Viewing Software Bugs/5426
Full headers

Major security issue: yes  no

Notes:
fixed in HEAD/RE24
Notification:

Date: Fri, 14 Mar 2008 16:16:10 GMT
From: hyc@OpenLDAP.org
To: openldap-its@openldap.org
Subject: syncrepl and syncprov clash on contextCSN updates

Full_Name: Howard Chu
Version: 2.4/HEAD
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (76.91.220.157)
Submitted by: hyc


If syncprov-checkpoint is configured on a database with a syncrepl consumer
(either for cascaded syncrepl or for mirrormode), the syncrepl consumer may fail
to update the contextCSN because syncprov updates it first. In 2.4 the syncrepl
consumer tries to delete its old value and add the new value, instead of just
doing a modify/Replace as it used to in 2.3. The 2.4 consumer was changed in
this respect because multiple consumers are now allowed on a database, thus
using multiple values in the contextCSN attribute. Replacing the entire
attribute when only a single value needed to change seemed like the wrong thing
to do.

The syncprov overlay still just uses a modify/Replace, so it doesn't have this
problem. Since both syncrepl and syncprov now currently track all of the
contextCSNs in use, probably syncrepl should just be switched back to using
modify/Replace, with the full list of known contextCSNs.