Red Hat Bugzilla – Bug 1445188
Misleading error message - Incoming BER Element was 3 bytes
Last modified: 2018-05-15 14:35:56 EDT
Description of problem: Because of a wrong port number used in commandline for ladpmodify, I am getting in error logs - [25/Apr/2017:03:03:32.806827033 -0400] - ERR - log_ber_too_big_error - conn=12 fd=64 Incoming BER Element was 3 bytes, max allowable is 2097152 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. which is misleading Version-Release number of selected component (if applicable): 389-ds-base-1.3.6.1-9.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Configure MMR with SSL 2. execute - /usr/lib64/mozldap/ldapmodify -Z -P "/etc/dirsrv/slapd-M1/cert8.db" -W secret12 -p 30100 -h localhost -D "cn=directory manager" -w Secret123 << EOF dn: uid=new_user4,dc=example,dc=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson uid: new_user4 sn: new_user4 cn: new_user4 EOF where 30100 is non-ssl port (wrong port number) 3. you will get below on command line - ldap_simple_bind: Can't contact LDAP server SSL error -5938 (Encountered end of file.) 4. And in error messages, it will show - [25/Apr/2017:03:13:17.830291071 -0400] - ERR - log_ber_too_big_error - conn=16 fd=64 Incoming BER Element was 3 bytes, max allowable is 2097152 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [25/Apr/2017:03:22:08.700482270 -0400] - ERR - log_ber_too_big_error - conn=22 fd=64 Incoming BER Element was 3 bytes, max allowable is 2097152 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. Actual results: Error message for a wrong port- [25/Apr/2017:03:13:17.830291071 -0400] - ERR - log_ber_too_big_error - conn=16 fd=64 Incoming BER Element was 3 bytes, max allowable is 2097152 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [25/Apr/2017:03:22:08.700482270 -0400] - ERR - log_ber_too_big_error - conn=22 fd=64 Incoming BER Element was 3 bytes, max allowable is 2097152 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. Expected results: Errors message should be helpful in pointing out the mistake. Additional info:
Here the error message says "ERR - log_ber_too_big_error - conn=16 fd=64 Incoming BER Element was 3 bytes, max allowable is 2097152 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase." Even if you try to change the nsslapd-maxbersize attribute in cn=config to increase, it does not help to resolve the issue and leads to more confusion.
I've seen this before. It's when you use TLS on a ldap:// port. This could be easy to detect and fix but I seem to remember last I looked at it, it was more annoying than I thought.
Upstream ticket: https://pagure.io/389-ds-base/issue/49377
After discussion on IRC it is clear that we can still get both of these error messages in some cases. Hence marking bug as verified. Thanks @wibrown
You're welcome Amita!
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0811