openldap-technical

openldap-technical@openldap.org

9 participants
9866 discussions

2.4.44 reproducible segfault via ldap search operation
by Karsten Heymann 16 May '17

16 May '17

Hi, some hours ago I found a way to instantly kill our (production -sigh- ) slapd processed with a simple unauthenticated ldap search operation. We are running 2.4.40 (from debian wheezy-backports) in production but I was able to reproduce exactly the same behaviour with 2.4.44 (taken from debian jessie-backports). While I'm building a minimal testcase without internal information so I can provide it to the project (are there more bug submission guidelines than http://www.openldap.org/faq/data/cache/59.html ?), I wanted to ask how you want me to handle this in my eyes quite serious incident. Should I just post it to the mailing list or do you prefer a non-public transmission first so the bug does not get exploited in a denial of service use case before you had the chance to come up with a fix? I will also try to verify if the problem is still existing in the current git master or self compiled 2.4.44. Best regards, Karsten

2 2

Re: Client binding to a specific local address
by Quanah Gibson-Mount 16 May '17

16 May '17

Be sure and raise it for discussion on the -devel list before starting work. --Quanah > On May 15, 2017, at 7:13 PM, Daniel Le <daniel.le(a)exfo.com> wrote: > > I filed http://www.openldap.org/its/index.cgi?findid=8654 and will be working on it as well. > > Daniel > > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Saturday, May 13, 2017 6:58 AM > To: Daniel Le <daniel.le(a)exfo.com> > Cc: openldap-technical(a)openldap.org > Subject: Re: Client binding to a specific local address > > Daniel Le wrote: >> Thanks Quanah and Michael. I much appreciate your help. >> >> I am new to this list. How do I submit an enhancement request? Or would you be willing >> to do it on behalf of the community? > > You can file a RFE request here: > http://www.openldap.org/its/ > > Ciao, Michael. >

1 0

Re: Client binding to a specific local address
by Quanah Gibson-Mount 15 May '17

15 May '17

--On Thursday, May 11, 2017 5:24 PM -0500 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Ah I see. No such option at this time that I am aware of. Yeah, looking at os-ip.c in libldap, we have no option to use bind(2), and purely use connect(2). I suppose this could be seen as an enhancement request. do{ osip_debug(ld, "attempting to connect: \n", 0, 0, 0); if ( connect(s, sin, addrlen) != AC_SOCKET_ERROR ) { --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

Transaction log files generated too frequently and DB_LOG_AUTOREMOVE setting does not remove old log files
by Joanne Yan Fu 13 May '17

13 May '17

I have a relatively small OpenLDAP DB (ldif backup file is less than 7M and total size of *bdb files is less than 20M), that handles mostly read requests and few write requests. The servers are configured to run in a cluster env using master-master replication. Recently, the servers ran out of space as the transaction log files accumulated. We deleted the old log files manually (as attemp on using "DB_ARCHIVE -d" failed) and were able to restart one of the servers, however noticed the transaction log files (with default size of 10M) were created too frequently ever since (can be 80 files a day). In peak hours, the 10M transaction log files was generated every min I am sure there were not so many write activities. Does anyone know what could cause the creation of the tranaction log files so frequently? In addition, I had set "set_flags DB_LOG_AUTOREMOVE" flag along with check point settings in one of the servers running in cluster, but the log files were not removed automatically. Am I supposed to set the configurations on each server in the cluster to make it working on any of the servers? Here are some settings and server information: - OpenLDAP: slapd 2.4.23 on linux - In slapd.conf: database bdb ... checkpoint 1024 15 - In DB_CONFIG #the cache size is a little too big, we will tune it down later. Hope this will not be an issue set_cachesize 0 268435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE - a sublist of log files: -rw------- 1 ldap ldap 10485760 May 11 14:50 log.0000000068 -rw------- 1 ldap ldap 10485760 May 11 14:52 log.0000000069 -rw------- 1 ldap ldap 10485760 May 11 14:53 log.0000000070 -rw------- 1 ldap ldap 10485760 May 11 14:54 log.0000000071 -rw------- 1 ldap ldap 10485760 May 11 14:55 log.0000000072 Thanks, Joanne

2 1

Re: Client binding to a specific local address
by Michael Ströder 12 May '17

12 May '17

Ralf, please stay on the mailing list. Ralf Mattes wrote: > Am Freitag, 12. Mai 2017 08:03 CEST, Michael Ströder <michael(a)stroeder.com> schrieb: > >> Quanah Gibson-Mount wrote: >>> Ah I see. No such option at this time that I am aware of. >> >> I'd also see this as a useful feature. > > Admitedly more out of curiosity than need: why? > [..] > The only time a TCP connection can have more than one source IP is when there are > multiple _routes_ to the same target IP - not something very common (and often a sign > of miss- configuration). I have such a configuration (for SMTP) and it's not a misconfiguration. Ciao, Michael.

