Netware Webserver - Problem with remote home directories

Author

Problem with remote home directories

Adam

2007-10-15, 7:11 pm

Hello,

I have gone through the setup to allow home directories to be web
accessible and it works just fine when the home directory is on the web
server that apache is running on. The problem comes in when I try to use
home directories on remote servers.

It ends with error "could not create path context. error: 117" I cannot
find any information regarding this, in fact I have only found one other
instance of this error and there was no help regarding it.

We are running OES on Netware with the most current version of mod_edir on
Apache 2.0.59.

I would appreciate any direction regarding this error.

Below is the error log on the Apache box. I have changed any information
that relates to our organization.

[Fri Oct 12 15:51:10 2007] [error] [client 10.199.X.X] could not create
path context. error: 117
[Fri Oct 12 15:51:07 2007] [debug] rdir.c(177): [client 10.199.X.X] server
path root is SERVER1/DATA:
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(440): [client 10.199.X.X]
Checking cache for entry SERVER1
[Fri Oct 12 15:51:07 2007] [debug] rdir.c(166): [client 10.199.X.X]
request is /~username, remote directory is
SERVER1/DATA:\Home\Staff\username/public_html
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(530): Checking mod_eDir
cache for purgible entries
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(521): [client 10.199.X.X] home
dir for user username is SERVER1/DATA:\Home\Staff\username
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(436): [client 10.199.X.X]
Returning home directory path SERVER1/DATA:\Home\Staff\username for user
or alias username
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(409): [client 10.199.X.X]
username added to the cache
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(364): [client 10.199.X.X]
Adding username to the cache
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(324): [client 10.199.X.X] Home
directory entry
cn=SERVER1_DATA,ou=SERVICES,ou=OUnit,o=O
RGANIZATION#0#\Home\Staff\username
for user or alias username
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(294): [client 10.199.X.X]
entryCount: 1
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(249): [client 10.199.X.X]
sfilter: (&(objectclass=*)(uid=username)) scope: Subtree
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(246): [client 10.199.X.X]
username:username hdir_search_attr:uid searchctx:O=ORGANIZATION
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(440): [client 10.199.X.X]
Checking cache for entry username
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(530): Checking mod_eDir
cache for purgible entries
[Fri Oct 12 15:48:46 2007] [info] Server built: Aug 2 2006 10:15:09
[Fri Oct 12 15:48:46 2007] [notice] Apache/2.0.59 (NETWARE) mod_jk/1.2.15
configured -- resuming normal operations
[Fri Oct 12 15:48:46 2007] [debug] util_ldap.c(1690): Initialisation of
global mutex SYS:/tmp/T-000005.TMP in child process 1 successful.
Attempting to create an identity. Tree: SERVER2.GLOBAL.ORGANIZATION, User:
CN=webhdaccess.OU=GLOBAL.O=ORGANIZATION. Result Code: 0
[Fri Oct 12 15:48:45 2007] [notice] LDAP: SSL support unavailable
[Fri Oct 12 15:48:45 2007] [notice] LDAP: Built with Novell LDAP SDK

Guenter

2007-10-15, 7:11 pm

Hi,

nospam@obfuscated.domain (Adam) wrote in news:Q8PQi.13282$NG7.3190
@kovat.provo.novell.com:

> Hello,
>
> I have gone through the setup to allow home directories to be web
> accessible and it works just fine when the home directory is on the web
> server that apache is running on. The problem comes in when I try to use
> home directories on remote servers.
>
> It ends with error "could not create path context. error: 117" I cannot
> find any information regarding this, in fact I have only found one other
> instance of this error and there was no help regarding it.
>
> We are running OES on Netware with the most current version of mod_edir on
> Apache 2.0.59.
if you are using aliases you should try downdate to mod_edir 1.0.12; others
reported issues with .13.
Also have you read the new docu we provide at the mod_edir Forge site?
it explains how you can access remote file systems:
http://forge.novell.com/modules/xfmod/project/?mod_edir

the error 117 comes most likely because you have not specified a user to log
into the remote server, and the server itself has no rights; just grant the
server object the rights to access the remote file system, and it should
work.

you should further make sure that on the remote server you have same libc
running as on the local server where Apache runs.

