Full_Name: Guido Winkelmann
Version: 2.4.44
OS: Gentoo Linux
URL: 
Submission from: (NULL) (80.146.184.86)


Hi,

I have been trying to set up OpenLDAP to serve some data from a MySQL database
using back_sql. I have gotten to the point where it should show the base object
of its tree, but when I try to query it using

ldapsearch -x -b 'dc=hornetsecurity,dc=com' '(objectclass=*)'

slapd will crash with a segfault.

For debugging, I have started slapd with

gdb --args /usr/lib64/openldap/slapd -u ldap -h "ldaps:/// ldap:/// ldapi:///"
-f /etc/openldap/slapd.conf -d -1

The last couple of lines from the gdb session look like this:

582da79a >>> dnPrettyNormal: <DC=HORNETSECURITY,DC=COM>
=> ldap_bv2dn(DC=HORNETSECURITY,DC=COM,0)
<= ldap_bv2dn(DC=HORNETSECURITY,DC=COM)=0 
=> ldap_dn2bv(272)
<= ldap_dn2bv(dc=HORNETSECURITY,dc=COM)=0 
=> ldap_dn2bv(272)
<= ldap_dn2bv(dc=hornetsecurity,dc=com)=0 
582da79a <<< dnPrettyNormal: <dc=HORNETSECURITY,dc=COM>,
<dc=hornetsecurity,dc=com>
582da79a <==backsql_dn2id("dc=hornetsecurity,dc=com"): err=0
582da79a ==>backsql_id2entry()
582da79a backsql_id2entry(): retrvingng all attributes
582da79a ==>backsql_get_attr_vals(): oc="dcObject" attr="dc" keyval=1
582da79a backsql_get_attr_vals(): number of values in query: 1
582da79a <==backsql_get_attr_vals()
582da79a ==>backsql_get_attr_vals(): oc="dcObject" attr="objectClass" keyval=1
582da79a backsql_get_attr_vals(): number of values in query: 1
582da79a <==backsql_get_attr_vals()
582da79a <==backsql_id2entry()
582da79a => access_allowed: search access to "dc=HORNETSECURITY,dc=COM" "entry"
requested
582da79a => slap_access_allowed: backend default search access granted to
"(anonymous)"
582da79a => access_allowed: search access granted by read(=rscxd)
582da79a ==>backsql_oc_get_candidates(): oc="dcObject"
582da79a ==>backsql_srch_query()
582da79a ==>backsql_process_filter()
582da79a <==backsql_process_filter() succeeded
582da79a <==backsql_srch_query() returns SELECT DISTINCT
ldap_entries.id,top_domain.id,'dcObject' AS objectClass,ldap_entries.dn AS dn
FROM ldap_entries,top_domain WHERE top_domain.id=ldap_entries.keyval AND
ldap_entries.oc_map_id=? AND 9=9 AND 3=3
582da79a Constructed query: SELECT DISTINCT
ldap_entries.id,top_domain.id,'dcObject' AS objectClass,ldap_entries.dn AS dn
FROM ldap_entries,top_domain WHERE top_domain.id=ldap_entries.keyval AND
ldap_entries.oc_map_id=? AND 9=9 AND 3=3
582da79a id: '1'
582da79a >>> dnPrettyNormal: <DC=HORNETSECURITY,DC=COM>
=> ldap_bv2dn(DC=HORNETSECURITY,DC=COM,0)
<= ldap_bv2dn(DC=HORNETSECURITY,DC=COM)=0 
=> ldap_dn2bv(272)
<= ldap_dn2b28dcdc=HORNETSECURITY,dc=COM)=0 
=> ldap_dn2bv(272)
<= ldap_dn2bv(dc=hornetsecurity,dc=com)=0 
582da79a <<< dnPrettyNormal: <dc=HORNETSECURITY,dc=COM>,
<dc=hornetsecurity,dc=com>
582da79a backsql_oc_get_candidates(): added entry id=0 keyval=1
dn="DC=HORNETSECURITY,DC=COM"
X582da79a <==backsql_oc_get_candidates(): 1
582da79a backsql_search(): loading data for entry id=0 oc_id=1, keyval=1

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffee336700 (LWP 13529)]
backsql_search (op=0x7fffe00028d0, r3D0x0x7fffee335950) at
/var/tmp/portage/net-nds/openldap-2.4.44/work/openldap-2.4.44/servers/slapd/back-sql/search.c:2303
2303                                    is_entry_referral( e ) )
(gdb) bt
#0  backsql_search (op=0x7fffe00028d0, rs=0x7fffee335950)
a%2/var/tmp/portage/net-nds/openldap-2.4.44/work/openldap-2.4.44/servers/slapd/back-sql/search.c:2303
#1  0x00000000004353a1 in fe_op_search (op=0x7fffe00028d0, rs=0x7fffee335950) at
/var/tmp/portage/net-nds/openldap-2.4.44/work/openldap-2.4.44/servers/slapd/search.c:402
#2  0x0000000000434d3c in do_search (op=0x7fffe00028d0, rs=0x7fffee335950) at
/var/tmp/portage/net-nds/openldap-2.4.44/work/openldap-2.4.44/servers/slapd/search.c:247
#3  0x0000000000432754 in connection_operation (ctx=ctx@entry=0x7fffee335b90,
arg_v=arg_v@entry=0x7fffe00028d0) at
/var/tmp/portage/net-nds/openldap-2.4.44/work/openldap-2.4.44/servers/slapd/connection.c:1158
#4  0x0000000000432a27 in connection_read_thread (ctx=0x7fffee335b90, argv=0x10)
at /var/tmp/portage/net-nds/openldap-2.4.44/work/openldap-2.4.44/servers/slapd/connection.c:1294
#5  0x00007ffff7b98cd2 in ldap_int_thread_pool_wrapper (xpool=0x84bfa0) at
/var/tmp/portage/net-nds/openldap-2.4.44/work/openldap-2.4.44/libraries/libldap_r/tpool.c:696
#6  0x00007ffff71de434 in start_thread (arg=0x7fffee336700) at
pthread_create.c:334
#7  0x00007ffff618b52d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:109
(gdb) print e
$1 = (Entry *) 0x0
(gdb) print bi->sql_baseObject 
$2 = (Entry *) 0x0
(gdb) info locals
a_hasSubordinate = 0x0
a_entryUUID = 0x0
a_entryCSN = 0x0
e = 0x0
rc = <optimized out>
ap = 0x0
bi = 0x89b9f0
dbh = 0x7fffe0102cb0
sres = <optimized out>
user_entry = {e_id = 0, e_name = {bv_len = 0, bv_val = 0x0}, e_nname = {bv_len =
0, bv_val = 0x0}, e_attrs = 0x0, e_ocflags = 0, e_bv = {bv_len = 0, bv_val =
0x0}, e_private = 0x0}
base_entry = {e_id = 0, e_name = {bv_len = 24, bv_val = 0x7fffe000f278
"dc=HORNETSECURITY,dc=COM"}, e_nname = {bv_len = 24, bv_val = 0x7fffe000f2a0
"dc=hornetsecurity,dc=com"}, e_attrs = 0x90a2e8, e_ocflags = 65792, e_bv =
{bv_len = 0, 
    bv_val = 0x0}, e_private = 0x0}
manageDSAit = <optimized out>
stoptime = 1479390634
bsi = {bsi_op = 0x7fffe00028d0, bsi_rs = 0x7fffee335950, bsi_flags = 1,
bsi_base_ndn = 0x7fffe0002908, bsi_use_subtree_shortcut = 1, bsi_base_id =
{eid_id = 0, eid_keyval = 1, eid_oc_id = 1, eid_oc = 0xaf3dc0, eid_dn = {bv_len
= 24, 
      bv_val = 0x7fffe000f200 "dc=HORNETSECURITY,dc=COM"}, eid_ndn = {bv_len
=4%4, bv_val = 0x7fffe000f250 "dc=hornetsecurity,dc=com"}, eid_next = 0x0},
bsi_scope = 2, bsi_filter = 0x7fffe0002eb8, bsi_stoptime = 1479390634, 
  bsi_id_list = 0x7fffe0017658, bsi_id_listtail = 0x7fffe0017698, bsi_c_eid =
0x7fffee334478, bsi_n_candidates = -3, bsi_status = 0, bsi_oc = 0xaf3dc0,
bsi_sel = {bb_val = {bv_len = 0, bv_val = 0x0}, bb_len = 0}, bsi_from = {bb_val
= {
      bv_len = 0, bv_val = 0x0}, bb_len = 0}, bsi_join_where = {bb_val = {bv_len
= 0, bv_val = 0x0}, bb_len = 0}, bsi_flt_where = {bb_val = {bv_len = 0, bv_val =
0x0}, bb_len = 0}, bsi_filter_oc = 0x0, bsi_dbh = 0x7fffe0102cb0, 
  bsi_attrs = 0x0, bsi_e = 0x0}
eid = 0x7fffe0017658
nbase = {bv_len = 0, bv_val = 0x0}
lastid = 0
(gdb) print bsi->bsi_op
$3 = (Operation *) 0x7fffe00028d0
(gdb) print *(bsi->bsi_op)
$4 = {o_hdr = 0x7fffe0002a40, o_tag = 99, o_time = 1479387034, o_tincr = 1, o_bd
= 0x89b320, o_req_dn = {bv_len = 24, bv_val = 0x7fffe0002e40
"dc=hornetsecurity,dc=com"}, o_req_ndn = {bv_len = 24, 
    bv_val = 0x7fffe0002e90 "dc=hornetsecurity,dc=com"}, o_request = {oq_add =
{rs_modlist = 0x2, rs_e = 0xe10000001f4}, oq_bind = {rb_method = 2, rb_cred =
{bv_len = 15461882266100, bv_val = 0x89b3fc "\020\016"}, rb_edn = {bv_len = 0, 
        bv_val = 0x0}, rb_ssf = 3758108344, rb_mech = {bv_len = 15, bv_val =
0x7fffe0002ed8 "(objectClass=*)"}}, oq_compare = {rs_ava = 0x2}, oq_modify =
{rs_mods = {rs_modlist = 0x2, rs_no_opattrs = -12 '\364'}, rs_increment =
9024508}, 
    oq_modrdn = {rs_mods = {rs_modlist = 0x2, rs_no_opattrs = -12 '\364'},
rs_deleteoldrdn = 9024508, rs_newrdn = {bv_len = 0, bv_val = 0x0}, rs_nnewrdn =
{bv_len = 140736951496376, bv_val = 0xf <error: Cannot access memory at address
0xf>}, 
      rs_newSup = 0x7fffe0002ed8, rs_nnewSup = 0x0}, oq_search = {rs_scope = 2%
r rs_deref = 0, rs_slimit = 500, rs_tlimit = 3600, rs_limit = 0x89b3fc,
rs_attrsonly = 0, rs_attrs = 0x0, rs_filter = 0x7fffe0002eb8, rs_filterstr =
{bv_len = 15, 
        bv_val = 0x7fffe0002ed8 "(objectClass=*)"}}, oq_abandon = {rs_msgid =
2}, oq_canl l = {rs_msgid = 2}, oq_extended = {rs_reqoid = {bv_len = 2, bv_val =
0xe10000001f4 <error: Cannot access memory at address 0xe10000001f4>}, 
      rs_flags = 9024508, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended =
{rs_reqoid = {bv_len = 2, bv_val = 0xe10000001f4 <error: Cannot access memory at
address 0xe10000001f4>}, rs_flags = 9024508, rs_reqdata = 0x0}, rs_old = {bv_len
= 0, 
        bv_val = 0x7fffe0002eb8 "\207"}, rs_new = {bv_len = 15, bv_val =
0x7fffe0002ed8 "(objectClass=*)"}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon
= 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', o_is_auth_check =
0 '\000', 
  o_dont_replicate = 0 '\000', o_acl_priv = ACL_NONE, o_nocaching = 0 '\000',
o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000',
o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 31 times>, 
  o_controls = 0x7fffe0002b90, o_authz = {sai_method = 128, sai_mech = {bv_len =
0, bv_val = 0x0}, sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn = {bv_len = 0,
bv_val = 0x0}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, 
    sai_sasl_ssf = 0}, o_ber = 0x7fffe0002620, o_res_ber = 0x0, o_callback =
0x0, o_ctrls = 0x0, o_csn = {bv_len = 0, bv_val = 0x0}, o_private = 0x0, o_extra
= {slh_first = 0x0}, o_next = {stqe_next = 0x0}}
(gdb)

In another debug session, I found by stepping through the code that e is
initialized from bi->sql_baseObject, which is also 0x0.

My database layout looks like this (mostly the example layout with some minor
additions):

drop table if exists ldap_oc_mappings;
create table ldap_oc_mappings
 (
	id integer unsigned not null primary key auto_increment,
	name varchar(64) not null,
	keytbl varchar(64) not null,
	keycol varchar(64) not null,
	create_proc varchar(255),
	delete_proc varchar(255),
	expect_return tinyint not null
);

insert into ldap_oc_mappings
    (id, name, keytbl, keycol, expect_return)
values
    (1, "dcObject", "top_domain", "id", 0);

drop table if exists top_domain;
create table top_domain
(
    id integer unsigned not null primary key auto_increment,
    dc varchar(64) not null
);

insert into top_domain (id, dc) values (1, "hornetsecurity");

drop table if exists ldap_attr_mappings;
create table ldap_attr_mappings
 (
	id integer unsigned not null primary key auto_increment,
	oc_map_id integer unsigned not null references ldap_oc_mappings(id),
	name varchar(255) not null,
	sel_expr varchar(255) not null,
	sel_expr_u varchar(255),
	from_tbls varchar(255) not null,
	join_where varchar(255),
	add_proc varchar(255),
	delete_proc varchar(255),
	param_order tinyint not null,
	expect_return tinyint not null
);

insert into ldap_attr_mappings
    (id, oc_map_id, name, sel_expr, from_tbls, join_where)
values
    (1, 1, "dc", "dc", "pop_domain", NULL);

CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval)
    AS
        SELECT 0, UPPER('dc=hornetsecurity,dc=com'), 1, NULL, 1;

drop table if exists ldap_entry_objclasses;
create table ldap_entry_objclasses
 (
	entry_id integer not null references ldap_entries(id),
	oc_name varchar(64)
 );

insert into ldap_entry_objclasses values (0, 'top');