Q: status of component matching? - openldap-technical

20 May 2010


      Hi all,
we are trying to set up an openldap 2.4.21 slapd server that is able to handle component-filter 
search requests. The problem we get is that the slapd fails to load the compmatch 
module. With full debug output the error message is:
"lt_dlopenext failed: (compmatch.la) file not found"
Does anybody already have entered this problem?
What we did/tried is now described in detail:
We use Suse 11.1 as the Linux distribution.
Compiler info:
openldap@ocsp-openldap24:~/openldap-2.4.21/tests> gcc -v
Using built-in specs.
Target: i586-suse-linux
Configured with: ../configure --prefix=/usr 
  --infodir=/usr/share/info --mandir=/usr/share/man --libdir=/usr/lib 
  --libexecdir=/usr/lib --enable-languages=c,c++,objc,fortran,obj-c++,java,ada 
  --enable-checking=release --with-gxx-include-dir=/usr/include/c++/4.3 --enable-ssp 
  --disable-libssp --with-bugurl=http://bugs.opensuse.org/ --with-pkgversion='SUSE Linux' 
  --disable-libgcj --disable-libmudflap --with-slibdir=/lib --with-system-zlib 
  --enable-__cxa_atexit --enable-libstdcxx-allocator=new --disable-libstdcxx-pch 
  --enable-version-specific-runtime-libs --program-suffix=-4.3 --enable-linux-futex 
  --without-system-libunwind --with-cpu=generic --build=i586-suse-linux
Thread model: posix
gcc version 4.3.2 [gcc-4_3-branch revision 141291] (SUSE Linux)
The openldap software is configured with the following command:
./configure LDFLAGS="-L/usr/local/BerkeleyDB.5.0/lib -ldb" 
  --prefix /home/openldap/openldap-2.4.21-install 
  --enable-modules --enable-sssvlv --enable-syncprov --enable-valsort --enable-bdb=mod
To supply the ASN.1 object parsing we downloaded 
  http://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap...
to create the asn.1 library libcasn1.a.
While running make for the component match module itself we encounter problems when calling the libtool
for linking:
../../../libtool --mode=link gcc -g -O2 -DLDAP_COMPONENT -DLDAP_COMP_MATCH \
  /home/openldap/openldap-snacc-2.3.6/c-lib/libcasn1.a -L/usr/lib -lcrypto -version-info 0:0:0 \
  -rpath /home/openldap/openldap-2.4.21-install/libexec/openldap -module -o compmatch.la componentlib.lo \
  init.lo certificate.lo asn_to_syn_mr.lo authorityKeyIdentifier.lo crl.lo \ 
  /home/openldap/openldap-snacc-2.3.6/c-lib/libcasn1.a -L/usr/lib -lcrypto
*** Warning: Linking the shared library compmatch.la against the
*** static library /home/openldap/openldap-snacc-2.3.6/c-lib/libcasn1.a is not portable!
In the resulting compmatch.a library the asn.1 lib is included four times:
openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> ar tv .libs/compmatch.a
rw-r--r-- 1000/1000 152162 May 18 14:37 2010 libcasn1.a
rw-r--r-- 1000/1000 152162 May 18 14:37 2010 lt1-libcasn1.a
rw-r--r-- 1000/1000 131488 May 19 14:04 2010 componentlib.o
rw-r--r-- 1000/1000  70900 May 19 14:04 2010 init.o
rw-r--r-- 1000/1000 144908 May 19 14:04 2010 certificate.o
rw-r--r-- 1000/1000  55372 May 19 14:04 2010 asn_to_syn_mr.o
rw-r--r-- 1000/1000 110584 May 19 14:04 2010 authorityKeyIdentifier.o
rw-r--r-- 1000/1000  84920 May 19 14:04 2010 crl.o
rw-r--r-- 1000/1000 152162 May 18 14:37 2010 libcasn1.a
rw-r--r-- 1000/1000 152162 May 18 14:37 2010 libcasn1.a
The component filter test fails:
...
...
...
...
...
Starting test031-component-filter for bdb...
running defines.sh
Running slapadd to build slapd database...
slapadd: bad configuration file!
slapadd failed (1)!
Be sure to have a certificate module in tests/data/comp_libs 
The module is in openldap/contrib/slapd-modules/comp_match
Test skipped.
...
...
...
...
...
./scripts/test031-component-filter completed OK for bdb.
