Bug 1273580

Summary: Several cyrus-sasl modules log multiple unsuppressible auth.debug messages per auth
Product: Red Hat Enterprise Linux 7 Reporter: Patrick Wagner <patrick.wagner>
Component: cyrus-saslAssignee: Jakub Jelen <jjelen>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.1CC: extras-qa, jjelen, mkosek, nmavrogi, pkis, plautrba, tmraz, vanmeeuwen+fedora
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1187097 Environment:
Last Closed: 2018-06-19 06:17:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Proposed patch (SQL module only) by Viktor Dukhovni none

Description Patrick Wagner 2015-10-20 18:02:56 UTC 
Created attachment 1084855 [details]
Proposed patch (SQL module only) by Viktor Dukhovni

+++ This bug was initially created as a clone of Bug #1187097 +++

Many cyrus-sasl auth backends include verbose auth.debug logging that cannot be suppressed due to incorrect invocations of the log() function (NULL is passed instead of the connection handle. 
Bug #1187097 fixed this for the gssapi module only. 
I was personally affected by the issue in the case of the SQL module and initially brought it up on the postfix-users mailing list (where Viktor Dukhovni helpfully created the attached patch, fixing the issue for the SQL backend only), and I filed bug #3906 on upstream Cyrus bugzilla: https://bugzilla.cyrusimap.org/show_bug.cgi?id=3906

Due to known unresponsive upstream this should be fixed downstream - this bug report might serve to fix "just" the SQL module, or all modules affected?


Version-Release number of selected component (if applicable):
rpmquery cyrus-sasl cyrus-sasl-sql           
cyrus-sasl-2.1.26-17.el7.x86_64
cyrus-sasl-sql-2.1.26-17.el7.x86_64

How reproducible:
always

Steps to Reproduce:
authenticate against a program that utilizes cyrus-sasl auth, with cyrus-sasl having a SQL backend configured for auth.

Actual results:
Several lines of auth.debug messages are logged to systemd journal (and subsequently, other syslog daemons) every time an auth attempt is made:
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql auxprop plugin using mysql engine
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
userPassword sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
userPassword sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin create statement from
cmusaslsecretPLAIN sasl-user mail.domain
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin doing query SELECT passwd
FROM saslout WHERE uname='sasl-user' AND aktiv='Y';
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin Parse the username
sasl-user
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin try and connect to a host
Oct 05 11:55:01 mail postfix/smtpd[5883]: sql plugin trying to open db
'postfix' on host '127.0.0.1:3306'

Expected results:
No generation of auth.debug messages
Comment 2 Jakub Jelen 2015-10-22 08:10:13 UTC 
Thank you for the report. The referenced bugzilla was fixed only in Fedora so far and as we agree, the connection callbacks are not propagated in some other modules then in original report. The sql is one of them.

I am in touch with upstream about this problem, so I will try to add this bug to discussion.
Comment 4 Jakub Jelen 2017-07-19 12:56:39 UTC 
This is already resolved upstream:

https://github.com/cyrusimap/cyrus-sasl/issues/401

Fixing that in future RHEL makes sense.