OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: openldap with dbv4 crash

From: Daniel (levaaz.isten.hu)
Date: Tue Jan 01 2008 - 06:27:50 CST


Vijay Sankar mrta:
> On December 30, 2007 08:03:09 pm Stuart Henderson wrote:
>>>>> On December 29, 2007 11:23:19 am Daniel wrote:
>>>>>> Hi (again, sorry, now with Subject)!
>>>>>>
>>>>>> Anyone experiencing or experienced segfaults with openldap using
>>>>>> the bdb backed? I'm using -current ports tree, and built the
>>>>>> openldap-{client,server}, dbv4 and cyrus-sasl2 packages from there.
>> openldap 2.3 doesn't support newer db 4.6 versions (should fail the
>> regression tests).
Yes, indeed, looking at this commit:
http://www.openldap.org/devel/cvsweb.cgi/configure.diff?r1=1.598.2.40&r2=1.598.2.41&hideattic=1&sortbydate=0

>>
>> there's support in 2.4 but iirc it's not a simple thing to backport.
Why should we backport the db4.6 support? We just need to use 2.4.

>
> Thanks very much for this information. Not sure how to help, but I am not
> seeing any seg faults so far. If there is something helpful for me to do,
> please advise. It is not clear from Daniel's message as to whether there is
> any specific thing that causes the seg fault or whether slapd just simply
> does not start.
Below I will write down how to reproduce the crash on an i386 machine,
openldap compiled from ports, with FLAVOR=bdb.

Start with a fresh database directory, use the stock DB_CONFIG options,
and of course the bdb backend. Add just the root dn, with the
domaincomponent attributes ie. "dn: dc=domain,dc=com", and a rootdn
account. Now test it with a simple ldapsearch command (eg. filter
(objectclass=*), it succeeds. Exit from slapd, then restart it, with the
same slapd.conf as before. Now do that simple ldapsearch again, and then
slapd will segfault. Doing a not so informative gdb with slapd, it shows
that it crashes with the libdb libraries. Changing the database backend
to ldbm solves the problem, what also supports this theory.
In the above example, it doesn't matter if one use TLS or not.

With openldap-2.4, one can not use the ldbm backend anymore, but there
is no need to, because the bdb backend is working with it.

[...]

> Normally I use packages. But some time ago, I was able to use syncrepl with
> OpenLDAP 2.3.33 and used the following ./configure command to build from
> source.
>
> env CPPFLAGS="-I/usr/local/include/db4 -I/usr/local/include/sasl" \
> LDFLAGS="-L/usr/local/lib/db4 -L/usr/local/share/libtool/libltdl -L/usr/local/lib/sasl2 -L/usr/local/lib"\
> ./configure \
> --prefix=/usr/local \
> --enable-slapd \
> --enable-cleartext \
> --enable-crypt \
> --enable-rewrite \
> --enable-wrapper \
> --with-cyrus-sasl=yes \
> --enable-spasswd \
> --enable-dnssrv \
> --enable-ldap \
> --enable-ldbm \
> --enable-bdb \
> --enable-meta \
> --enable-null \
> --enable-passwd \
> --disable-ipv6 \
> --disable-shell \
> --enable-slurpd \
> --enable-overlays=mod \
> --with-tls \
> --disable-sql
>
> Is this correct? Should I make any changes? Please let me know.
Same here, almost.

>
> Thanks very much,
>
> Vijay