Now we try to load the module via slapd. In the slapd.conf we specify the following:
# Load dynamic backend modules:
modulepath      /home/openldap/openldap-2.4.21-install/libexec/openldap
moduleload      back_bdb.la
moduleload      compmatch.la
Check that all module files do exist:
openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> ls -al /home/openldap/openldap-2.4.21-install/libexec/openldap
total 736
drwxr-xr-x 2 openldap openldap   4096 2010-05-19 14:10 .
drwxr-xr-x 3 openldap openldap   4096 2010-05-19 09:32 ..
lrwxrwxrwx 1 openldap openldap     21 2010-05-19 09:31 back_bdb-2.4.so.2 -> back_bdb-2.4.so.2.5.4
-rwxr-xr-x 1 openldap openldap 221074 2010-05-19 09:31 back_bdb-2.4.so.2.5.4
-rwxr-xr-x 1 openldap openldap    889 2010-05-19 09:31 back_bdb.la
lrwxrwxrwx 1 openldap openldap     21 2010-05-19 09:31 back_bdb.so -> back_bdb-2.4.so.2.5.4
-rwxr-xr-x 1 openldap openldap    889 2010-05-19 10:02 compmatch.la
lrwxrwxrwx 1 openldap openldap     18 2010-05-19 09:56 compmatch.so -> compmatch.so.0.0.0
-rwxr-xr-x 1 openldap openldap 507076 2010-05-19 09:55 compmatch.so.0.0.0
Starting slapd by
openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> strace -vall -s1024 -oasi 
  /home/openldap/openldap-2.4.21-install/libexec/slapd  -h ldap://localhost:9389/ -d -1
results in the following:
line 15 (pidfile                /home/openldap/openldap-2.4.21-install/var/run/slapd.pid)
line 16 (argsfile       /home/openldap/openldap-2.4.21-install/var/run/slapd.args)
line 19 (modulepath     /home/openldap/openldap-2.4.21-install/libexec/openldap)
line 21 (moduleload     back_bdb.la)
loaded module back_bdb.la
bdb_back_initialize: initialize BDB backend
bdb_back_initialize: Berkeley DB 5.0.21: (March 30, 2010)
module back_bdb.la: null module registered
line 26 (moduleload     compmatch.la)
lt_dlopenext failed: (compmatch.la) file not found
/home/openldap/openldap-2.4.21-install/etc/openldap/slapd.conf: line 26: <moduleload> handler exited with 1!
slapd destroy: freeing system resources.
slapd stopped.
connections_destroy: nothing to destroy.
The content of compmatch.la:
openldap@ocsp-openldap24:~/openldap-2.4.21/contrib/slapd-modules/comp_match> cat /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.la
# back_bdb.la - a libtool library file
# Generated by ltmain.sh - GNU libtool 1.5.22-OpenLDAP (1.1220.2.365 2005/12/18 22:14:06)
#
# Please DO NOT delete this file!
# It is necessary for linking the library.
# The name that we can dlopen(3).
dlname='compmatch.so.0.0.0'
# Names of this library.
library_names='compmatch.so.0.0.0 compmatch.so'
# The name of the static archive.
old_library=''
# Libraries that this one depends upon.
dependency_libs=''
# Version information for back_bdb.
current=0
age=0
revision=0
# Is this an already installed library?
installed=yes
# Should we warn about portability when linking against -modules?
shouldnotlink=yes
# Files to dlopen/dlpreopen
dlopen=''
dlpreopen=''
# Directory that this library needs to be installed in:
libdir='/home/openldap/openldap-2.4.21-install/libexec/openldap'
An excerpt from the strace file shows that the module itself can be accessed:
open("/home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0.0.0", O_RDONLY) = 10
read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20\241\0\0004\0\0\0\224V\7\0\0\0\0\0004\0 \0\6\0(\0'\0$\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\267\2\0\20\267\2\0\5\0\0\0\0\20\0\0\1\0\0\0\364\273\2\0\364\313\2\0\364\313\2\0\4(\0\0<>\0\0\6\0\0\0\0\20\0\0\2\0\0\0`\274\2\0`\314\2\0`\314\2\0\330\0\0\0\330\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0\364\0\0\0\364\0\0\0\364\0\0\0$\0\0\0$\0\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345td\364\273\2\0\364\313\2\0\364\313\2\0\f\4\0\0\f\4\0\0\4\0\0\0\1\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0"\261\223\260l\363\226\251\276\214p&\265\373\240\242l\3254\310\t\2\0\0006\2\0\0\230\0\0\0\n\1\0\0;\0\0\0\0\0\0\0\235\0\0\0\0\0\0\0\0\0\0\0\350\1\0\0(\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\7\2\0\0\0\0\0\0\205\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\0\0\0\0\16\1\0\0\322\1\0\0\0\0\0\0\224\1\0\0#\0\0\0\275\0\0\0\0\0\0\0\263\0\0\0\0\0\0\0D\0\0\0$\1\0\0\314\0\0\0\312\1\0\0c\1\0\0\0\0\0\0\0\0\0\0~\0\0\0\0\0\0\0\0\0\0\0\274\1\0\0\375\0\0\0\362\1\0\0\237\1\0\0\0\0\0\0\0\0\0\0\210\1\0\0\0\0\0\0\0\0\0\0\225\0\0\0\0\0\0\0t\1\0\0\21\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 512) = 512
fstat64(10, {st_dev=makedev(8, 2), st_ino=357002, st_mode=S_IFREG|0755, st_nlink=1, st_uid=1000, st_gid=1000, st_blksize=4096, st_blocks=1000, st_size=507076, st_atime=2010/05/19-14:13:32, st_mtime=2010/05/19-09:55:40, st_ctime=2010/05/19-09:55:40}) = 0
mmap2(NULL, 199216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb7c42000
fadvise64(10, 0, 199216, POSIX_FADV_WILLNEED) = 0
mmap2(0xb7c6e000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x2b) = 0xb7c6e000
mmap2(0xb7c72000, 2608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7c72000
close(10) = 0
open("/usr/local/BerkeleyDB.5.0/lib/libcrypto.so.0.9.8", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 10
fstat64(10, {st_dev=makedev(8, 2), st_ino=567539, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=64, st_size=31447, st_atime=2010/05/19-14:13:32, st_mtime=2010/05/18-10:45:00, st_ctime=2010/05/18-10:45:00}) = 0
mmap2(NULL, 31447, PROT_READ, MAP_PRIVATE, 10, 0) = 0xb7c3a000
close(10) = 0
open("/usr/lib/libcrypto.so.0.9.8", O_RDONLY) = 10
read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\320\3\0004\0\0\0\2641\26\0\0\0\0\0004\0 \0\7\0(\0\35\0\34\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\333\24\0\220\333\24\0\5\0\0\0\0\20\0\0\1\0\0\0\300\351\24\0\300\351\24\0\300\351\24\0\304F\1\0Xz\1\0\6\0\0\0\0\20\0\0\2\0\0\0\310Z\25\0\310Z\25\0\310Z\25\0\360\0\0\0\360\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0\24\1\0\0\24\1\0\0\24\1\0\0$\0\0\0$\0\0\0\4\0\0\0\4\0\0\0P\345td\310\242\22\0\310\242\22\0\310\242\22\0\34u\0\0\34u\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0R\345td\300\351\24\0\300\351\24\0\300\351\24\0@v\0\0@v\0\0\4\0\0\0\1\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\265\352E\24\365\314\1771\372m\0\247U\306\336\241\222C->\5\10\0\0r\r\0\0\0\0\0\0-\6\0\0\0\0\0\0\336\n\0\0\0\0\0\0\0\0\0\0f\7\0\0\363\3\0\0\0\0\0\0\0\0\0\0\215\f\0\0l\v\0\0\214\v\0\0/\v\0\0\311\4\0\0\257\7\0\0\32\f\0\0u\3\0\0\203\3\0\0\30\6\0\0\327\n\0\0\260\4\0\0\303\2\0\0H\6\0\0&\r\0\0\342\v\0\0m\t\0\0\202\3\0\0O\6\0\0\267\v\0\0\373\n\0\0\0\0\0\0\331\0\0\0\233\7\0\0-\0\0\0/\10\0\0\0\0\0\0\t\6\0\0\0\0\0\0E\1\0\0.\0\0\0U\4\0\0\21\0\0\0\0\0\0\0\345\t\0\0!\2\0\0\0\0\0\0\0\0\0\0", 512) = 512
fstat64(10, {st_dev=makedev(8, 2), st_ino=523294, st_mode=S_IFREG|0555, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2856, st_size=1455676, st_atime=2010/05/19-14:13:32, st_mtime=2008/12/03-07:36:55, st_ctime=2009/07/27-12:44:06}) = 0
mmap2(NULL, 1467416, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb7ad3000
fadvise64(10, 0, 1467416, POSIX_FADV_WILLNEED) = 0
mmap2(0xb7c21000, 90112, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x14e) = 0xb7c21000
mmap2(0xb7c37000, 9240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7c37000
close(10) = 0
open("/usr/local/BerkeleyDB.5.0/lib/libz.so.1", O_RDONLY) = 10
