Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() #6325

droideck · 2024-09-12T23:33:40Z

Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING.

Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case.

Fixes: #6324

Reviewed by: ?

…up_ol_tls_conn() Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: 389ds#6324 Reviewed by: ?

droideck · 2024-09-13T02:46:39Z

I'm not sure why but the test passes on my machine (and on a virtual machine). But it can't find the error message in GitHub CI.
Probably, it's because we have Docker here, and the issue is triggered when certificate is removed from systemd tmp.

progier389 · 2024-09-13T13:34:22Z

At least the C code looks good.
About the failing test test I find a bit surprising that we are not seeing any log about the deleted cert files:
cacert list should not be empty of the test would be skipped. And neither successful deletion or failed one are logged.
So I wonder if the delete operation has not failed and our logger does ignore the warning level
Maybe you should rather use log.info (as we know that info are logged!)
And probably worth to log,info(f'ca_files={ca_files}') to help debugging the testcase

droideck · 2024-09-17T04:47:46Z

Okay, the issue was that I tried to grab the wrong error.

The error I need to check for is: error:80000002:system library::No such file or directory. It is the error that happens during the TLS context set when the cert is missing.

But there's another error that happens earlier in the function. And they are different between GitHub CI and my virtual machine mock run.

GitHub CI - error:0200008A:rsa routines::invalid padding
My env - error:0A000086:SSL routines::certificate verify failed

Why it's different, it's another story I am not sure still.

vashirov · 2024-09-17T09:36:09Z

What version of openssl do you have? In the CI image I see openssl-3.2.2-3.fc40

droideck · 2024-09-17T14:24:15Z

What version of openssl do you have? In the CI image I see openssl-3.2.2-3.fc40

It's the same on my machine - openssl-3.2.2-3.fc40.x86_64

progier389

LGTM

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

@progier389

…up_ol_tls_conn() (#6325) Description: When there's a problem with creating a new TLS context, we just fail with -1 error code. We can improve it by providing more information that can be extracted from LDAP_OPT_DIAGNOSTIC_MESSAGE or LDAP_OPT_ERROR_STRING. Use slapi_ldap_get_lderrno to get more information from the ld structure. Add a test case. Fixes: #6324 Reviewed by: @progier389 (Thanks!)

Fix error and enhance test logs

d535ffd

droideck force-pushed the i6324 branch from 8ed855e to d535ffd Compare September 17, 2024 03:39

progier389 approved these changes Sep 17, 2024

View reviewed changes

droideck merged commit 82dcdab into 389ds:main Sep 18, 2024
197 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() #6325

Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() #6325

droideck commented Sep 12, 2024

droideck commented Sep 13, 2024 •

edited

Loading

progier389 commented Sep 13, 2024

droideck commented Sep 17, 2024

vashirov commented Sep 17, 2024

droideck commented Sep 17, 2024

progier389 left a comment

Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() #6325

Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() #6325

Conversation

droideck commented Sep 12, 2024

droideck commented Sep 13, 2024 • edited Loading

progier389 commented Sep 13, 2024

droideck commented Sep 17, 2024

vashirov commented Sep 17, 2024

droideck commented Sep 17, 2024

progier389 left a comment

Choose a reason for hiding this comment

droideck commented Sep 13, 2024 •

edited

Loading