Bug 1438526
| Summary: | Server allows to set any nsds5replicaid in the existing replica entry | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Simon Pichugin <spichugi> |
| Component: | 389-ds-base | Assignee: | mreynolds |
| Status: | CLOSED ERRATA | QA Contact: | Viktor Ashirov <vashirov> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.4 | CC: | nkinder, rmeggins |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | 389-ds-base-1.3.7.5-6.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 14:15:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Upstream ticket: https://pagure.io/389-ds-base/issue/49408 ================= test session starts =================
platform linux -- Python 3.6.3, pytest-3.2.5, py-1.5.2, pluggy-0.4.0 -- /opt/rh/rh-python36/root/usr/bin/python3
cachedir: .cache
metadata: {'Python': '3.6.3', 'Platform': 'Linux-3.10.0-768.el7.x86_64-x86_64-with-redhat-7.5-Maipo', 'Packages': {'pytest': '3.2.5', 'py': '1.5.2', 'pluggy': '0.4.0'}, 'Plugins': {'metadata': '1.5.0', 'html': '1.16.0'}}
389-ds-base: 1.3.7.5-9.el7
nss: 3.34.0-0.1.beta1.el7
nspr: 4.17.0-1.el7
openldap: 2.4.44-9.el7
svrcore: 4.1.3-2.el7
rootdir: /mnt/tests/rhds/tests/upstream/ds, inifile:
plugins: metadata-1.5.0, html-1.16.0
collected 1 item
dirsrvtests/tests/suites/replication/replica_config_test.py::test_replicaid_modification PASSED
================= 1 passed in 9.98 seconds =================
Marking as VERIFIED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0811 |
Description of problem: We can break the nsds5replicaid attribute rules (it should be 1 to 65534 for suppliers) if we'll try to modify the existing replication entry. Version-Release number of selected component (if applicable): 389-ds-base-1.3.6.1-5.el7.x86_64 How reproducible: Always Steps to Reproduce: [1] Install an instance [2] Add a replica entry: [root@qeos-175 ds]# ldapmodify -a -h localhost -p 389 -D "cn=Directory manager" -w Secret123 dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=sync user,cn=config nsDS5ReplicaId: 7 nsDS5ReplicaRoot: dc=example,dc=com nsDS5ReplicaType: 3 objectClass: top objectClass: nsDS5Replica objectClass: extensibleobject adding new entry "cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" [3] Check the entry: [root@qeos-175 ds]# ldapsearch -h localhost -p 389 -D "cn=Directory manager" -w Secret123 -b "cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" # replica, dc\3Dexample\2Cdc\3Dcom, mapping tree, config dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=sync user,cn=config nsDS5ReplicaId: 7 nsDS5ReplicaRoot: dc=example,dc=com nsDS5ReplicaType: 3 objectClass: top objectClass: nsDS5Replica objectClass: extensibleobject nsState:: BwAAAAAAAADycuJYAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAA== nsDS5ReplicaName: 65766987-188711e7-80a2fa60-3a60cc96 nsds5ReplicaChangeCount: 0 nsds5replicareapactive: 0 [4] Set nsDS5ReplicaId to some wrong_id format: [root@qeos-175 ds]# ldapmodify -h localhost -p 389 -D "cn=Directory manager" -w Secret123 dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config changetype: modify replace: nsDS5ReplicaId nsDS5ReplicaId: wrong_id modifying entry "cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" [5] Check the entry: [root@qeos-175 ds]# ldapsearch -h localhost -p 389 -D "cn=Directory manager" -w Secret123 -b "cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" # replica, dc\3Dexample\2Cdc\3Dcom, mapping tree, config dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=sync user,cn=config nsDS5ReplicaId: wrong_id nsDS5ReplicaRoot: dc=example,dc=com nsDS5ReplicaType: 3 objectClass: top objectClass: nsDS5Replica objectClass: extensibleobject nsState:: BwAAAAAAAADycuJYAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAA== nsDS5ReplicaName: 65766987-188711e7-80a2fa60-3a60cc96 nsds5ReplicaChangeCount: 0 nsds5replicareapactive: 0 Actual results: It is possible to set bogus replica id to the existing replica entry Expected results: Operation error should happen when we try to set bogus replica id Additional info: - Operation error happens with a wrong replica id when we are creating the replica entry initially. - It is impossible to set nsDS5ReplicaId to something in the second time: [root@qeos-175 ds]# ldapmodify -h localhost -p 389 -D "cn=Directory manager" -w Secret123 dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config changetype: modify replace: nsDS5ReplicaId nsDS5ReplicaId: 8 modifying entry "cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" ldap_modify: Operations error (1) additional info: replica type is already 2 - not changing