Bug 39963 - CONNECT_ERROR not handled by UDM module
CONNECT_ERROR not handled by UDM module
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: UMC - Domain management (Generic)
UCS 4.2
Other Linux
: P5 normal (vote)
: UCS 4.2-1-errata
Assigned To: Florian Best
Johannes Keiser
:
: 39325 44608 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-11-16 09:03 CET by Florian Best
Modified: 2017-08-21 11:06 CEST (History)
0 users

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 6: Setup Problem: Issue for the setup process
Who will be affected by this bug?: 2: Will only affect a few installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.206
Enterprise Customer affected?: Yes
School Customer affected?:
ISV affected?:
Ticket number: 2016100421000557, 2017052821000092, 2017061421000697, 2017060121000274, 2017070821000214, 2017081721000357
Bug group (optional): Error handling, External feedback
Max CVSS v3 score:


Attachments
patch (2.72 KB, patch)
2017-06-20 12:42 CEST, Florian Best
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2015-11-16 09:03:09 CET
4.0-4 errata363 (Walle)

Traceback (most recent call last):
  File "%PY2.7%/univention/management/console/protocol/modserver.py", line 265, in handle
    self.__handler.init()
  File "%PY2.7%/univention/management/console/modules/udm/__init__.py", line 157, in init
    self.settings = UDM_Settings()
  File "%PY2.7%/univention/management/console/modules/udm/udm_ldap.py", line 1022, in __init__
    self.read()
  File "%PY2.7%/univention/management/console/modules/udm/udm_ldap.py", line 1025, in read
    self._read_directories()
  File "%PY2.7%/univention/management/console/modules/udm/udm_ldap.py", line 161, in _decorated
    return func(*args, **kwargs)
  File "%PY2.7%/univention/management/console/modules/udm/udm_ldap.py", line 153, in wrapper_func
    return _func(*args, **kwargs)
  File "%PY2.7%/univention/management/console/modules/udm/udm_ldap.py", line 136, in _func
    lo, po = _get_user_connection()
  File "%PY2.7%/univention/management/console/modules/udm/udm_ldap.py", line 108, in _get_user_connection
    lo = udm_uldap.access(host=ucr.get('ldap/master'), base=ucr.get('ldap/base'), binddn=_user_dn, bindpw=_password)
  File "%PY2.7%/univention/admin/uldap.py", line 265, in __init__
    self.lo=univention.uldap.access(host, port, base, binddn, bindpw, start_tls, follow_referral=follow_referral)
  File "%PY2.7%/univention/uldap.py", line 177, in __init__
    self.__open(ca_certfile)
  File "%PY2.7%/univention/uldap.py", line 215, in __open
    self.lo.start_tls_s()
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 884, in start_tls_s
    res = self._apply_method_s(SimpleLDAPObject.start_tls_s,*args,**kwargs)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 860, in _apply_method_s
    return func(self,*args,**kwargs)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 571, in start_tls_s
    return self._ldap_call(self._l.start_tls_s)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 106, in _ldap_call
    result = func(*args,**kwargs)
CONNECT_ERROR: {'info': 'TLS: hostname does not match CN in peer certificate', 'desc': 'Connect error'}
Comment 1 Florian Best univentionstaff 2015-12-18 17:01:38 CET
Reported again, 4.1-0 errata29 (Vahr)
Comment 2 Florian Best univentionstaff 2016-02-15 13:17:37 CET
Reported again, 3.2-5 errata310 (Borgfeld)
Comment 3 Florian Best univentionstaff 2016-10-10 11:27:34 CEST
Reported again, 4.1-3 errata282 (Vahr)

Remark: Installation of web failed. Route to SSL was some tmp directory. Changed it to ucs SSL route.

CONNECT_ERROR: {'info': 'TLS: hostname does not match CN in peer certificate', 'desc': 'Connect error'}
Comment 4 Florian Best univentionstaff 2017-05-30 10:45:10 CEST
Reported again, 4.2-0 errata25 (Lesum)

Remark: Nach der Neuinstallation des Domaincontrollers kam diese Fehlermeldung 
Role: domaincontroller_backup

CONNECT_ERROR: {'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (self signed certificate in certificate chain)', 'desc': 'Connect error'}
Comment 5 Florian Best univentionstaff 2017-06-16 18:49:23 CEST
Reported again, 4.2-0 errata29 (Lesum)
Comment 6 Florian Best univentionstaff 2017-06-20 12:30:22 CEST
Reported again, 4.2-0 errata10 (Lesum)
Comment 7 Florian Best univentionstaff 2017-06-20 12:42:25 CEST
Created attachment 8939 [details]
patch

The patch handles CONNECT_ERROR for every module and displays a human readable error message.
Comment 8 Florian Best univentionstaff 2017-06-20 12:43:29 CEST
*** Bug 39325 has been marked as a duplicate of this bug. ***
Comment 9 Florian Best univentionstaff 2017-06-20 12:44:38 CEST
(In reply to Florian Best from comment #8)
> *** Bug 39325 has been marked as a duplicate of this bug. ***

Use the user pain of the duplicate bug.
Comment 10 Florian Best univentionstaff 2017-06-20 19:23:39 CEST
The patch has been applied.

univention-management-console.yaml:
r80366 | YAML Bug #39963, Bug #44670, Bug #40998

univention-management-console (9.0.80-47):
r80360 | Bug #39963: handle CONNECT_ERROR
Comment 11 Johannes Keiser univentionstaff 2017-06-21 15:35:17 CEST
We could add a link to http://sdb.univention.de/1000 in the error message.
Comment 12 Florian Best univentionstaff 2017-06-21 16:13:48 CEST
univention-management-console (9.0.80-48):
r80392 | Bug #39963: enhance error message
Comment 13 Johannes Keiser univentionstaff 2017-06-21 16:40:23 CEST
(In reply to Johannes Keiser from comment #11)
> We could add a link to http://sdb.univention.de/1000 in the error message.

(In reply to Florian Best from comment #12)
> univention-management-console (9.0.80-48):
> r80392 | Bug #39963: enhance error message

The link is just plain text. It would be better if it were a clickable a tag.
Comment 14 Florian Best univentionstaff 2017-06-21 16:43:54 CEST
(In reply to Johannes Keiser from comment #13)
> The link is just plain text. It would be better if it were a clickable a tag.
Not possible. We don't have a error format. The lists are also '*'. Complain at Bug #38204.
Comment 15 Johannes Keiser univentionstaff 2017-06-21 17:52:51 CEST
Tested with:

Change certificate via "Certificate settings" module on DC master.
While the changes are being applied search a user in the "User" module.

Before patch: traceback is shown
After patch: human readable error message is shown

YAML: OK

-> Verified
Comment 16 Janek Walkenhorst univentionstaff 2017-06-28 15:33:22 CEST
<http://errata.software-univention.de/ucs/4.2/64.html>
Comment 17 Florian Best univentionstaff 2017-07-14 13:55:04 CEST
Reported again, 4.0-2 errata342 (Walle)
Comment 18 Florian Best univentionstaff 2017-07-17 16:36:08 CEST
*** Bug 44608 has been marked as a duplicate of this bug. ***
Comment 19 Florian Best univentionstaff 2017-08-21 11:06:28 CEST
Reported again, 4.1-4 errata327 (Vahr)