding with updateref
(44e9bda0e42f40e0baf0a2c0ef733eb757abd366)
ITS#7770 - back-monitor - Add mdb_stat info
(e19c683c41e14365d28e82278eec1d8b12c71d4c ,
6e2bac6465bb81a8c1aeb083b6dc497eb4187264 )
ITS#8841 - back-meta - Fix assertion if the network interface goes down
(17f1e32b65c332f7a33b77ebe6e20b47188a88aa)
ITS#8999 - slapd - Fix telephoneNumberNormalize, cert DN validation
(d8c90a2feebb9eeecc69cd0c4411f51cb75a7dbb,
8b7f21c7aa8c99065977b3dd4eb41f9f41eeadde)
ITS#8695 - slapd -"sleep" is deprecated (WINDOWS ONLY) (has patch)
ITS#8637 - slapd-ldap - Correctly reject invalid config with slapd-config
(has patch)
ITS#8674 - libldap - Fix leak (has patch)
ITS#7996, ITS#8450 - libldap - Fix race condition (has patch)
ITS#8427 - slapd/syncrepl - Fix broken behavor for TLS options (has patch)
ITS#8417 - liblmdb - Add -T option to mdb_load to specify the mapsize (has
patch)
ITS#8739 - liblmdb - Fixes fsync check on FreeBSD (has patch)
ITS#8748 - liblmdb - New feature for write ops (has patch, IPR OK)
ITS#8754 - libldap - Correctly ignore IPv6 if IPv6 is disabled (has patch)
ITS#8671 - libldap - ldap_init_fd() in ldap.h (has patch, for Samba project)
ITS#7042 - slapd/syncrepl - Allow disconfiguring TLS settings (has patch)
ITS#8794 - libraries/libldap - Fix implicit declaration (has minor patch)
ITS#9001 - libraries/libldap - Use new Tavl bits to reduce search time (has
patch)
ITS#9008 - slapd-modules - Fix rpath in module builds (has patch)
ITS#8997 - slapd-ldap - Fix segfault (Howard already wrote the patch, just
needs to be committed)
-------------------------------------------------------------------
The following commits have no associated ITS, but apply to RE24
-------------------------------------------------------------------
3bda24173df9b071aafc7c3f294c17af3ea2c7d0 -- Do not leak memory in slappasswd
593512bb7b2b5d23a658d3a8d05bdeeb15d7611f -- Just the first commit (there is
significant divergence in the tests/slapd-progs between RE24 and master)
--Quanah
--
Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
[View Less]
-------------------------------------------------------------------
The following ITSes need fixes or other other action:
-------------------------------------------------------------------
ITS#8967 - back-mdb "unchecked" limits broken with particular search scopes.
ITS#8683 - back-meta documented feature hidden behind LDAP_DEVEL
ITS#8686 - back-hdb broken with some MODRDN ops
ITS#8691 - liblmdb segfault on shutdown (WINDOWS ONLY)
ITS#8693, ITS#8799 - conversion from slapd.conf to cn=…
[View More]config is broken for
slapo-chain
ITS#8694 - Missing event information for slapd (WINDOWS ONLY)
ITS#8698 - slapo-ppolicy broken with pwdCheckModule and extended password
modify op
ITS#8700 - build fails when slapd is disabled
ITS#8708 - SASL/EXTERNAL bind succeeds when it should fail
ITS#8721 - slapd-meta quarantine broken
ITS#8102 - slapd/syncrepl - Mutex issues causing null_callback and other
issues
ITS#8743 - slapd-meta - Reject invalid slapd.conf -> cn=config conversion
ITS#8751 - slapd-meta - deref aliases is broken
ITS#8755 - libldap - leaking file descriptor when closing connection
ITS#8768 - slapd/syncrepl - New cookie being sent incorrectly
ITS#8788 - slapo-pcache - Fix pcache initialization, and documentation
update?
ITS#8790 - slapd/syncrepl N-way MMR w/o serverID in at least one entry can
destroy the MMR cluster (MAJOR BUG), see also ITS#8789
ITS#9002 - slapcat - Add option to honor rtxnsize setting
ITS#8998 - ldap.conf/.ldaprc - SASLNOCANON breaks ldapi:// URI
--
Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
[View Less]