Bug 1662461

Summary: Log the actual base DN when the search fails with "invalid attribute request".
Product: Red Hat Enterprise Linux 7 Reporter: Têko Mihinto <tmihinto>
Component: 389-ds-baseAssignee: thierry bordaz <tbordaz>
Status: CLOSED ERRATA QA Contact: RHDS QE <ds-qe-bugs>
Severity: medium Docs Contact: Marc Muehlfeld <mmuehlfe>
Priority: high    
Version: 7.6CC: cobrown, gparente, hkhot, jvilicic, lkrispen, mreynolds, msauton, nkinder, pasik, sgouvern, spichugi, tbordaz, tscherf, vashirov, vmishra
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 389-ds-base-1.3.10.1-1.el7 Doc Type: Bug Fix
Doc Text:
.Directory Server now correctly logs the search base if the server rejects a search operation Previously, when Directory Server rejected a search operation because of a protocol error, the server logged `base="(null)"` instead of the actual search base. With this update, Directory Server passes the correct internal variable to the log operation. As a result, the server correctly logs the search base in the mentioned scenario.
Story Points: ---
Clone Of:
: 1720331 1801704 (view as bug list) Environment:
Last Closed: 2020-03-31 19:46:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1710435, 1713200, 1720331, 1801704    

Description Têko Mihinto 2018-12-28 17:30:54 UTC
Description of problem:

When a search fails because it requests more than one empty attribute,
the search base DN is always logged as "(null)".
This can make it difficult to troubleshoot customer issues.


Version-Release number of selected component (if applicable):

# rpm -qa | grep 389-ds-base-1
389-ds-base-1.3.8.4-18.el7_6.x86_64
#


How reproducible:

Always.


Steps to Reproduce:

# ldapsearch -xLLL -D "cn=Directory Manager" -W -b "dc=TekoSoft,dc=com" -sbase objectclass=* ""
Enter LDAP Password:
dn: dc=TekoSoft,dc=com

# ldapsearch -xLLL -D "cn=Directory Manager" -W -b "dc=TekoSoft,dc=com" -sbase objectclass=* "" "" ""
Enter LDAP Password:
Protocol error (2)
#


Actual results:

Access log excerpt:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[28/Dec/2018:17:42:10.152998700 +0100] conn=21 fd=64 slot=64 connection from ::1 to ::1
[28/Dec/2018:17:42:10.153155808 +0100] conn=21 op=0 BIND dn="cn=Directory Manager" method=128 version=3
[28/Dec/2018:17:42:10.153279838 +0100] conn=21 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0000198830 dn="cn=directory manager"
[28/Dec/2018:17:42:10.153426653 +0100] conn=21 op=1 SRCH base="dc=TekoSoft,dc=com" scope=0 filter="(objectClass=*)" attrs=""
[28/Dec/2018:17:42:10.153551106 +0100] conn=21 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0000204349
[28/Dec/2018:17:42:10.153710720 +0100] conn=21 op=2 UNBIND
[28/Dec/2018:17:42:10.153723276 +0100] conn=21 op=2 fd=64 closed - U1
[28/Dec/2018:17:42:19.466484844 +0100] conn=22 fd=64 slot=64 connection from ::1 to ::1
[28/Dec/2018:17:42:19.466712558 +0100] conn=22 op=0 BIND dn="cn=Directory Manager" method=128 version=3
[28/Dec/2018:17:42:19.466817359 +0100] conn=22 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0000289684 dn="cn=directory manager"
[28/Dec/2018:17:42:19.466979068 +0100] conn=22 op=1 SRCH base="(null)" scope=0 filter="(objectClass=*)", invalid attribute request
[28/Dec/2018:17:42:19.466999527 +0100] conn=22 op=1 RESULT err=2 tag=101 nentries=0 etime=0.0000075801
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


Expected results:

... SRCH base="dc=TekoSoft,dc=com"" scope=0 filter="(objectClass=*)", invalid attribute request


Additional info:

Related to the fix in bug https://bugzilla.redhat.com/show_bug.cgi?id=1624004

Comment 7 thierry bordaz 2019-06-07 09:25:24 UTC
Upstream ticket:
https://pagure.io/389-ds-base/issue/50428

Comment 8 thierry bordaz 2019-06-07 12:34:02 UTC
Bug fix pushed upstream -> POST

Comment 12 sgouvern 2019-09-26 15:39:25 UTC
Verified on :
[root@ci-vm-10-0-136-194 upstream]# rpm -qa | grep 389
389-ds-base-1.3.10.1-2.el7.x86_64

automated test : s_logs_test.py::test_log_base_dn_when_invalid_attr_request output :

====================================================== warnings summary ======================================================
ds/dirsrvtests/tests/suites/ds_logs/ds_logs_test.py:735
  /mnt/tests/rhds/tests/upstream/ds/dirsrvtests/tests/suites/ds_logs/ds_logs_test.py:735: DeprecationWarning: invalid escape sequence \(
    """

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.bz1273549 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.bz1358706 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.ds49029 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.ds49232 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.bz1732053 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.ds50510 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.bz1662461 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

/opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324
  /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/_pytest/mark/structures.py:324: PytestUnknownMarkWarning: Unknown pytest.mark.ds50428 - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/latest/mark.html
    PytestUnknownMarkWarning,

-- Docs: https://docs.pytest.org/en/latest/warnings.html
=============================================== 1 passed, 9 warnings in 10.71s ===============================================

Comment 17 errata-xmlrpc 2020-03-31 19:46:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1064