Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1150694 - Encoding of SearchResultEntry is missing tag
Encoding of SearchResultEntry is missing tag
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base (Show other bugs)
7.0
Unspecified Unspecified
urgent Severity urgent
: rc
: ---
Assigned To: Noriko Hosoi
Viktor Ashirov
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2014-10-08 13:19 EDT by Noriko Hosoi
Modified: 2015-03-05 04:36 EST (History)
5 users (show)

See Also:
Fixed In Version: 389-ds-base-1.3.3.1-6.el7
Doc Type: Bug Fix
Doc Text:
Cause: The encoding of the PreReadControl,PostReadControl does not contain the tag (LDAP_RES_SEARCH_ENTRY = constructed+application). Consequence: The missing tag is a violation of LDAP (Lightweight Directory Access Protocol). Fix: Add the tag to the ber encoding. Result: The server does not violate the protocol.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-03-05 04:36:09 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0416 normal SHIPPED_LIVE Important: 389-ds-base security, bug fix, and enhancement update 2015-03-05 09:26:33 EST

  None (edit)
Description Noriko Hosoi 2014-10-08 13:19:37 EDT
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47920

ldap/servers/slapd/result.c:2179 contains this:
ber_printf( ber, "{s{", slapi_entry_get_dn_const(e) );

However, the actual structure is:
SearchResultEntry ::= [APPLICATION 4] SEQUENCE {
  objectName      LDAPDN,
  attributes      PartialAttributeList
}

Notice that the Application 4 tag is missing.
Comment 1 Sankar Ramalingam 2014-10-08 22:44:36 EDT
Please add verification steps
Comment 2 Noriko Hosoi 2014-10-08 23:04:21 EDT
Hi Thierry, 
Could there be an isolated reproducer for this issue?
If yes, could you share with us?
Comment 3 thierry bordaz 2014-10-09 03:55:39 EDT
Hello Noriko,

In the ticket I provided a test case https://fedorahosted.org/389/attachment/ticket/47920/ticket47920_test.py.

By isolated reproducer do you mean a test case integrated into the CI tests ?

thanks
thierry
Comment 4 Noriko Hosoi 2014-10-09 11:59:07 EDT
(In reply to thierry bordaz from comment #3)
> Hello Noriko,
> 
> In the ticket I provided a test case
> https://fedorahosted.org/389/attachment/ticket/47920/ticket47920_test.py.
> 
> By isolated reproducer do you mean a test case integrated into the CI tests ?
> 
> thanks
> thierry

Cool!  (Sorry, Thierry.  I should have remembered you added the test case... :p)

That's perfect for the verification.  Thanks, Thierry!
Comment 8 Amita Sharma 2014-11-24 11:53:23 EST
executed 
https://fedorahosted.org/389/attachment/ticket/47920/ticket47920_test.py

Result ::
[root@dhcp201-126 export]# python test.py
*** <ldap.ldapobject.SimpleLDAPObject instance at 0x7ffa47daba70> ldap://localhost:389/ - SimpleLDAPObject.set_option
((17, 3), {})
=> result:
None
*** <ldap.ldapobject.SimpleLDAPObject instance at 0x7ffa47daba70> ldap://localhost:389/ - SimpleLDAPObject.simple_bind
(('cn=directory manager', 'Secret123', None, None), {})
=> result:
1
*** <ldap.ldapobject.SimpleLDAPObject instance at 0x7ffa47daba70> ldap://localhost:389/ - SimpleLDAPObject.result4
((1, 1, -1, 0, 0, 0), {})
=> result:
(97, [], 1, [])
*** <ldap.ldapobject.SimpleLDAPObject instance at 0x7ffa47daba70> ldap://localhost:389/ - SimpleLDAPObject.add_ext
(('uid=foo,dc=example,dc=com',
  [('objectClass', ['account']),
   ('uid', ['foo']),
   ('description', ['original description'])],
  None,
  None),
 {})
=> result:
2
*** <ldap.ldapobject.SimpleLDAPObject instance at 0x7ffa47daba70> ldap://localhost:389/ - SimpleLDAPObject.modify_ext
(('uid=foo,dc=example,dc=com',
  [(2, 'description', 'new description')],
  [('1.3.6.1.1.13.2', True, '0\x12\x04\x03uid\x04\x0bdescription')],
  None),
 {})
=> result:
3
*** <ldap.ldapobject.SimpleLDAPObject instance at 0x7ffa47daba70> ldap://localhost:389/ - SimpleLDAPObject.result4
((3, 1, -1, 0, 0, 0), {})
=> result:
(103,
 [],
 3,
 [('1.3.6.1.1.13.2',
   0,
   'dM\x04\x19uid=foo,dc=example,dc=com000\x0c\x04\x03uid1\x05\x04\x03foo0 \x04\x0bdescription1\x11\x04\x0fnew description')])
resp_ctrls[0].dn: uid=foo,dc=example,dc=com
resp_ctrls[0].entry:
{'description': ['new description'], 'uid': ['foo']}

Hence marking as VERIFIED.
Comment 10 errata-xmlrpc 2015-03-05 04:36:09 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0416.html

Note You need to log in before you can comment on or make changes to this bug.