[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ITS#6475



>> Such a behavior allows replays attacks
>> within the modification propagation time frame, but it ensures that bind
>> are still possible when then master is down. I think it could be
>> interesting to have a configuration setting for that.
>
> We should bring this to -devel, to see whether it makes sense and whether
> it would be acceptable.

A fix in this sense is in HEAD.  Modifications consist in the original
patch (well-known SASL mechs exploit the dontUseCopy control to actually
lookup and propagate auxprops to the master ("sasl-auxprops-dontusecopy"
directive).  Another directive ("sasl-auxprops-dontusecopy-ignore") allows
to ignore errors and lookup/store auxprops locally.  By default it's FALSE
for consistency.  If set to TRUE, replicas will be misaligned, but service
will be possible.  Choose what best fits your needs.  Both directives are
not documented yet, as I consider the whole code highly experimental. 
Right now, is only built when #define LDAP_DEVEL.

Please note that the relatively minor modifications to slapo-chain(5) are
not conditioned on #define SLAP_AUXPROP_DONTUSECOPY, because I think they
are generally useful, and I've checked they don't break anything (I could
check so far).  Please report any inconvenience.

p.