1 0

Re: Client binding to a specific local address
by Quanah Gibson-Mount 12 May '17

12 May '17

Ah I see. No such option at this time that I am aware of. --Quanah > On May 11, 2017, at 1:42 PM, Daniel Le <daniel.le(a)exfo.com> wrote: > > Indeed, similarly to "telnet -b <client-local-address>" or Microsoft LDAP client API function ldap_set_option(LDAP_OPT_SOCKET_BIND_ADDRESSES...) and my system is a multi-homed host. > > Daniel > > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Thursday, May 11, 2017 4:26 PM > To: Quanah Gibson-Mount <quanah(a)symas.com>; Daniel Le <daniel.le(a)exfo.com>; 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> > Subject: Re: Client binding to a specific local address > > Quanah Gibson-Mount wrote: >> --On Thursday, May 11, 2017 6:38 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: >>> Thanks for the answer, however the -h <URI/URL> appears to be a server >>> (slapd) option. I'm looking for the LDAP client side which uses OpenLDAP >>> libldap and liblber libraries. >> >> You may wish to more carefully read my response (Hint: -h and -H are not the same >> thing). You may also wish to refer to the man pages for client utilities such as >> ldapsearch, (which use the LDAP client side API). > > Maybe there's a misunderstanding: > > As I read it Daniel asks for setting the client's *out-going* IP address, something like > telnet -b <local-address>. Probably he's on a multi-homed host or has a more complicated > IP configuration and has to use a specific out-going address for getting his packets > accepted by the server. > > Ciao, Michael. >

2 1

RE: Client binding to a specific local address
by Quanah Gibson-Mount 12 May '17

12 May '17

--On Thursday, May 11, 2017 11:57 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: > Thanks Quanah and Michael. I much appreciate your help. > > I am new to this list. How do I submit an enhancement request? Or would > you be willing to do it on behalf of the community? You can file the request at http://www.openldap.org/its/ If you wish to do the related work, then see also <http://www.openldap.org/devel/contributing.html> I would note there is no guarantee on if/when said feature would be implemented. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Error adding schema: empty AttributeDescription
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 4:34 PM -0400 Prentice Bisbal <pbisbal(a)pppl.gov> wrote: > Is my perception wrong? Yes. You could, for example, to convert "test.schema" that had dependencies on core, cosine, and inetorgperson.schema do the following. a) Create a file named "/tmp/test.conf" with the following contents: include /opt/zimbra/openldap/etc/openldap/schema/core.schema include /opt/zimbra/openldap/etc/openldap/schema/cosine.schema include /opt/zimbra/openldap/etc/openldap/schema/inetorgperson.schema include /tmp/ldap/schema/test.schema b) mkdir -p /tmp/ldap c) slaptest -f /tmp/test.conf -F /tmp/ldap d) Go and grab your newly converted schema file. It will have been numbered in order as it appeared in the conf file, so you'll likely want to tweak it slight, and adjust the dn for adding it via ldapadd. Hope that helps! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

RE: Client binding to a specific local address
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 6:38 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: > Thanks for the answer, however the -h <URI/URL> appears to be a server > (slapd) option. I'm looking for the LDAP client side which uses OpenLDAP > libldap and liblber libraries. You may wish to more carefully read my response (Hint: -h and -H are not the same thing). You may also wish to refer to the man pages for client utilities such as ldapsearch, (which use the LDAP client side API). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

Re: Error adding schema: empty AttributeDescription
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 2:07 PM -0700 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, May 11, 2017 4:34 PM -0400 Prentice Bisbal > <pbisbal(a)pppl.gov> wrote: > >> Is my perception wrong? > > Yes. You could, for example, to convert "test.schema" that had > dependencies on core, cosine, and inetorgperson.schema do the following. > > a) Create a file named "/tmp/test.conf" with the following contents: > > include /opt/zimbra/openldap/etc/openldap/schema/core.schema > include /opt/zimbra/openldap/etc/openldap/schema/cosine.schema > include /opt/zimbra/openldap/etc/openldap/schema/inetorgperson.schema > include /tmp/ldap/schema/test.schema Heh, adjust those paths of course to the actual locations of the core/cosine/inetorgperson schema files. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical