openldap-devel

openldap-devel@openldap.org

1443 discussions

Trivial build fixes for addpartial
by Buchan Milne 16 Oct '08

16 Oct '08

I should have reported this when I first enabled addpartial (but it was most likely near distribution release time ...), but I had patched the Makefile to build more sanely: http://svn.mandriva.com/cgi- bin/viewvc.cgi/packages/cooker/openldap/current/SOURCES/openldap-2.4.8- addpartial-makefile.patch?revision=189682&view=markup Since some things have now been fixed (but others not), I had to re-diff to address the outstanding items: 1)-fPIC is required in LDFLAGS to build on x86_64 (I didn't check to see if there's a more portable way) 2)I don't see a reason to call the overlay addpartial-overlay, we all know it is an overlay. http://svn.mandriva.com/cgi- bin/viewvc.cgi/packages/cooker/openldap/current/SOURCES/openldap-2.4.8- addpartial-makefile.patch?revision=293664&view=markup Regards, Buchan

3 2

Re: commit: ldap/doc/man/man5 slapd-bdb.5
by Hallvard B Furuseth 15 Oct '08

15 Oct '08

hyc(a)OpenLDAP.org writes: > slapd-bdb.5 1.40 -> 1.41 > Add dbpagesize keyword for configuring DB file page sizes If I understand the DB doc correctly, a pagesize parameter which means "use the file system's block size" could also be useful, at least for data integrity. Unless that's already the default. -- Hallvard

2 8

Re: commit: ldap/libraries/libldap gssapi.c
by Hallvard B Furuseth 13 Oct '08

13 Oct '08

hyc writes: > gssapi.c NONE -> 1.1 > > ITS#5369 SASL/GSSAPi refactoring from Stefan Metzmacher <metze(a)samba.org> > and Rafal Szczeniak <mimir(a)samba.org>, with minor cleanups This is buggy: pkt_len is used uninitialized in sb_sasl_gssapi_decode(). guess_service_principal() is broken: It uses 'ret' uninitialized, as if a return value from malloc. It passes (buffer length - 1) instead of buffer length to snprintf, which I think fails for the (allow_remote && givenstr) case. snprintf() unnecessary anyway since the function can malloc the exact needed size. Also it's preferable to only use a string literal as format argument, so gcc can verify the printf (instead of warning that it can't). Format errors: OM_uint32 printed as %u, size_t/ber_len_t as %lu. Here is a draft patch. Untested. Note I've not looked at how this actually works, just how to get rid of warnings. http://folk.uio.no/hbf/OpenLDAP/gssapi.txt Finally, some header files should declare these functions: ldap_gssapi_bind_s(), ldap_int_gssapi_close(), ldap_int_gssapi_config(), ldap_int_gssapi_get_option(), ldap_int_gssapi_set_option(), ldap_pvt_sasl_generic_install(), ldap_pvt_sasl_generic_remove(), and be #included by bind.c, cyrus.c, gssapi.c, init.c, options.c, request.c. -- Regards, Hallvard

3 3

ldap_sasl_interactive_bind support
by Howard Chu 09 Oct '08

09 Oct '08

I think we need to move the lutil_sasl_interact stuff into libldap. Clients ought to be able to use libldap's SASL support without having to #include Cyrus's <sasl.h> themselves. Right now they're forced to write their own interact handlers and the handlers must know about the SASL_CB constants etc. This is ugly; callers shouldn't need to know anything about what the underlying SASL implementation is doing. Actually the lutil_sasl_ code should be cleaned up a bit, not used in libldap as-is. In particular, we should define a callback whose only purpose is to display a provided prompt string and retrieve user input. This callback's interface must have zero dependencies on <sasl.h>. We can provide a generic callback that writes to stderr and uses getpassphrase, but callers should be able to replace this with GUI dialog callbacks etc. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: RE24 final testing
by Brett ＠Google 09 Oct '08

09 Oct '08

> Ok, please proceed with testing RE24. Solaris 10 test OK using native gcc compiler in /usr/sfw/bin. had to use --disable-perl and --disable-slapi to solve compiler issues - but this is not unusual / or a regression, i think for Solaris 10 the build process still assumes a sun compiler in a few places (although CC=gcc and sun compiler not installed, so should not) -bash-3.00$ gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) -bash-3.00$ uname -a SunOS mytesthost 5.10 Generic_127111-11 sun4v sparc SUNW,Sun-Fire-T200

1 1

Re: RE24 final testing
by Quanah Gibson-Mount 08 Oct '08

08 Oct '08

--On Tuesday, October 07, 2008 9:57 AM +1000 brett.maxfield(a)gmail.com wrote: > are all (test050 etc.,) changes comitted to RE24 cvs now? > > i was running on suse 10.3 dual core xen kernel about 12h ago and had > a failure.. i will re-test tonight > > checked out vanilla re24 with bdb 4.7 + patches. Hold off a little bit, the latest ITS fix has revealed some other long-standing bugs. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

7 11

StartTLS URL extension
by Howard Chu 07 Oct '08

07 Oct '08

We really ought to have a way to allow clients to make libldap use StartTLS without having to code their own calls into libldap for that purpose. I think it would be useful to allow specifying StartTLS in the extension field of the LDAP URL. Then at least it can be configured into ldap.conf forgotten about. The code for ldap_initialize() should look for the URL extension field, and act on it if StartTLS / 1.3.6.1.4.1.1466.20037 is present. Any comments? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

6 15

RE24 final testing
by Quanah Gibson-Mount 06 Oct '08

06 Oct '08

RE24 has been tagged for OpenLDAP 2.4.12. The only major change since the previous testing request is the fix for the test050 issues that had been seen and ITS#5728. Unless someone turns up a major regression, current RE24 will got out as-is. All tests pass for me on CentOS 5.2 64-bit, using BDB 4.7.25+patches. --Quanah

1 1

Re: StartTLS URL extension
by Howard Chu 06 Oct '08

06 Oct '08

William A. Rowe, Jr. wrote: > Howard Chu wrote: >> We really ought to have a way to allow clients to make libldap use >> StartTLS without having to code their own calls into libldap for that >> purpose. I think it would be useful to allow specifying StartTLS in the >> extension field of the LDAP URL. Then at least it can be configured into >> ldap.conf forgotten about. >> >> The code for ldap_initialize() should look for the URL extension field, >> and act on it if StartTLS / 1.3.6.1.4.1.1466.20037 is present. >> >> Any comments? > > What would be the syntax and mechanism for defining client certificates > or permitted server CA chains? The same as currently exists. None of those details are parameters of the actual StartTLS exop so they're not relevant to this discussion. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Enforcing attribute ACL on add operations
by manu＠netbsd.org 04 Oct '08

04 Oct '08

Hello Right now, slapd ignore attribute ACL when performing an add operation. If you have privilegied users that can add entries, it means that you can prevent them from modifying attributes in existing entries, but you cannot prevent them from adding an entry with a read-only attribute. The problem can be interesting with an attribute such as authzTo, where the whole access control can be circumvented by any user that can create an entry in the tree. IMO this behavior was not intended, but if it was, then it should be clearly documented. Below is a patch that cause attribute ACL to be checked for add operations. It is done in the backend, so if it is acceptable, then I will have to do it for other backends. I wonder if the modrdn operation shoulnd't be subject to the same sanity checks. Any thought? Does it look right? diff -U2 -r1.174 add.c --- servers/slapd/back-bdb/add.c 26 Aug 2008 23:45:35 -0000 1.174 +++ servers/slapd/back-bdb/add.c 27 Sep 2008 15:54:58 -0000 @@ -300,4 +300,22 @@ } + /* + * Check ACL for attribute write access + */ + if (!acl_check_modlist(op, oe, op->ora_modlist)) { + switch( opinfo.boi_err ) { + case DB_LOCK_DEADLOCK: + case DB_LOCK_NOTGRANTED: + goto retry; + } + + Debug( LDAP_DEBUG_TRACE, + LDAP_XSTRING(bdb_add) ": no write access to attribute\n", + 0, 0, 0 ); + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + rs->sr_text = "no write access to attribute"; + goto return_results;; + } + if ( eid == NOID ) { rs->sr_err = bdb_next_id( op->o_bd, &eid ); -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

4 22

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel