Issue 6347 - VLV search sometime fails with operation error #6349
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tbordaz
reviewed
Sep 30, 2024
|
LGTM |
This was referenced Oct 8, 2024
progier389
added a commit
that referenced
this pull request
Oct 10, 2024
A better fix than PR 6349 about corrupted vlv cache Problem is a race condition because txn was released while building the cache. Solution keep the write txn open until the cache is fully rebuilt. Also fixed some debug logs And also added the source of a tool useful to check the vlv cache consistency Note: this remove PR #6349 and integrate PR #6356 Issue: #6347 Reviewed by @tbodaz (Thanks!)
progier389
added a commit
that referenced
this pull request
Oct 10, 2024
A better fix than PR 6349 about corrupted vlv cache Problem is a race condition because txn was released while building the cache. Solution keep the write txn open until the cache is fully rebuilt. Also fixed some debug logs And also added the source of a tool useful to check the vlv cache consistency Note: this remove PR #6349 and integrate PR #6356 Issue: #6347 Reviewed by @tbodaz (Thanks!) (cherry picked from commit 8366819)
progier389
added a commit
that referenced
this pull request
Oct 11, 2024
A better fix than PR 6349 about corrupted vlv cache Problem is a race condition because txn was released while building the cache. Solution keep the write txn open until the cache is fully rebuilt. Also fixed some debug logs And also added the source of a tool useful to check the vlv cache consistency Note: this remove PR #6349 and integrate PR #6356 Issue: #6347 Reviewed by @tbodaz (Thanks!) (cherry picked from commit 8366819)
Firstyear
added a commit
to Firstyear/389-ds-base
that referenced
this pull request
Oct 16, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: 389ds#6349 Author: William Brown <william@blackhats.net.au> Review by: ???
Firstyear
added a commit
to Firstyear/389-ds-base
that referenced
this pull request
Oct 17, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: 389ds#6349 Author: William Brown <william@blackhats.net.au> Review by: ???
Firstyear
added a commit
to Firstyear/389-ds-base
that referenced
this pull request
Oct 17, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: 389ds#6349 Author: William Brown <william@blackhats.net.au> Review by: ???
Firstyear
added a commit
to Firstyear/389-ds-base
that referenced
this pull request
Oct 17, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: 389ds#6349 Author: William Brown <william@blackhats.net.au> Review by: ???
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
that referenced
this pull request
Oct 18, 2024
Bug Description: slapd_SSL_client_auth uses the values of KeyExtractFile and CertExtractFile from the configuration entry, and each time it's called attempts to determine if this is an absolute or relative path. If the path is relative, it prepends a /tmp location based on if the running system /tmp is a private namespace or not. This causes a replication client that uses TLS certificate authentication to repeatedly emit warnings that the key extraction occurred to non-private tmp in a container. Fix Description: During key extraction, we extract keys and files using the "last token" from nss as the item that we extract. Because of this, we know that there can only be a single extracted key and cert, allowing us to extract these and store the full abs path of the extracted files rather than deriving them during each client iteration. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @tbordaz @progier389 @droideck (Thanks!)
Firstyear
added a commit
to Firstyear/389-ds-base
that referenced
this pull request
Nov 6, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: 389ds#6349 Author: William Brown <william@blackhats.net.au> Review by: ???
Firstyear
added a commit
that referenced
this pull request
Nov 7, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Firstyear
added a commit
that referenced
this pull request
Nov 7, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Firstyear
added a commit
that referenced
this pull request
Nov 7, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Firstyear
added a commit
that referenced
this pull request
Nov 7, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Firstyear
added a commit
that referenced
this pull request
Nov 7, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Firstyear
added a commit
that referenced
this pull request
Nov 7, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Firstyear
added a commit
to Firstyear/389-ds-base
that referenced
this pull request
Nov 21, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: After more testing, if the connection is dropped and restarted, the certpath is retrieved but re-extraction does not occur. This still triggers the warning however. To resolve this, we only warn about the tpm namespace during library initialisation. I really hope I got it right this time :( fixes: 389ds#6349 Author: William Brown <william@blackhats.net.au> Review by: ???
Firstyear
added a commit
that referenced
this pull request
Nov 29, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Firstyear
added a commit
that referenced
this pull request
Nov 29, 2024
Bug Description: Keys/Certs are extracted to PEM repeatedly causing many warnings during outbound TLS authenticated replication Fix Description: slapd_ssl_init() is called every time an outbound TLS connection is made, and will trigger a key extraction. If key extraction is already complete then the extraction is skipped. fixes: #6349 Author: William Brown <william@blackhats.net.au> Review by: @progier389 @tbordaz
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
if enabling certificate pruning freeipa tests sometime fails because VLV search sometime fails with err=1 and
error logs show - ERR - vlv_build_idl - Can't follow db cursor (err -12797)
Cause: The end of records is reached when trying to get a record in vlv index using its position
Solution: avoid to return MDB_NOT_FOUND in such case but return the last record instead
Issue: #6347
Reviewed by: tbordaz (Thanks!)