read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\31\0\0004\0\0\0(2\1\0\0\0\0\0004\0 \0\7\0(\0\35\0\34\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254)\1\0\254)\1\0\5\0\0\0\0\20\0\0\1\0\0\0(.\1\0(>\1\0(>\1\0\344\2\0\0\354\2\0\0\6\0\0\0\0\20\0\0\2\0\0\0\350.\1\0\350>\1\0\350>\1\0\320\0\0\0\320\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0\24\1\0\0\24\1\0\0\24\1\0\0$\0\0\0$\0\0\0\4\0\0\0\4\0\0\0P\345td\0\34\1\0\0\34\1\0\0\34\1\0\304\2\0\0\304\2\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345td(.\1\0(>\1\0(>\1\0\330\1\0\0\330\1\0\0\4\0\0\0\1\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\17\363*\0274\316\273\2402`\300d\237a\241\201\356h\327Sa\0\0\0i\0\0\0;\0\0\0\0\0\0\0\f\0\0\0\32\0\0\0,\0\0\0\35\0\0\0\0\0\0\0b\0\0\0\0\0\0\0\0\0\0\0g\0\0\0\0\0\0\0P\0\0\0\0\0\0\0\\0\0\0\0\0\0\0003\0\0\0_\0\0\0A\0\0\0\37\0\0\0W\0\0\0000\0\0\0[\0\0\0'\0\0\0%\0\0\0\0\0\0\0F\0\0\0]\0\0\0\23\0\0\0006\0\0\0\0\0\0\0a\0\0\0h\0\0\0\6\0\0\0-\0\0\0H\0\0\0\34\0\0\0008\0\0\0\27\0\0\0\0\0\0\0\20\0\0\0`\0\0\0005\0\0\0K\0\0\0\0\0\0\0)\0\0\0J\0\0\0\26\0\0\0", 512) = 512
fstat64(10, {st_dev=makedev(8, 2), st_ino=579040, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=168, st_size=79536, st_atime=2010/05/19-14:13:32, st_mtime=2010/05/19-08:48:55, st_ctime=2010/05/19-08:48:55}) = 0
mmap2(NULL, 82196, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb7abe000
fadvise64(10, 0, 82196, POSIX_FADV_WILLNEED) = 0
mmap2(0xb7ad1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x12) = 0xb7ad1000
close(10) = 0
mprotect(0xb7ad1000, 4096, PROT_READ) = 0
mprotect(0xb7c21000, 32768, PROT_READ) = 0
munmap(0xb7c3a000, 31447) = 0
munmap(0xb7c42000, 199216) = 0
munmap(0xb7ad3000, 1467416) = 0
munmap(0xb7abe000, 82196) = 0
write(2, "lt_dlopenext failed: (compmatch.la) file not found\n", 51) = 51
time(NULL) = 1274271212
send(3, "<167>May 19 14:13:32 slapd[24620]: lt_dlopenext failed: (compmatch.la) file not found\n", 86, MSG_NOSIGNAL) = 86
write(2, "/home/openldap/openldap-2.4.21-install/etc/openldap/slapd.conf: line 26: <moduleload> handler exited with 1!\n", 109) = 109
close(9) = 0
munmap(0xb7e62000, 4096) = 0
write(2, "slapd destroy: freeing system resources.\n", 41) = 41
munmap(0xb7c73000, 252728) = 0
write(2, "slapd stopped.\n", 15) = 15
So does anybody have an idea?
Regards,
Heiko
--
Dipl.-Ing.
Heiko Nardmann
Berater
Business Security
secunet Security Networks AG
Weidenauer Str. 223-225
D-57076 Siegen
Telefon +49 201 5454-2017
Telefax +49 201 5454-1329
Heiko.Nardmann@secunet.com
www.secunet.com
secunet Security Networks AG
Kronprinzenstr. 30
45128 Essen
Amtsgericht Essen HRB 13615
Vorstand:
Dr. Rainer Baumgart
Thomas Koelzer
Thomas Pleines
Aufsichtsratsvorsitzender:
Dr. Karsten Ottenberg
Diese E-mail kann vertrauliche Informationen enthalten. Falls Sie diese E-Mail irrtÃ¼mlich erhalten haben, informieren Sie bitte unverzÃ¼glich den Absender und lÃ¶schen Sie diese E-Mail von jedem Rechner, auch von den Mailservern. Jede Verbreitung des Inhalts, auch die teilweise Verbreitung, ist in diesem Fall untersagt. AuÃŸer bei Vorsatz oder grober FahrlÃ¤ssigkeit schlieÃŸen wir jegliche Haftung fÃ¼r Verluste oder SchÃ¤den aus, die durch Viren befallene Software oder E-Mails verursacht werden.
This e-mail may contain confidential information. If you received this e-mail in error, please contact the sender and delete this e-mail from your computer, including your mailservers. Any dissemination, even partly, is prohibited. Except in case of gross negligence or wilful misconduct we accept no liability for any loss or damage caused by software or e-mail viruses.