openldap-devel

openldap-devel@openldap.org

1416 discussions

Drop support for GNUTLS and libnss in 2.5?
by Michael Ströder 22 Jul '19

22 Jul '19

HI! IMHO OpenLDAP project should drop support for building against GNUTLS and libnss. Support for these seems to be largely non-existent and it's a waste of time, especially since there is no build pipeline and no automatic testing for all the variants. The support for libnss was done by RedHat for the unified crypto project which is AFAICS obsolete. Does anybody maintain the stuff? The support for GNUTLS was requested by Debian folks because of OpenSSL licensing paranoia. Does anybody maintain the stuff? The question is whether this is still revelavant with OpenSSL 3.0.0 moving to Apache-2.0 license [1]. [2] says APL-2.0 is not compatible with GPLv2 though. Ciao, Michael. [1] https://www.openssl.org/blog/blog/categories/license/ [2] https://www.gnu.org/licenses/license-list.html#apache2

4 5

back_ldap / TLS Issues with OPENLDAP_REL_ENG_2_4_48
by Nikos Voutsinas 21 Jul '19

21 Jul '19

Hi all, In the view of the new openldap release, I ran some tests by using the current snapshot of the OPENLDAP_REL_ENG_2_4_48 tree and based on my findings It seems that this build breaks the back_ldap backend when it is used with a remote ldaps:/// server. In particular, the following snippet of proxy bind configuration, which works on the same system, with the same remote ldaps:/// server / certificate and the 2.4.47 release, fails with the engineering release of 2.4.48. The testing environment was a Debian (Stable/Buster) and Openldap was compiled with the Debian's gnu TLS libs. Based on my previous experience I would have bet that this is a GNU TLS issue, however this seems to be a different case considering that the error happens only with the switch from the 2.4.47 to 2.4.48. Could this be another side effect of the related to ITS#8427 fixes? dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {2}back_ldap olcModuleLoad: rwm dn: olcOverlay={0}rwm,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmRewrite: rwm-rewriteContext "bindDN" olcRwmRewrite: rwm-rewriteRule "^academicID=([^,]+),ou=People,dc=acme" "academicID=$1,cn=authn" ":@I" dn: olcDatabase={3}ldap,cn=config changetype: add objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcAccess: to * by * manage olcSuffix: cn=authn olcRootDN: cn=admin,cn=authn olcRootPW: {SSHA}<REMOVED> olcDbURI: ldaps://remote-authn.acme.foo:636 dn: olcOverlay={0}rwm,olcDatabase={3}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmRewrite: rwm-rewriteContext "bindDN" olcRwmRewrite: rwm-rewriteRule "^academicID=([^,]+),cn=authn" "academicID=$1,ou=People,dc=acme" ":@I" The debug output shows the following: 5d32a159 <<< dnPrettyNormal: <academicID=E2Q4KXGLNSPLB25T8TLLT5,ou=People,dc=acme>, <academicID=e2q4kxglnsplb25t8tllt5,ou=people,dc=acme> ldap_create ldap_url_parse_ext(ldaps://remote-authn.acme.foo:636) 5d32a159 =>ldap_back_getconn: conn=1000 op=0: lc=0x7f10ac12abc0 inserted refcnt=1 rc=0 ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP remote-authn.acme.foo:636 ldap_new_socket: 16 ldap_prepare_socket: 16 ldap_connect_to_host: Trying <IP of remote-authn.acme.foo>:636 ldap_pvt_connect: fd: 16 tm: -1 async: 0 attempting to connect: connect success tls_write: want=337, written=337 0000: 16 03 01 01 4c 01 00 01 48 03 03 57 00 4d a5 80 ....L...H..W.M.. 0010: d4 4b 71 8e 08 62 4f 7a b6 a9 4f 20 cd e3 04 9b .Kq..bOz..O .... 0020: 04 91 54 e8 78 9d 20 44 cd bd b3 00 00 3a 13 02 ..T.x. D.....:.. 0030: 13 03 13 01 13 04 c0 2c cc a9 c0 ad c0 0a c0 2b .......,.......+ .... .... TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). 5d32a169 send_ldap_result: conn=1000 op=0 p=3 5d32a169 send_ldap_result: err=52 matched="" text="Proxy operation retry failed" 5d32a169 send_ldap_response: msgid=1 tag=97 err=52 Best Regards, Nikos

6 32

Issues ISC dhcpd using libldap of OpenLDAP 2.4.48
by Michael Ströder 17 Jul '19

17 Jul '19

HI! I've tried the following without success: Disabled Link Time Optimization (LTO), recently introduced for openSUSE Tumbleweed, in packages openldap2 and dhcp-server. Just to make sure it does not cause any harm. Upstream update to dhcp 4.4.1 without any of openSUSE's back-port patches. dhcpd does not even contact the LDAP server. It seems there's some call into libldap failing and this is handled by dhcpd as connection error. FWIW: I've attached the strace output of the following command which does not say much: LDAPNOINIT=1 /usr/sbin/dhcpd -T I have no clues where to look now and I have to give up. Could someone review the source of dhcpd? The relevant files are ldap*.c: https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=tree;f=server Ciao, Michael. ------------------------- dhcpd.conf ------------------------------ ldap-server "127.0.0.1"; ldap-port 389; ldap-username "cn=host.example.com,ou=DHCP,example,dc=com"; ldap-password "host-secret"; ldap-base-dn "ou=DHCP,example,dc=com"; ldap-ssl off; ldap-method dynamic;

3 4

NO-USER-MODIFICATION for attribute type description memberOf
by Michael Ströder 11 Jul '19

11 Jul '19

HI! Currently attribute type description memberOf does not have NO-USER-MODIFICATION. memberof.c contains a commented line: /* "NO-USER-MODIFICATION " */ /* add? */ But it's my understanding that if the memberof overlay is responsible maintaining this attribute NO-USER-MODIFICATION should be added. Any objections against adding it? Ciao, Michael.

2 2

Persistent failures of test050
by Quanah Gibson-Mount 01 Jul '19

01 Jul '19

I've noticed that when running test050 in a loop, it often fails, even after increasing the sleep timeout defaults. Where it fails in the test is inconsistent and which servers differ is inconsistent as well. I'm concerned we may have a regression or perhaps long standing issue here that needs addressing. I'll continue to investigate and see if I can get more details on what the issue(s) are. In my latest run I see: ..... Using ldapmodify to add/modify/delete entries from server 1... iteration 1 iteration 2 iteration 3 iteration 4 iteration 5 iteration 6 iteration 7 iteration 8 iteration 9 iteration 10 Waiting 10 seconds for servers to resync... Using ldapsearch to read all the entries from server 1... Using ldapsearch to read all the entries from server 2... Using ldapsearch to read all the entries from server 3... Using ldapsearch to read all the entries from server 4... Comparing retrieved entries from server 1 and server 2... Comparing retrieved entries from server 1 and server 3... test failed - server 1 and server 3 databases differ Failed after 3 of 500 iterations [build@freebsd12 ~/git/openldap-2-4/tests/testrun]$ diff -u server1.out server3.out --- server1.out 2019-06-22 18:23:54.933600000 +0000 +++ server3.out 2019-06-22 18:23:55.049209000 +0000 @@ -1,3 +1,8 @@ +dn: cn=Add-Mod-Del,dc=example,dc=com +cn: Add-Mod-Del +objectClass: organizationalRole +description: guinea pig + dn: cn=All Staff,ou=Groups,dc=example,dc=com member: cn=Manager,dc=example,dc=com member: cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=exam --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 9

Current RE24 status (2.4.48)
by Quanah Gibson-Mount 28 Jun '19

28 Jun '19

Ondrej is looking at a few different issues related to replication w/ syncrepl, including cn=config. Additionally, the fix applied for ITS#8427 has broken back-ldap with ldaps. For the last item, one option would be to revert ITS#8427, although I'd prefer to see a fix rather than a revert. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

ITS review 6/14/2019
by Quanah Gibson-Mount 27 Jun '19

27 Jun '19

Thanks to Ondrej, this list is a bit shorter now. :) The following ITSes have a patch or have been committed already. ------------------------------------------------------------------- ITS#7721 - contrib/lastbind - allow authtimestamp forwarding with updateref (44e9bda0e42f40e0baf0a2c0ef733eb757abd366) ITS#7770 - back-monitor - Add mdb_stat info (e19c683c41e14365d28e82278eec1d8b12c71d4c , 6e2bac6465bb81a8c1aeb083b6dc497eb4187264 ) **** ITS#8037 - slapd - Fix delta-syncrepl with relax (cb9a4d01bc1ecf1eeb3fb7ef39067b2b30b6c545) ITS#8349 - Fix ppolicy behavior with pwdHistory ITS#8508 - liblunicode - Fix ucgendat (cc99da182f53d3d4f3874703643b277773717af3) **** ITS#8637 - slapd-ldap - Correctly reject invalid config with slapd-config (has patch, IPR OK) **** ITS#8671 - libldap - ldap_init_fd() in ldap.h (6a5e30674b63b17587738ba9a3d1ea3633c33fb1) ITS#8695 - slapd - "sleep" is deprecated (WINDOWS ONLY) (has patch, IPR OK) **** ITS#8755 - libldap - leaking file descriptor when closing connection (has patch, IPR OK) ITS#8794 - libraries/libldap - Fix implicit declaration (has minor patch) **** ITS#8799 - back-chain - Fix conversion from slapd.conf (has patch, IPR OK) **** ITS#8864 - liblber - fix ber_flush (fb49d486a35fd4b2e993398c1eea0c8f7bc6ac40) ITS#8875 - back-mdb - fix performance problems with large DIT and many aliases (has patch, RE25 only) **** ITS#8997 - slapd-ldap - Fix segfault (Howard already wrote the patch, just needs to be committed) ITS#9000 - slapo-memberof - Fix group rename issue (Ondrej has already written the patch, just needs to be committed?) -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 9

RE24 testing call (2.4.48) LMDB RE0.9 testing call (0.9.24)
by Quanah Gibson-Mount 25 Jun '19

25 Jun '19

This is expected to be the final testing call for 2.4.48, with an anticipated release, depending on feedback, during the week of 2019/06/24. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.48 Engineering Added libldap OpenSSL Elliptic Curve support (ITS#7595) Added libldap Expose OpenLDAP specific interfaces via openldap.h (ITS#8671) Added slapd-monitor support for slapd-mdb (ITS#7770) Fixed liblber leaks (ITS#8727) Fixed liblber with partial flush (ITS#8864) Fixed libldap ASYNC TLS so it works (ITS#8957,ITS#8980) Fixed libldap ASYNC connections with Solaris 10 (ITS#8968) Fixed libldap with SASL_NOCANON=on and ldapi connections (ITS#7585) Fixed libldap to use AI_ADDRCONFIG when available (ITS#7326) Fixed libldap to be able to unset syncrepl TLS options (ITS#7042) Fixed libldap race condition in ldap_int_initialize (ITS#7996, ITS#8450) Fixed libldap return code in ldap_create_assertion_control_value (ITS#8674) Fixed libldap to correctly disable IPv6 when configured to do so (ITS#8754) Fixed libldap to correctly close TLS connection (ITS#8755) Fixed libldap_r handling of deprecated OpenSSL function (ITS#8353) Fixed liblunicode case correspondance (ITS#8508) Fixed slapd with an idletimeout of less than four seconds (ITS#8952) Fixed slapd config parser variable for Windows64 (ITS#9012) Fixed slapd syncrepl fallback handling with delta-syncrepl (ITS#9015) Fixed slapd telephoneNumberNormalize, cert DN validation (ITS#8999) Fixed slapd syncrepl for relax with delta-syncrepl (ITS#8037) Fixed slapd TLS settings on reconnection (ITS#8427) Fixed slapd to restrict rootDN proxyauthz to its own databases (ITS#9038) Fixed slapo-accesslog with SLAP_MOD_SOFT modifications (ITS#8990) Fixed slapd-ldap starttls connections timeout behavior (ITS#8963) Fixed slapd-ldap TLS settings on reconnection (ITS#8427) Fixed slapd-ldap segfault when entry result doesn't match filter (ITS#8997) Fixed slapd-meta conversion from slapd.conf to cn=config (ITS#8743) Fixed slapd-meta TLS settings on reconnection (ITS#8427) Fixed slapd-meta assertion when network interface goes down (ITS#8841) Fixed slapd-mdb fix bitshift integer overflow (ITS#8989) Fixed slapd-mdb index cleanup with cn=config (ITS#8472) Fixed slapo-accesslog possible assert with exops (ITS#8971) Fixed slapo-chain to correctly reject multiple chaining URIs (ITS#8637) Fixed slapo-chain conversion from slapd.conf to cn=config (ITS#8799) Fixed slapo-memberof conversion from slapd.conf to cn=config (ITS#8663) Fixed slapo-memberof for group name change to itself (ITS#9000) Fixed slapo-ppolicy behavior when pwdInHistory is changed (ITS#8349) Fixed slapo-rwm to not free original filter (ITS#8964) Fixed slapo-syncprov contextCSN generation (ITS#9015) Build Environment Fixed slapd to only link to BDB libraries with static build (ITS#8948) Fixed libldap implicit declaration with LDAP_CONNECTIONLESS (ITS#8794) Documentation General - Fixed minor typos (ITS#8764, ITS#8761) admin24 - Miscellaneous updates promoting mdb and fixing examples (ITS#9031) slapd.access(5) - Note MDB is the primary backend (ITS#8881) slapd.backends(5) - Note MDB is the recommended backend (ITS#8771) slapd-ldap(5) - Document starttls parameter (ITS#8693) Contrib Added slapo-lastbind capability to forward authTimestamp updates (ITS#7721) LMDB 0.9.24 Engineering ITS#8969 Tweak mdb_page_split ITS#8975 WIN32 fix writemap set_mapsize crash ITS#9007 Fix loose pages in WRITEMAP --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

5 18

ITS#8286 continued
by Quanah Gibson-Mount 18 Jun '19

18 Jun '19

I found a few stray items that still need matching rules. All were trivially straight forward except one for slapo-chain: { "chain-chaining", "args", 2, 4, 0, ARG_MAGIC|ARG_BERVAL|CH_CHAINING, chain_cf_gen, "( OLcfgOvAt:3.1 NAME 'olcChainingBehavior' " "DESC 'Chaining behavior control parameters (draft-sermersheim-ldap-chaining)' " "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, At the moment, based on the man page description, I was thinking: "EQUALITY caseExactMatch " for the matching rule. Anyone have an opinion for caseIgnoreMatch being better? Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

ITS review 6/4/2019
by Quanah Gibson-Mount 13 Jun '19

13 Jun '19

All of the following have patches and need review/approval. Any with **** I consider desired for the next releases of LMDB & OpenLDAP: LMDB related ITSes ---------------------- **** ITS#8986 - Fix LMDB for FreeBSD12 (has patch, IPR OK) ITS#8739 - liblmdb - Fixes fsync check on FreeBSD (has patch, IPR not needed) OpenLDAP related ITSes for RE24 ------------------------------- ITS#7042 - slapd/syncrepl - Allow disconfiguring TLS settings (has patch, IPR OK) ITS#7721 - contrib/lastbind - allow authtimestamp forwarding with updateref (44e9bda0e42f40e0baf0a2c0ef733eb757abd366) ITS#7770 - back-monitor - Add mdb_stat info (e19c683c41e14365d28e82278eec1d8b12c71d4c , 6e2bac6465bb81a8c1aeb083b6dc497eb4187264 ) **** ITS#7996, ITS#8450 - libldap - Fix race condition (has patch, IPR OK) **** ITS#8037 - slapd - Fix delta-syncrepl with relax (cb9a4d01bc1ecf1eeb3fb7ef39067b2b30b6c545) **** ITS#8167 - libldap - fix non-blocking TLS (46c93e41f43da7f16270179c6eff75e450617329) ITS#8349 - Fix ppolicy behavior with pwdHistory **** ITS#8427 - slapd/syncrepl - Fix broken behavor for TLS options (has patch, IPR OK) ITS#8508 - liblunicode - Fix ucgendat (cc99da182f53d3d4f3874703643b277773717af3) **** ITS#8637 - slapd-ldap - Correctly reject invalid config with slapd-config (has patch, IPR OK) **** ITS#8671 - libldap - ldap_init_fd() in ldap.h (has patch, for Samba project, IPR OK) **** ITS#8674 - libldap - Fix leak (has patch, IPR not needed) ITS#8695 - slapd - "sleep" is deprecated (WINDOWS ONLY) (has patch, IPR OK) ITS#8754 - libldap - Correctly ignore IPv6 if IPv6 is disabled (has patch) **** ITS#8755 - libldap - leaking file descriptor when closing connection (has patch, IPR OK) ITS#8794 - libraries/libldap - Fix implicit declaration (has minor patch) **** ITS#8841 - back-meta - Fix assertion if the network interface goes down (17f1e32b65c332f7a33b77ebe6e20b47188a88aa) **** ITS#8864 - liblber - fix ber_flush (fb49d486a35fd4b2e993398c1eea0c8f7bc6ac40) **** ITS#8997 - slapd-ldap - Fix segfault (Howard already wrote the patch, just needs to be committed) **** ITS#9001 - libraries/libldap - Use new Tavl bits to reduce search time (has patch, IPR OK) OpenLDAP related ITSes for RE25 ------------------------------- ITS#8875 - back-mdb - fix performance problems with large DIT and many aliases (has patch) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

← Newer
1
...
6
7
8
9
10
11
12
...
142
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel