openldap-devel

openldap-devel@openldap.org

1416 discussions

RE24 (2.4.23) testing call #2
by Quanah Gibson-Mount 21 Jun '10

21 Jun '10

This should be the final testing call prior to release. Only change is a fix to slapo-refint for ITS#6572. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

4 8

Re: commit: ldap/servers/slapd/back-bdb cache.c
by Quanah Gibson-Mount 21 Jun '10

21 Jun '10

--On Sunday, June 20, 2010 7:28 PM +0000 hyc(a)OpenLDAP.org wrote: > Update of /repo/OpenLDAP/pkg/ldap/servers/slapd/back-bdb > > Modified Files: > cache.c 1.216 -> 1.217 > > Log Message: > ITS#6577 potential fix, found using valgrind/drd. please test. Didn't fix it. :/ Running 1 of 2000 iterations slapd-bind PID=30472: ldap_sasl_bind_s: Invalid credentials (49) slapd-addel PID=29838: ldap_delete_ext_s: No such object (32) matched: ou=People,dc=example,dc=com PID=29838 - Add/Delete done (32). <<< dnPrettyNormal: <cn=James A Jones 4,ou=People,dc=example,dc=com>, <cn=james a jones 4,ou=people,dc=example,dc=com> conn=1003 op=96 DEL dn="cn=James A Jones 4,ou=People,dc=example,dc=com" bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") hdb_referrals: tag=74 target="cn=James A Jones 4,ou=People,dc=example,dc=com" matched="ou=People,dc=example,dc=com" ==> hdb_delete: cn=James A Jones 4,ou=People,dc=example,dc=com slap_queue_csn: queing 0x4663f1c 20100620225300.281710Z#000000#000#000000 bdb_dn2entry("cn=james a jones 4,ou=people,dc=example,dc=com") <=- hdb_delete: no such object cn=James A Jones 4,ou=People,dc=example,dc=com send_ldap_result: conn=1003 op=96 p=3 send_ldap_result: err=10 matched="ou=People,dc=example,dc=com" text="" send_ldap_response: msgid=97 tag=107 err=32 ber_flush2: 41 bytes to sd 18 conn=1003 op=96 RESULT tag=107 err=32 text= slap_graduate_commit_csn: removing 0x8910e38 20100620225300.281710Z#000000#000#000000 [root@build28 tests]# diff -u testrun/ldapsearch.flt testrun/ldif.flt --- testrun/ldapsearch.flt 2010-06-20 15:54:05.291229451 -0700 +++ testrun/ldif.flt 2010-06-20 15:54:05.375908287 -0700 @@ -308,25 +308,6 @@ facsimileTelephoneNumber: +1 313 555 8688 telephoneNumber: +1 313 555 7334 -dn: cn=James A Jones 4,ou=People,dc=example,dc=com -objectClass: OpenLDAPperson -cn: James A Jones 4 -cn: James Jones -cn: Jim Jones -sn: Jones -uid: jaj -postalAddress: Alumni Association $ 111 Maple St $ Anytown, MI 48109 -seeAlso: cn=All Staff,ou=Groups,dc=example,dc=com -userPassword:: OiBhbUZx -homePostalAddress: 3882 Beverly Rd. $ Anytown, MI 48105 -homePhone: +1 313 555 4772 -description: Outstanding -title: Mad Cow Researcher, UM Alumni Association -pager: +1 313 555 3923 -mail: jaj(a)mail.alumni.example.com -facsimileTelephoneNumber: +1 313 555 4332 -telephoneNumber: +1 313 555 0895 - dn: cn=Jane Doe,ou=Alumni Association,ou=People,dc=example,dc=com objectClass: OpenLDAPperson cn: Jane Doe --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE24 testing call (2.4.23)
by Quanah Gibson-Mount 19 Jun '10

19 Jun '10

Please test RE24. Thanks! --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

6 10

syncrepl suffixmassage
by Howard Chu 18 Jun '10

18 Jun '10

We've talked about this before; it would be nice for the consumer to be able to pull updates from a different suffix on the provider than the one in use on the consumer. Just attaching the rwm overlay is not straightforward, since that expects to sit on a database and the consumer's queries are sent through direct LDAP calls. A potential kludge for this would be to rewrite all of the consumer client code in terms of backend calls through a back-ldap instance. That seems a little heavy-handed though. Another possibility may be to just expose some of the rwm overlay's entry points so the consumer can call them explicitly, faking enough of the context so we can call suffixmassage config. Suggestions? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

Re: RE24 testing call (2.4.23)
by Gavin Henry 12 Jun '10

12 Jun '10

----- "Quanah Gibson-Mount" <quanah(a)zimbra.com> wrote: > Please test RE24. Fine here on Fedora 12 i686 still on 4.7.25. Have you tried bdb 5.0.21 or is 4.8.30 recommended? I need to update the docs on all recommended versions plus what's outstanding in ITS: http://www.openldap.org/doc/admin24/appendix-recommended-versions.html Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

4 4

CERT Fuzzing Framework
by Howard Chu 27 May '10

27 May '10

http://threatpost.com/en_us/blogs/cert-releases-basic-fuzzing-framework-052… Would be interesting to have a tool that can generate random data at arbitrary points in an LDAP session. Before Bind is the most obvious case, which we've tested many times before. But what about after a session has already been fully authenticated? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Add-if-not-present
by masarati＠aero.polimi.it 27 May '10

27 May '10

I need to implement a modify operation whose semantics is "add if not present", an add that only takes place if that attribute is not yet present in the entry. I need it as an internal operation, so right now I wouldn't bother formalizing it as an extension of the semantics of the modify operation. Something like the SLAP_MOD_SOFTADD, which in turn consists in adding an attribute value only if that value is not already present. I'd introduce a SLAP_MOD_ADD_IF_NOT_PRESENT flag and add code to support it in all (well, most) backends/overlays that need to muck with modify operation type. Comments? Objections? p.

