Bug 1444938

Summary: nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart
Product: Red Hat Enterprise Linux 7 Reporter: Simon Pichugin <spichugi>
Component: 389-ds-baseAssignee: mreynolds
Status: CLOSED ERRATA QA Contact: Viktor Ashirov <vashirov>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.4CC: mreynolds, nkinder, rmeggins, vashirov, wibrown
Target Milestone: rcKeywords: Regression, TestBlocker
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 389-ds-base-1.3.6.1-16.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-01 21:16:38 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Simon Pichugin 2017-04-24 15:02:40 UTC
Description of problem:
When we have some value in nsslapd-allowed-sasl-mechanisms attribute of cn=config and if we'll delete the attribute (which will set it to the default), it will be set to supportedSASLMechanisms: EXTERNAL only. Though after a restart we will see a full set of attributes.

Version-Release number of selected component (if applicable):
389-ds-base-1.3.6.1-9.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Check the supportedSASLMechanisms on a clean instance with a default nsslapd-allowed-sasl-mechanisms:
[root@qeos-236 tests]# ldapsearch -h localhost -p 389 -D "cn=directory manager" -w Secret123 -b "" -s base supportedSASLMechanisms
dn:
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: CRAM-MD5
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: ANONYMOUS

2. Set some particular SASL mechanism:
[root@qeos-236 tests]# ldapmodify -h localhost -p 389 -D "cn=directory manager" -w Secret123
dn: cn=config
changetype: modify
replace: nsslapd-allowed-sasl-mechanisms
nsslapd-allowed-sasl-mechanisms: DIGEST-MD5

modifying entry "cn=config"

3. Check the supportedSASLMechanisms:
[root@qeos-236 tests]# ldapsearch -h localhost -p 389 -D "cn=directory manager" -w Secret123 -b "" -s base supportedSASLMechanisms
dn:
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5

4. Reset to default by deleting the attribute:
[root@qeos-236 tests]# ldapmodify -h localhost -p 389 -D "cn=directory manager" -w Secret123
dn: cn=config
changetype: modify
delete: nsslapd-allowed-sasl-mechanisms

modifying entry "cn=config"

5. Check the supportedSASLMechanisms once againg:
[root@qeos-236 tests]# ldapsearch -h localhost -p 389 -D "cn=directory manager" -w Secret123 -b "" -s base supportedSASLMechanisms
dn:
supportedSASLMechanisms: EXTERNAL

6. Restart the instance:
[root@qeos-236 tests]# restart-dirsrv
Restarting instance "qeos-236"

7. Check the supportedSASLMechanisms:
[root@qeos-236 tests]# ldapsearch -h localhost -p 389 -D "cn=directory manager" -w Secret123 -b "" -s base supportedSASLMechanisms
dn:
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: CRAM-MD5
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: ANONYMOUS


Actual results:
On a step 5, we see only supportedSASLMechanisms: EXTERNAL.

Expected results:
On a step 5, we should see a full set of supportedSASLMechanisms.

Additional info:
Issue is covered by TET.
sasl_allowed_mechanisms_8 in sasl test suite.

Comment 2 Simon Pichugin 2017-04-25 06:30:25 UTC
Upstream issue - https://pagure.io/389-ds-base/issue/49231

Comment 3 mreynolds 2017-04-27 15:30:20 UTC
Fixed upstream

Comment 5 Viktor Ashirov 2017-05-05 20:01:21 UTC
*** Bug 1448547 has been marked as a duplicate of this bug. ***

Comment 6 Viktor Ashirov 2017-05-05 22:04:00 UTC
Build tested:
389-ds-base-1.3.6.1-12.el7.x86_64

ldapsearch crashes the server:

