use of server-side sorting and virtual list view controls blocks slapd

Hi all,

We encounter a problem using server-side sort and virtual list view controls in our search requests. After sending one search requests the slapd remains busy until it is restarted:

Executing the command

/home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children -E!sss=sncertnr -E!vlv="0/0/1/0" "objectclass=*"

Generates the following output:

# extended LDIF

# LDAPv3

# base <o=CustomerCA,c=de> with scope children

# filter: objectclass=*

# requesting: sncertnr

# with server side sorting critical control

# with virtual list view critical control: 0/0/1/0

# R\C3\BCger OttoSER:9000, testsuite, CustomerCA, de

dn:: Y249UsO8Z2VyIE90dG9TRVI6OTAwMCxvdT10ZXN0c3VpdGUsbz1DdXN0b21lckNBLGM9ZGU=

SNcertNr: 9000

# search result

search: 2

result: 0 Success

control: 1.2.840.113556.1.4.474 false MAMKAQA=

sortResult: (0) Success

control: 2.16.840.1.113730.3.4.10 false MA8CAQECAQsCAQAEBJB4LAg=

vlvResult: pos=1 count=11 context=kHgsCA== (0) Success

# numResponses: 2

# numEntries: 1

Press [before/after(/offset/count|:value)] Enter for the next window.

# extended LDIF

# LDAPv3

# base <o=CustomerCA,c=de> with scope children

# filter: objectclass=*

# requesting: sncertnr

# with server side sorting critical control

# with virtual list view critical control: 0/0/1/11

# search result

search: 3

result: 4 Size limit exceeded

# numResponses: 1

Why is the size limit exceeded here?

Executing the same command once more produces the following output:

# extended LDIF

# LDAPv3

# base <o=CustomerCA,c=de> with scope children

# filter: objectclass=*

# requesting: sncertnr

# with server side sorting critical control

# with virtual list view critical control: 0/0/1/0

# search result

search: 2

result: 51 Server is busy

text: Other sort requests already in progress

# numResponses: 1

Now slapd doesn’t accept sssvlv requests anymore, it has to be restarted.

Here is the content of slapd.conf:

# See slapd.conf(5) for details on configuration options.

# This file should NOT be world readable.

include /home/openldap/openldap-2.4.21-install/etc/openldap/schema/core.schema

include /home/openldap/openldap-2.4.21-install/etc/openldap/schema/isis_mtt_extensions.schema

include /home/openldap/openldap-2.4.21-install/etc/openldap/schema/secunet_isis_mtt_extensions.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory

# service AND an understanding of referrals.

#referral ldap://root.openldap.org

pidfile /home/openldap/openldap-2.4.21-install/var/run/slapd.pid

argsfile /home/openldap/openldap-2.4.21-install/var/run/slapd.args

# Load dynamic backend modules:

modulepath /home/openldap/openldap-2.4.21-install/libexec/openldap

# modulepath /usr/local/libexec/openldap

moduleload back_bdb.la

# moduleload back_hdb.la

# moduleload back_ldap.la

# moduleload /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch

# moduleload /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.la

# moduleload compmatch.la

# overlay server-side-sorting + virtual list view:

overlay sssvlv

# Sets the maximum number of concurrent sort requests allowed

# across all connections; the default is one half of the number of

# server threads:

sssvlv-max 8

# Sets the maximum number of keys allowed in a sort request; the

# default is 5:

sssvlv-maxkeys 5

# Sample security restrictions

# Require integrity protection (prevent hijacking)

# Require 112-bit (3DES or better) encryption for updates

# Require 63-bit encryption for simple bind

# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:

# Root DSE: allow anyone to read it

# Subschema (sub)entry DSE: allow anyone to read it

# Other DSEs:

# Allow self write access

# Allow authenticated users read access

# Allow anonymous users to authenticate

# Directives needed to implement policy:

# access to dn.base="" by * read

# access to dn.base="cn=Subschema" by * read

# access to *

# by self write

# by users read

# by anonymous auth

# if no access controls are present, the default policy

# allows anyone and everyone to read anything but restricts

# updates to rootdn. (e.g., "access to * by * read")

# rootdn can always read and write EVERYTHING!

#######################################################################

# BDB database definitions

#######################################################################

database bdb

suffix ""

rootdn "cn=openldapadmin"

# Cleartext passwords, especially for the rootdn, should

# be avoid. See slappasswd(8) and slapd.conf(5) for details.

# Use of strong authentication encouraged.

rootpw welcome

# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended.

directory /home/openldap/openldap-2.4.21-install/var/openldap-data

# Indices to maintain

index objectClass eq

index c eq

index o eq

index ou eq

index sncertnr eq

index sncerthash eq

index snissuerkeyhash eq

index snissuernamehash eq

Does anybody have an idea?

Executing this command against a Sun DS 6 server doesn’t generate this problem.

Regards,

Hartmut