Günter.

Sami Kapanen

2007-10-16, 7:12 am

Adam wrote:
>
> Hello,
>
> I have gone through the setup to allow home directories to be web
> accessible and it works just fine when the home directory is on the web
> server that apache is running on. The problem comes in when I try to use
> home directories on remote servers.
>
> It ends with error "could not create path context. error: 117" I cannot
> find any information regarding this, in fact I have only found one other
> instance of this error and there was no help regarding it.
>
> We are running OES on Netware with the most current version of mod_edir on
> Apache 2.0.59.

to check,
what is the version of mod_edir?
the server has RF rights to the remote volumes?

-sk

Adam

2007-10-16, 1:12 pm

Thank you very much for the prompt replies.

Yes, I have read through the documentation.

I am running in authenticated mode. For testing purposes, the
authenticated user and server object which Apache is running on have been
given inheritable supervisor rights at the organization level.

Since the server has Supervisor rights to the tree, it should inherit RF
rights to the remote filesystem. We have also tried specifying RF on the
remote volume and have still had no luck.

We are running LibCSP6A on both the server running apache and the remote
server which we are trying to acess.

I am not using aliases.

We are running mod_edir binary 1.0.13 for Apache 2.0.59

I have tried v1.0.12 and receive the same error.

Do I need to set up a control for access to them in the httpd.conf file?
As an example, something like this?

<Directory SERVER1/DATA:HomeStaff*pulbic_html>
AllowOverride FileInfo AuthConfig Limit Indexes
Options MultiViews Indexes
Order allow,deny
Allow from all
</Directory>

Adam

2007-10-16, 1:12 pm

I am posting my apache config here with the organziation specific info
changed.
ServerRoot "SYS:/APACHE2"
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15
ThreadStackSize 65536
StartThreads 25
MinSpareThreads 10
MaxSpareThreads 50
MaxThreads 1024
MaxRequestsPerChild 0
MaxMemFree 100
Listen 80
SecureListen 443 "SSL CertificateDNS"
ServerAdmin you@your.address
ServerName SERVER1.GLOBAL.ORGANIZATION
UseCanonicalName Off
DocumentRoot "SYS:/APACHE2/htdocs"
DirectoryIndex index.html index.html.var
AccessFileName .htaccess
TypesConfig conf/mime.types
DefaultType text/plain
HostnameLookups Off
ErrorLog "|SYS:/APACHE2/bin/rotlogs.nlm sys:/apache2/logs/error_log
5M"
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i""
combined
LogFormat "%h %l %u %t "%r" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog "|sys:/apache2/bin/rotlogs.nlm sys:/apache2/logs/access_log
5M" common
ServerSignature On
Alias /icons/ "SYS:/APACHE2/icons/"
AliasMatch ^/manual(?:/(?:de|en|fr|ja|ko|ru))?(/.*)?$
"SYS:/APACHE2/manual$1"
Alias /error/ "SYS:/APACHE2/error/"
ScriptAlias /cgi-bin/ "SYS:/APACHE2/cgi-bin/"
IndexOptions FancyIndexing VersionSort
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^
DefaultIcon /icons/unknown.gif
ReadmeName README.html
HeaderName HEADER.html
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
AddEncoding x-compress Z
AddEncoding x-gzip gz tgz
AddLanguage ca .ca
AddLanguage cs .cz .cs
AddLanguage da .dk
AddLanguage de .de
AddLanguage el .el
AddLanguage en .en
AddLanguage eo .eo
AddLanguage es .es
AddLanguage et .et
AddLanguage fr .fr
AddLanguage he .he
AddLanguage hr .hr
AddLanguage it .it
AddLanguage ja .ja
AddLanguage ko .ko
AddLanguage ltz .ltz
AddLanguage nl .nl
AddLanguage nn .nn
AddLanguage no .no
AddLanguage pl .po
AddLanguage pt .pt
AddLanguage pt-BR .pt-br
AddLanguage ru .ru
AddLanguage sv .sv
AddLanguage zh-CN .zh-cn
AddLanguage zh-TW .zh-tw
LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl
nn no pl pt pt-BR ru sv zh-CN zh-TW
ForceLanguagePriority Prefer Fallback
AddDefaultCharset ISO-8859-1
AddCharset ISO-8859-1 .iso8859-1 .latin1
AddCharset ISO-8859-2 .iso8859-2 .latin2 .cen
AddCharset ISO-8859-3 .iso8859-3 .latin3
AddCharset ISO-8859-4 .iso8859-4 .latin4
AddCharset ISO-8859-5 .iso8859-5 .latin5 .cyr .iso-ru
AddCharset ISO-8859-6 .iso8859-6 .latin6 .arb
AddCharset ISO-8859-7 .iso8859-7 .latin7 .grk
AddCharset ISO-8859-8 .iso8859-8 .latin8 .heb
AddCharset ISO-8859-9 .iso8859-9 .latin9 .trk
AddCharset ISO-2022-JP .iso2022-jp .jis
AddCharset ISO-2022-KR .iso2022-kr .kis
AddCharset ISO-2022-CN .iso2022-cn .cis
AddCharset Big5 .Big5 .big5
AddCharset WINDOWS-1251 .cp-1251 .win-1251 .ru
AddCharset CP866 .cp866
AddCharset KOI8-r .koi8-r .koi8-ru
AddCharset KOI8-ru .koi8-uk .ua
AddCharset ISO-10646-UCS-2 .ucs2
AddCharset ISO-10646-UCS-4 .ucs4
AddCharset UTF-8 .utf8
AddCharset GB2312 .gb2312 .gb
AddCharset utf-7 .utf7
AddCharset utf-8 .utf8
AddCharset big5 .big5 .b5
AddCharset EUC-TW .euc-tw
AddCharset EUC-JP .euc-jp
AddCharset EUC-KR .euc-kr
AddCharset shift_jis .sjis
AddType application/x-tar .tgz
AddType image/x-icon .ico
AddHandler type-map var
ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
ErrorDocument 410 /error/HTTP_GONE.html.var
ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4.0b2;" nokeepalive downgrade-1.0
force-response-1.0
BrowserMatch "RealPlayer 4.0" force-response-1.0
BrowserMatch "Java/1.0" force-response-1.0
BrowserMatch "JDK/1.0" force-response-1.0
BrowserMatch "Microsoft Data Access Internet Publishing Provider"
redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[012]" redirect-carefully
Include "SYS:/adminsrv/webapps/welcome/web-inf/welcome-apache.conf"
Include sys:/tomcat/4/conf/tomcatdocs-apache.conf
Include sys:/tomcat/4/conf/tomcatadmin-apache.conf
Include sys:/tomcat/4/conf/tomcatmanager-apache.conf
LogLevel Debug
LoadModule ldap_module modules/utilldap.nlm
LoadModule auth_ldap_module modules/authldap.nlm
LoadModule jk_module modules/mod_jk.nlm
LoadModule edir_module modules/mod_edir.nlm
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>

<Directory "SYS:/APACHE2/htdocs">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>

<Files ~ "^.ht">
Order allow,deny
Deny from all
</Files>

<Directory "SYS:/APACHE2/icons">
Options Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>

<Directory "SYS:/APACHE2/manual">
Options Indexes
AllowOverride None
Order allow,deny
Allow from all
<Files *.html>
SetHandler type-map
</Files>

SetEnvIf Request_URI ^/manual/de/ prefer-language=de
SetEnvIf Request_URI ^/manual/en/ prefer-language=en
SetEnvIf Request_URI ^/manual/fr/ prefer-language=fr
SetEnvIf Request_URI ^/manual/ja/ prefer-language=ja
SetEnvIf Request_URI ^/manual/ko/ prefer-language=ko
SetEnvIf Request_URI ^/manual/ru/ prefer-language=ru
RedirectMatch 301 ^/manual(?:/(de|en|fr|ja|ko|ru)){2,}(/.*)?$
/manual/$1$2
</Directory>

<Directory "SYS:/APACHE2/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>

<Directory "SYS:/APACHE2/error">
AllowOverride None
Options IncludesNoExec
AddOutputFilter Includes html
AddHandler type-map var
Order allow,deny
Allow from all
LanguagePriority en es de fr
ForceLanguagePriority Prefer Fallback
</Directory>

<VirtualHost
BrowserMatch "MSIE" nokeepalive downgrade-1.0 force-response-1.0
</VirtualHost>

<IfModule mod_jk.c>
JkWorkersFile "sys:/adminsrv/conf/mod_jk/workers.properties"
JkLogFile "logs/mod_jk.log"
JkLogLevel error
</IfModule>

<IfModule mod_edir.c>
eDirServer NML1.GLOBAL.ORGANIZATION 636 secure
hDirUserSubDirectory public_html
RemoteDirEnabled On
hDirSearchContexts O=ORGANIZATION
eDirRootCerts sys:/public/RootCert.der
HomeDirEnabled On
eDirUserAccount cn=webhdaccess.ou=global.o=organization
eDirPassword *Password*
</IfModule>

<IfModule mod_auth_ldap.c>
AuthLDAPCharsetConfig conf/charset.conv
</IfModule>

<IfModule mod_mime_magic.c>
MIMEMagicFile conf/magic
</IfModule>

Guenter

2007-10-16, 7:11 pm

Hi Adam,

adam@obfuscated.domain (Adam) wrote in news:Xb6Ri.14043$NG7.11800
@kovat.provo.novell.com:

> I am posting my apache config here with the organziation specific info
> changed.
> <IfModule mod_edir.c>
> eDirServer NML1.GLOBAL.ORGANIZATION 636 secure
> hDirUserSubDirectory public_html
> RemoteDirEnabled On
> hDirSearchContexts O=ORGANIZATION
> eDirRootCerts sys:/public/RootCert.der
> HomeDirEnabled On
> eDirUserAccount cn=webhdaccess.ou=global.o=organization
> eDirPassword *Password*
> </IfModule>
just for the records: an error 117 is defined as ELOOKUP - this happens most
likely when the remote server isnt found. So it might be that
NML1.GLOBAL.ORGANIZATION cant be resolved via DNS, and then causes the 117.
Replace this with the server's IP, and try again....

Günter.

Adam

2007-10-17, 1:12 pm

Thank you.

I tried setting that to the IP address, and then I get a different error.
Based on what you just told me I am going to try a few more things and
report back.

Below is the error I get when I change that name to ip.

[Wed Oct 17 09:46:20 2007] [error] [client 10.199.14.22] could not create
path context. error: 114
Failed to create a server identity. [Error 117] Possibly invalid tree,
user or password supplied.
Attempting to create an identity. Tree: 172.18.1.2, User:
cn=webhdaccess.ou=global.o=organization. Result Code: 117
[Wed Oct 17 09:46:20 2007] [error] [client 10.199.14.22] invalid rdir
identity detected. error: -1732538720
[Wed Oct 17 09:46:20 2007] [debug] rdir.c(177): [client 10.199.14.22]
server path root is SERVER1/DATA:
[Wed Oct 17 09:46:15 2007] [debug] rdirutils.c(440): [client 10.199.14.22]
Checking cache for entry SERVER1
[Wed Oct 17 09:46:15 2007] [debug] rdir.c(166): [client 10.199.14.22]
request is /~username, remote directory is
SERVER1/DATA:\Home\Staff\username/public_html
[Wed Oct 17 09:46:15 2007] [debug] rdirutils.c(530): Checking mod_eDir
cache for purgible entries
[Wed Oct 17 09:46:15 2007] [debug] hdir.c(521): [client 10.199.14.22] home
dir for user username is SERVER1/DATA:\Home\Staff\username
[Wed Oct 17 09:46:15 2007] [debug] rdirutils.c(496): [client 10.199.14.22]
Using cached conn info for username, identity: 0, path context: 0
[Wed Oct 17 09:46:15 2007] [debug] rdirutils.c(617): [client 10.199.14.22]
Determining if cache entry username is valid
[Wed Oct 17 09:46:15 2007] [debug] rdirutils.c(469): [client 10.199.14.22]
Found entry username in the cache
[Wed Oct 17 09:46:15 2007] [debug] rdirutils.c(440): [client 10.199.14.22]
Checking cache for entry username
[Wed Oct 17 09:46:15 2007] [debug] rdirutils.c(530): Checking mod_eDir
cache for purgible entries

Adam

2007-10-17, 1:12 pm

Yay! I found a solution. What you had said about error 117 meaning that it
could not find the remote server got me thinking. There are no hostnames
for those servers in the global.organization domain (which is where the
apache server is located). All of those hostnames are in the
location.organization domain. mod_edir was trying to resolve a local
hostname rather than the fully qualified domain name for the server.

I will illustrate this for the benefit of anyone who has this issue (or
someone wants to update the documentation to explain it) Please note that
this is a DNS issue, not an eDirectory issue so I am referring to DNS
throughout.

An example of what a comparible DNS hierarchy looks like:

global.organization - where our global services exist, such as web, top
level dns, email, etc
web1.global.organization - a server that is using apache and mod_edir

city1.organizaion - where city specific services, users, etc, reside
city1server.city1.organzation - the server located in city1 that contains
user home directories

city2.organization - where city specific services, users, etc, reside
city2server.city2.organization - the server located in city2 that contains
user home directories

There were no local hostname records in the global.organization domain
that would resolve to the servers in the city domains. For example, if I
would ping city1server from server web1, it would not resolve the hostname
city1server. However, I could ping city1server.city1.organziation and it
would resolve fine.

Because of this mod_edir would error out with this error:

[Fri Oct 12 15:51:10 2007] [error] [client 10.199.24.52] could not create
path context. error: 117
[Fri Oct 12 15:51:07 2007] [debug] rdir.c(177): [client 10.199.24.52]
server
path root is CITY1SERVER/DATA:
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(440): [client 10.199.24.52]
Checking cache for entry CITY1SERVER
[Fri Oct 12 15:51:07 2007] [debug] rdir.c(166): [client 10.199.24.52]
request is /~username, remote directory is
CITY1SERVER/DATA:HomeStaffusername/public_html
[Fri Oct 12 15:51:07 2007] [debug] rdirutils.c(530): Checking mod_eDir
cache for purgible entries
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(521): [client 10.199.24.52] home
dir for user username is CITY1SERVER/DATA:HomeStaffusername
[Fri Oct 12 15:51:07 2007] [debug] hdir.c(436): [client 10.199.24.52]
Returning home directory path CITY1SERVER/DATA:HomeStaffusername for user
or alias username

What is happening is mod_edir is trying to resolve a local hostname
CITY1SERVER in the domain global.organization and that hostname does not
exist.

The fix for this is to create local hostname (resource record) in the
global.organization domain for CITY1SERVER. At that point mod_edir will be
able to resolve it and the home directory access will work.

I hope this helps anyone who has this issue!

Guenter

2007-10-17, 7:12 pm

Hi Adam,

adam@obfuscated.domain (Adam) wrote in news:%jqRi.14878$NG7.9601
@kovat.provo.novell.com:

> I tried setting that to the IP address, and then I get a different error.
> Based on what you just told me I am going to try a few more things and
> report back.
>
> Below is the error I get when I change that name to ip.
>
> [Wed Oct 17 09:46:20 2007] [error] [client 10.199.14.22] could not create
> path context. error: 114

ok, here are some other possible error codes which may probably be returned
by mod_edir:

#define EBADIDENT 114 /* invalid user or other identity
*/
#define ENDS 115 /* generic eDirectory error, see 'clienterrno'
*/
#define ENCP 116 /* generic NCP error, see 'h_errno'
*/
#define ELOOKUP 117 /* generic look-up error, see 'h_errno'
*/

if I have some more time I will probably investigate mod_edir's source, and
see if I can can add some more output for the errors; though the 114 seems
already verbose from what I see in your logs.

thanks also for your detailed explaining of the error.
I've though one question: dont you think that it is just enough that you
make sure that the remote server is 'resolvable' via sys:/etc/hosts ?

Regarding docu: I can at any time change the docu, no prob. You're welcome
to prosose any changes, just it should be simple and short -- means the
docu should not cover the proper setup of DNS, but it should mention that
its important that either DNS is fully working (probably with a pointer to
further docu for DNS), or the remote server appears in the local hosts
file.
I will also ask the one who mainly wrote the new docu if he has some time
to add a section for error codes.

thanks, Günter.