Bug 1181341

Summary: nsslapd-changelogtrim-interval and nsslapd-changelogcompactdb-interval are not validated
Product: Red Hat Enterprise Linux 7 Reporter: Viktor Ashirov <vashirov>
Component: 389-ds-baseAssignee: Noriko Hosoi <nhosoi>
Status: CLOSED ERRATA QA Contact: Viktor Ashirov <vashirov>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.2CC: nkinder, rmeggins, spichugi
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 389-ds-base-1.3.4.0-1.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-19 11:43:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Viktor Ashirov 2015-01-12 23:00:01 UTC
Description of problem:
nsslapd-changelogtrim-interval and nsslapd-changelogcompactdb-interval are not validated for syntax and can be multivalued.

Version-Release number of selected component (if applicable):
389-ds-base-1.3.3.1-11.el7.x86_64

How reproducible:
always

Steps to Reproduce:

[1]  Setup DS using "dc=example,dc=com"
[2]  Create the changelog
[3]  Set the changelog trim and compactdb intervals

dn: cn=changelog5,cn=config
changetype: modify
replace: nsslapd-changelogtrim-interval
nsslapd-changelogtrim-interval: -1
nsslapd-changelogtrim-interval: foobar
nsslapd-changelogtrim-interval: 15
-
replace: nsslapd-changelogcompactdb-interval
nsslapd-changelogcompactdb-interval: -1
nsslapd-changelogcompactdb-interval: foobar
nsslapd-changelogcompactdb-interval: 15

Actual results:
ldapsearch ... -b "cn=changelog5,cn=config" -s base nsslapd-changelogtrim-interval
dn: cn=changelog5,cn=config
nsslapd-changelogtrim-interval: -1
nsslapd-changelogtrim-interval: foobar
nsslapd-changelogtrim-interval: 15

ldapsearch ... -b "cn=changelog5,cn=config" -s base nsslapd-changelogcompactdb-interval
dn: cn=changelog5,cn=config
nsslapd-changelogcompactdb-interval: -1
nsslapd-changelogcompactdb-interval: foobar
nsslapd-changelogcompactdb-interval: 15

Expected results:
Server should validate values and allow attributes to be single-valued only.

Comment 2 Simon Pichugin 2015-07-27 09:12:28 UTC
Build tested: 389-ds-base-1.3.4.0-8.el7.x86_64

Commands:
[spichugi@dell-pesc430-01 ~]$ ldapmodify -h localhost -p 389 -x -v -a -D "cn=Directory Manager" -w Secret123
dn: cn=changelog5,cn=config
changetype: modify
replace: nsslapd-changelogtrim-interval

nsslapd-changelogtrim-interval: -1
Output:
ldap_modify: Server is unwilling to perform (53)
        additional info: nsslapd-changelogtrim-interval: invalid value "-1", nsslapd-changelogtrim-interval
 must range from 0 to 9223372036854775807 or digit[sSmMhHdD]

nsslapd-changelogtrim-interval: foobar
Output:
ldap_modify: Server is unwilling to perform (53)
        additional info: nsslapd-changelogtrim-interval: invalid value "foobar", nsslapd-changelogtrim-inte
rval must range from 0 to 9223372036854775807 or digit[sSmMhHdD]

nsslapd-changelogtrim-interval: 15
nsslapd-changelogtrim-interval: 16
Output:
ldap_modify: Object class violation (65)
        additional info: single-valued attribute "nsslapd-changelogtrim-interval" has multiple values

-
replace: nsslapd-changelogcompactdb-interval

nsslapd-changelogcompactdb-interval: -1
Output:
ldap_modify: Server is unwilling to perform (53)
        additional info: nsslapd-changelogcompactdb-interval: invalid value "-1", nsslapd-changelogcompactd
b-interval must range from 0 to 9223372036854775807 or digit[sSmMhHdD]

nsslapd-changelogcompactdb-interval: foobar
Output:
ldap_modify: Server is unwilling to perform (53)
        additional info: nsslapd-changelogcompactdb-interval: invalid value "foobar", nsslapd-changelogcomp
actdb-interval must range from 0 to 9223372036854775807 or digit[sSmMhHdD]

nsslapd-changelogcompactdb-interval: 15
nsslapd-changelogcompactdb-interval: 16
Output:
ldap_modify: Object class violation (65)
        additional info: single-valued attribute "nsslapd-changelogcompactdb-interval" has multiple values


Marking as verified.

Comment 3 errata-xmlrpc 2015-11-19 11:43:23 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2351.html