Bug 1042855

(In reply to Milan Kubík from comment #0)
> Description of problem:
> The directory server does not verify the value being added to replication
> agreement.
> 
> Version-Release number of selected component (if applicable):
> 389-ds-base-1.3.1.6-12.el7.x86_64
> 
> How reproducible:
> Always
> 
> Steps to Reproduce:
> 1. Do all the necessary steps to set up a replica.
> 2a. Create/modify a replication agreement with negative integer. 
> 2b. Create/modify a replication agreement with non-integer value.
> 
> Actual results:
> a) The value is accepted.

But... the value is converted to use the default timeout under since exact scenario.  I will change this to just give an error.

> b) The server returns error 21 - invalid syntax.

This is the correct error/result.  


I will work on correcting (a)

Thanks,
Mark

> 
> Expected results:
> Negative value or non-integer is rejected with error 53, unwilling to
> perform.
> 
> Additional info:
> From the results I guess there is no validation in this case and the two
> scenarios are one issue. Also it is inconsistent with the error code
> returned by the directory server when this steps are being performed on the
> replica entry.

Ad a) when queried, it returns the negative value. I don't know/haven't tried what timeout would be would actually be used.

Ad b) then the result 53 returned when this is done on replica entry is wrong? Or this inconsistency is not an issue?

Thanks

(In reply to Milan Kubík from comment #3)
> Ad a) when queried, it returns the negative value. I don't know/haven't
> tried what timeout would be would actually be used.

It is converted internally in the replication code - it does not modify the config, but I will correct this.  So no worries.

> 
> Ad b) then the result 53 returned when this is done on replica entry is
> wrong? Or this inconsistency is not an issue?

I'm not sure I follow.  As long as the operation is rejected, we have the result we want.  Technically speaking, error 53 is not the standard error message for rejecting an update - it is one of many errors that could be returned.

> 
> Thanks

At the moment the results for replica and replication agreement respectively are:

ldap_modify: DSA is unwilling to perform
ldap_modify: additional info: attribute nsds5ReplicaProtocolTimeout value (fifteen) is invalid, must be a number greater than zero.

modifying entry cn=replica,cn="o=airius.com",cn=mapping tree,cn=config

ldap_modify: Invalid syntax
ldap_modify: additional info: nsds5ReplicaProtocolTimeout: value #0 invalid per syntax

modifying entry cn=24222_to_24212,cn=replica,cn="o=airius.com",cn=mapping tree,cn=config

The error 53 and the message seem to me like a better response to this update than syntax error. However, if the point is to just to refuse the change, I'll content any value other than 0.

(In reply to Milan Kubík from comment #5)
> At the moment the results for replica and replication agreement respectively
> are:
> 
> ldap_modify: DSA is unwilling to perform
> ldap_modify: additional info: attribute nsds5ReplicaProtocolTimeout value
> (fifteen) is invalid, must be a number greater than zero.
> 
> modifying entry cn=replica,cn="o=airius.com",cn=mapping tree,cn=config
> 
> ldap_modify: Invalid syntax
> ldap_modify: additional info: nsds5ReplicaProtocolTimeout: value #0 invalid
> per syntax
> 
> modifying entry cn=24222_to_24212,cn=replica,cn="o=airius.com",cn=mapping
> tree,cn=config
> 
> The error 53 and the message seem to me like a better response to this
> update than syntax error. However, if the point is to just to refuse the
> change, I'll content any value other than 0.

Ok I see.  There is a difference between modifying the replica entry and the agreement.  Ultimately we are getting a correct result, but yes it should be consistent.  I'll look into this as well.

Everything is now fixed and working as expected.  Fixed upstream.

I think we've got a regression here.

$ ldapmodify -x -h localhost -p 24202 -D "cn=directory manager" -w Secret123 <<EOF
> dn: cn=24202_to_24224,cn=replica,cn=o\=airius.com,cn=mapping tree,cn=config
> changetype: modify
> delete: nsds5ReplicaProtocolTimeout
> EOF
modifying entry "cn=24202_to_24224,cn=replica,cn=o\=airius.com,cn=mapping tree,cn=config"
ldap_modify: Server is unwilling to perform (53)
        additional info: attribute nsds5ReplicaProtocolTimeout value () is invalid, must be a number greater than zero.

$ rpm -qa 389-ds-base
389-ds-base-1.3.1.6-14.el7.x86_64

Fixed upstream

----------------- Starting Test replica_timeout_11 -------------------------
Delete the attribute from an replica or replication agreement entry.
                                                                  
Deleting the value from replication agreement on S1.
modifying entry cn=24202_to_24224,cn=replica,cn="o=airius.com",cn=mapping tree,cn=config

Successfully deleted the timeout from replication agreement.
TestCase [replica_timeout_11] result-> [PASS]
Deleting the value from replica on S1.
modifying entry cn=replica,cn="o=airius.com",cn=mapping tree,cn=config

Successfully deleted the timeout from replica.
TestCase [replica_timeout_11] result-> [PASS]

PASS for all related test cases. Bug verified.

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.