back-ldap bug?

[Stephan Duehr <stephan.duehr@dass-it.de>]

I've got a setup of two OpenLDAP servers. One is master, the other runs two 
instances of slapd, one replicates using syncrepl listening on port 10389 and 
the other on port 389 using back-ldap proxies to localhost:10389, mainly for 
referral chasing.

If I send a modification operation to the back-ldap instance, I get this 
error:
ldap_initialize( ldap://localhost )
replace dbkImageVersion:
        2
replace objectclass:
        dbkCarrierClass
        dbkWorkstation
modifying entry "cn=pc00108,ou=client,ou=test,o=testing,c=de"
ldapmodify: update failed: cn=pc00108,ou=client,ou=test,o=testing,c=de
ldap_modify: Object class violation (65)
        additional info: no structural object class provided

If I send the same modification directly to the master, the operation is 
successful:
ldap_initialize( ldap://192.168.135.10 )
replace dbkImageVersion:
        2
replace objectclass:
        dbkCarrierClass
        dbkWorkstation
modifying entry "cn=pc00108,ou=client,ou=test,o=testing,c=de"
modify complete

The LDIF used for modify:
dn: cn=pc00108,ou=client,ou=test,o=testing,c=de
changetype: modify
replace: dbkImageVersion
dbkImageVersion: 2
-
replace: objectclass
objectclass: dbkCarrierClass
objectclass: dbkWorkstation

Command used for modify through proxy:
ldapmodify -x -v -D "uid=foo,ou=user,o=testing,c=de" -w secret -h localhost -f 
mod108.ldif

Command used for modify on master directly:
ldapmodify -x -v -D "uid=foo,ou=user,o=testing,c=de" -w secret -h 
192.168.135.10 -f mod108.ldif

Here comes the funny parts of ethereal dumps of both operations captured on 
the master (Message Length differs by one, but is wrong here because I 
changed the base for this posting):

Through back-ldap:
Lightweight Directory Access Protocol, Modify Request
    Message Id: 3
    Message Type: Modify Request (0x06)
    Message Length: 177
    Response In: 9
    Distinguished Name: cn=pc00108,ou=client,ou=test,o=testing,c=de
    Replace: dbkImageVersion
        Value: 2
    Replace: objectClass
        Value: dbkWorkstation
        Value: dbkWorkstation

Direct:
Lightweight Directory Access Protocol, Modify Request
    Message Id: 2
    Message Type: Modify Request (0x06)
    Message Length: 178
    Distinguished Name: cn=pc00108,ou=client,ou=test,o=testing,c=de
    Replace: dbkImageVersion
        Value: 2
    Replace: objectclass
        Value: dbkCarrierClass
        Value: dbkWorkstation

The weird thing is that through back-ldap it sends the same value for 
objectClass twice. May this be a bug in the back-ldap code?

This seems to be related to ITS# 1540 and 1547, but they are from 2002 and 
refer to 2.0.x. I'm using SLES9 and recent packages (openldap2-2.2.6-37.35)

-- 
Stephan Dühr
dass IT GmbH
http://www.dass-IT.de