Bug 723514 - DDS overlay tolerance parametr doesn't function and breakes default ttl
Summary: DDS overlay tolerance parametr doesn't function and breakes default ttl
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openldap
Version: 6.1
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Jan Vcelak
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks: 733069
TreeView+ depends on / blocked
 
Reported: 2011-07-20 12:16 UTC by David Spurek
Modified: 2015-03-02 05:26 UTC (History)
7 users (show)

Fixed In Version: openldap-2.4.23-17.el6
Doc Type: Bug Fix
Doc Text:
- OpenLDAP server with 'dds' overlay configured and olcDDStolerance is set. - The dynamic entries are deleted before their TTL is expired. olcDDStolerance is shortening dynamic entries TTL, instead of its prolonging. - The patch was applied to correctly evaluate real time of dynamic entries deletion. - The dynamic entries real lifetime is entry's entryTtl + olcDDStolerance as described in documentation
Clone Of:
: 733069 (view as bug list)
Environment:
Last Closed: 2011-12-06 12:13:04 UTC
Target Upstream Version:


Attachments (Terms of Use)
Slapd configuration file (1.56 KB, application/octet-stream)
2011-07-20 12:16 UTC, David Spurek
no flags Details
proposed patch (878 bytes, patch)
2011-08-11 18:22 UTC, Jan Vcelak
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1514 normal SHIPPED_LIVE openldap bug fix and enhancement update 2011-12-06 00:51:20 UTC

Description David Spurek 2011-07-20 12:16:55 UTC
Created attachment 513997 [details]
Slapd configuration file

Description of problem:
DDS overlay tolerance parametr doesn't function. Default ttl parametr work bad with set dds-tolerance. EntryTtl attribute has right value, but entry is delete before ttl expiration.

Version-Release number of selected component (if applicable):
openldap-servers-2.4.23-15.el6

How reproducible:
always

Steps to Reproduce:
1.slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
(slapd.conf is in attachement)
2.add entry
dn: cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=my-domain,dc=com
objectClass: groupOfNames
objectClass: dynamicObject
cn: OpenLDAP Documentation Meeting
member: cn=testusr1, dc=my-domain,dc=com
member: cn=testusr2, dc=my-domain,dc=com

3.sleep 120
4. ldapsearch -LLL -x -b 'cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=my-domain,dc=com' \"(objectClass=dynamicObject)\"
  
Actual results:
Entry cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=my-domain,dc=com doesn't exist after 120s (lifetime should be entryTtl  +  tolerance = 240s). Even entry doesn't exist after 30s.

Expected results:
Entry should be exist after 120s.

Comment 1 Jan Vcelak 2011-08-11 18:22:18 UTC
Created attachment 517864 [details]
proposed patch

olcDDStolerance setting had inverse effect and in fact was shortening entries real TTL. Attaching patch. It will be submitted upstream.

Comment 3 Jan Vcelak 2011-08-15 08:25:09 UTC
Resolved in openldap-2.4.23-17.el6

Comment 4 Jan Vcelak 2011-08-15 11:29:22 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
- OpenLDAP server with 'dds' overlay configured and olcDDStolerance is set.
- The dynamic entries are deleted before their TTL is expired. olcDDStolerance is shortening dynamic entries TTL, instead of its prolonging.
- The patch was applied to correctly evaluate real time of dynamic entries deletion.
- The dynamic entries real lifetime is entry's entryTtl + olcDDStolerance as described in documentation

Comment 7 errata-xmlrpc 2011-12-06 12:13:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1514.html


Note You need to log in before you can comment on or make changes to this bug.