4 14

slapo-allowed: allowedChildClasses and allowedChildClassesEffective (was: Seg faults with 2.4.22)
by Michael Ströder 28 Apr '10

28 Apr '10

Redirected this to openldap-devel... masarati(a)aero.polimi.it wrote: > slapo-allowed was modified between 2.4.21 and 2.4.22; support for > allowedChildClasses and allowedChildClassesEffective was added. The semantics you've implemented seems to be incompatible with my implementation in web2ldap which works correctly with MS AD. I do not claim to know the *exact* semantics of these attributes though. web2ldap only uses the attribute 'allowedChildClasses'. In the object class select form web2ldap now only shows an empty list of STRUCTURAL object classes to be usable for a new entry. AUXILIARY object classes are shown. At first glance it seems STRUCTURAL object classes are not returned by slapo-allowed in the search result at all. Ciao, Michael.

2 5

OpenLDAP 2.5
by Howard Chu 28 Apr '10

28 Apr '10

With 2.4.21 out, and hopefully stable enough to promote to the next Stable release, it's time to feature-freeze 2.4 and prepare for the 2.5 branch. As I already announced to the OpenLDAP-Committers, we're also planning to switch from CVS to GIT in mid-January. Commits for 2.5 will begin after we've settled into GIT. We haven't really laid out a formal roadmap for 2.5 yet, but I think most of it has been discussed here or in Development ITSs already. I would like to be able to resolve all outstanding Development ITSs - we will either implement them or reject/close them. There are 42 outstanding at the moment. Likewise for all outstanding ITSs in Software Bugs - many of them have been deferred because a proper fix would require invasive changes to large parts of the code base. There are 26 outstanding. With 2.5 beginning we are free to make these large scale changes. We should also walk thru the Software Enhancement requests and decide which to accept and which to reject. Currently there are 37 outstanding. I also have a number of specific areas I want to see worked on; some of these are included in the above ITSs but I'll outline them here: syncrepl config - this is pretty unwieldy already; syncrepl needs to be moved outside of the slapd core and into an overlay. That will allow us a lot more flexibility in configuring while also eliminating a lot of redundant parsing code. suffixmassage - we at the very least need to be able to point a consumer at some non-homogeneous suffix in the provider. We may go for complete librewrite support as well, although at this point I don't see as strong a need. config TLS certs and keys should be stored as LDAP attributes, not pointers to filesystem locations. This is a prereq to using some of the dynamic cert generation features of the CA overlay. (This can be troublesome as there may not be clean APIs for reading certs from memory in all of the TLS APIs we support.) Disabling individual config attribute values and entries. At the moment I'm thinking of adding an ";x-disabled" tag to those values. back-mdb Using a single-level store for Entries will impact all of the schema engine as well. I think the simplest solution here is going to be using an mmap'd file for all of the schema elements. The actual design of back-mdb still needs to be defined in several areas. The single-level store approach exposes us to some new failure modes that the current multi-level backends don't have. (E.g., corruptions due to bad RAM / wild pointer writes are very likely to get persisted on disk, implicitly.) The solution I'm considering is based on a mirroring strategy. Every database will be stored twice on disk: once in the file that is actively mmap'd into the process, and once in a write-only file. On every intentional update of a memory page, we will also store a checksum of the page, and manually write the page to the mirror. If we detect a checksum failure on any in-memory page we can still retrieve a valid copy from the mirror file. This of course doubles our potential I/O load, but I don't believe it's any worse than the load from performing write-ahead logging on a traditional database. (And yes, mirroring will take the place of writing transaction log files.) Some of these same considerations apply to the schema storage, but not entirely. At runtime, the schema is effectively read-only. When we do dynamic schema changes thru cn=config, all other threads are suspended. For the mmap purposes, we can mark all of the schema pages as read-only during runtime, and only make them read-write when cn=config is actually trying to perform an update. As such, the only sticky issue is dealing with changes made to the back-config internal files by plain text editors and such. These are the things I'm interested in. But as always, this Project is driven forward by the particular interests of each individual contributor. If you have other ideas you want to pursue, speak up. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

9 13

RE24 call for testing (round 1)
by Quanah Gibson-Mount 22 Apr '10

22 Apr '10

Please test RE24 in preparation for 2.4.22. Currently it all builds for me, and the only test failure I've had is for test022 (ppolicy). It happened in 36/100 runs, not sure what is going on there. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

5 5

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel