[Pkg-openldap-devel] Bug#868753: slapd: Please include several upstream fixes

[Sven Maeder]

Package: slapd
Version: 2.4.44+dfsg-5
Severity: important

Dear Maintainer,

We noticed several issues related to delta-syncrepl in a 3-way
multi-master setup. The issues seem to be caused by bugs in upstream,
which are fixed in upstream version of Openldap 2.4.45.
We successfully tested a build of Openldap 2.4.45: All issues (1-4)
seem to be resolved.

Please find below the list of issues 1-4 (incl. possibly rel. ITS#):


1. Endless replication loop after fast subsequent modifications

Related ITS#:

- ITS#8432: Never ending operation modifications with 3+ MMR nodes
  (http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8432)

Steps to reproduce:

- Modify attribute A of cn=00000,ou=tt,dc=phys,dc=ethz,dc=ch on phd-aa1
- Wait for a short period of time (<= ~10-100ms), or not at all.
- At this point the change was most probably not yet synced to the other
  nodes, before that sync happens, repeat the modify:
- Modify attribute A of cn=00000,ou=tt,dc=phys,dc=ethz,dc=ch on phd-aa1
- Now the 3 slapds are somehow in a loop, sending cookies forever
- Sometimes a restart of all slapds helps to kill the loop
- Sometimes a stop of at least 2 slapds was nessecary to kill the loop
- Subsequent modifications had to occur in a variable time frame lower
  than 10-100 ms in my tests to cause the loop.

Outcome:

- Endless syncrepl loop, 100% CPU load on all nodes


2. Occasionally slapd hangs on shutdown

Steps to reproduce:

- Occasionally when restarting/stopping the slapd service (using
  `systemctl restart/stop slapd`), process hangs with 100% CPU load.
- Only a `kill -9 <PID>` helps. In the logs is stated that slapd is
  waiting for some tasks: `slapd shutdown: waiting for 2
  operations/tasks to finish`


3. Occasionally slapd crashes when another master is restarted

Possibly (not sure) related ITS# (same symptoms: slapd crash):

- ITS#8413: Assertion in back-mdb/search.c during replication
  (http://www.openldap.org/its/index.cgi/?findid=8413)

Steps to reproduce:

- Occasionally when making an update using ldapmodify and after that
  restarting slapd on the same host, it happens that slapd process on
  one of the other masters crashes (nothing showing in the error log)


4. Unwilling slapd after service restart (Error code 53)

This seems to be a temporary hickup under some circumstances, which
fixes itself after another ldapmodify on the unwillig slapd.

Steps to reproduce:

- Setup phd-aa1 (ID 000): initial master config + add data dump
- Setup phd-aa2 (ID 001): replicates all data
- Setup phd-aa3 (ID 002): replicates all data
- Test replication using ldapmodify of an attribute on each master
  separately: all syncing correctly
- Restart slapd on phd-aa1: all ok (all syncing)
- Restart slapd on phd-aa2: now this one starts reporting in the logs
  that phd-aa1 (rid=004) is unwilling:
  `do_syncrep2: rid=004 (53) Server is unwilling to perform`
- Restart slapd on phd-aa3: now this one starts reporting the same.
- Syncrepl tries to reconnect according to the retry parameter interval,
  logging the error above on each cycle.
- After another ldapmodify on phd-aa1 all masters are syncing correctly
  the error message above is gone, all logs look ok.


For more information on the exact setup and configuration,
please refer to:

- https://people.phys.ethz.ch/~rda/openldap/delta-syncrepl/questions_issues.html
- https://people.phys.ethz.ch/~rda/openldap/delta-syncrepl/config.ldif


-- System Information:
Debian Release: 9.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages slapd depends on:
ii  adduser                            3.115
ii  coreutils                          8.26-3
ii  debconf [debconf-2.0]              1.5.61
ii  libc6                              2.24-11+deb9u1
ii  libdb5.3                           5.3.28-12+b1
ii  libgnutls30                        3.5.8-5+deb9u1
ii  libldap-2.4-2                      2.4.44+dfsg-5
ii  libltdl7                           2.4.6-2
ii  libodbc1                           2.3.4-1
ii  libperl5.24 [libmime-base64-perl]  5.24.1-3
ii  libsasl2-2                         2.1.27~101-g0780600+dfsg-3
ii  libwrap0                           7.6.q-26
ii  lsb-base                           9.20161125
ii  perl                               5.24.1-3
ii  psmisc                             22.21-2.1+b2

Versions of packages slapd recommends:
ii  libsasl2-modules  2.1.27~101-g0780600+dfsg-3

Versions of packages slapd suggests:
ii  ldap-utils                   2.4.44+dfsg-5
ii  libsasl2-modules-gssapi-mit  2.1.27~101-g0780600+dfsg-3

-- debconf information excluded