$ ldapsearch -x -s base


Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd058b700 (LWP 16923)]
0x00007ffff76d8fa8 in strcmpi_fast (src=0x5555555a8a21 "supportedSASLMechanisms", dst=0x1 <Address 0x1 out of bounds>)
    at ldap/servers/slapd/intrinsics.h:29
29                      if ( ((f = (unsigned char)(*(dst++))) >= 'A') && (f <= 'Z') )
Missing separate debuginfos, use: debuginfo-install sqlite-3.7.17-8.el7.x86_64
(gdb) 
(gdb) bt
#0  0x00007ffff76d8fa8 in strcmpi_fast (src=0x5555555a8a21 "supportedSASLMechanisms", dst=0x1 <Address 0x1 out of bounds>)
    at ldap/servers/slapd/intrinsics.h:29
#1  attrlist_find_or_create_locking_optional (alist=alist@entry=0x55555686a1f8, 
    type=type@entry=0x5555555a8a21 "supportedSASLMechanisms", a=a@entry=0x7fffd0585760, use_lock=use_lock@entry=1)
    at ldap/servers/slapd/attrlist.c:47
#2  0x00007ffff76d905a in attrlist_find_or_create (alist=alist@entry=0x55555686a1f8, 
    type=type@entry=0x5555555a8a21 "supportedSASLMechanisms", a=a@entry=0x7fffd0585760) at ldap/servers/slapd/attrlist.c:37
#3  0x00007ffff76d910d in attrlist_merge_valuearray (alist=alist@entry=0x55555686a1f8, 
    type=type@entry=0x5555555a8a21 "supportedSASLMechanisms", vals=0x55555686f250) at ldap/servers/slapd/attrlist.c:102
#4  0x00007ffff76d9180 in attrlist_merge (alist=alist@entry=0x55555686a1f8, type=type@entry=0x5555555a8a21 "supportedSASLMechanisms", 
    vals=vals@entry=0x7fffd0585810) at ldap/servers/slapd/attrlist.c:88
#5  0x000055555557d8b4 in read_root_dse (pb=0x7fffd058aa50, e=0x55555686a180, entryAfter=<optimized out>, returncode=0x7fffd058592c, 
    returntext=<optimized out>, arg=<optimized out>) at ldap/servers/slapd/rootdse.c:212
#6  0x00007ffff76e9369 in dse_call_callback (pb=pb@entry=0x7fffd058aa50, operation=operation@entry=4, flags=flags@entry=1, 
    entryBefore=entryBefore@entry=0x55555686a180, entryAfter=entryAfter@entry=0x0, returncode=returncode@entry=0x7fffd058592c, 
    returntext=returntext@entry=0x7fffd05859b0 "", pdse=<optimized out>) at ldap/servers/slapd/dse.c:2637
#7  0x00007ffff76eaf47 in dse_search (pb=0x7fffd058aa50) at ldap/servers/slapd/dse.c:1739
#8  0x00007ffff772460e in op_shared_search (pb=pb@entry=0x7fffd058aa50, send_result=send_result@entry=1)
    at ldap/servers/slapd/opshared.c:807
#9  0x00005555555815f3 in do_search (pb=pb@entry=0x7fffd058aa50) at ldap/servers/slapd/search.c:349
#10 0x00005555555707d4 in connection_dispatch_operation (pb=0x7fffd058aa50, op=0x555556236340, conn=0x5555568a7a00)
    at ldap/servers/slapd/connection.c:658
#11 connection_threadmain () at ldap/servers/slapd/connection.c:1772
#12 0x00007ffff5a959bb in _pt_root (arg=0x555555fd9440) at ../../../nspr/pr/src/pthreads/ptthread.c:216
#13 0x00007ffff5435e25 in start_thread (arg=0x7fffd058b700) at pthread_create.c:308
#14 0x00007ffff4d1734d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Comment 16 Simon Pichugin 2017-05-30 15:57:16 UTC
There is failure in the automated test suite. It is related to 389-ds-base-1.3.6.1-15.el7.x86_64 only. The test on master branch has passed.

[root@qeos-247 ds]# py.test -v dirsrvtests/tests/suites/sasl/allowed_mechs.py
========================= test session starts =========================
platform linux2 -- Python 2.7.5, pytest-3.1.0, py-1.4.33, pluggy-0.4.0 -- /usr/bin/python
cachedir: .cache
metadata: {'Python': '2.7.5', 'Platform': 'Linux-3.10.0-671.el7.x86_64-x86_64-with-redhat-7.4-Maipo', 'Packages': {'py': '1.4.33', 'pytest': '3.1.0', 'pluggy': '0.4.0'}, 'Plugins': {'beakerlib': '0.7.1', 'html': '1.14.2', 'cov': '2.5.1', 'metadata': '1.5.0'}}
DS build: 1.3.6.1
389-ds-base: 1.3.6.1-15.el7
nss: 3.28.4-8.el7
nspr: 4.13.1-1.0.el7_3
openldap: 2.4.44-4.el7
svrcore: 4.1.3-2.el7

rootdir: /mnt/tests/rhds/tests/upstream/ds, inifile:
plugins: metadata-1.5.0, html-1.14.2, cov-2.5.1, beakerlib-0.7.1
collected 1 items

dirsrvtests/tests/suites/sasl/allowed_mechs.py::test_sasl_allowed_mechs FAILED

========================= FAILURES =========================
_________________________ test_sasl_allowed_mechs _________________________

topology_st = <lib389.topologies.TopologyMain object at 0x2c758d0>

    def test_sasl_allowed_mechs(topology_st):
        standalone = topology_st.standalone

        # Get the supported mechs. This should contain PLAIN, GSSAPI, EXTERNAL at least
        orig_mechs = standalone.rootdse.supported_sasl()
        print(orig_mechs)
        assert('GSSAPI' in orig_mechs)
>       assert('PLAIN' in orig_mechs)
E       AssertionError: assert 'PLAIN' in ['EXTERNAL', 'GSS-SPNEGO', 'GSSAPI', 'DIGEST-MD5', 'CRAM-MD5', 'ANONYMOUS']

dirsrvtests/tests/suites/sasl/allowed_mechs.py:24: AssertionError
------------------------- Captured stdout setup -------------------------
OK group dirsrv exists
OK user dirsrv exists
------------------------- Captured stdout call -------------------------
['EXTERNAL', 'GSS-SPNEGO', 'GSSAPI', 'DIGEST-MD5', 'CRAM-MD5', 'ANONYMOUS']
------------------------- Captured stdout teardown -------------------------
Instance slapd-standalone_1 removed.
========================= 1 failed in 4.19 seconds =========================

Though if we remove the lines 24, 31, 40 - 'assert('PLAIN' in mechs)' - the test case will pass. So the actual bugzilla subject is okay - "nsslapd-allowed-sasl-mechanisms doesn't reset to default values without a restart".

Comment 17 wibrown@redhat.com 2017-05-30 21:46:42 UTC
Does this test pass on git master? I think it should ....

Comment 18 mreynolds 2017-05-30 23:05:54 UTC
(In reply to wibrown from comment #17)
> Does this test pass on git master? I think it should ....

I believe it does, but it needs to pass on 1.3.6.

Comment 19 wibrown@redhat.com 2017-05-31 01:13:25 UTC
These patches should all be in 1.3.6 though. Do you want me took at this?

Comment 24 Simon Pichugin 2017-06-07 17:30:59 UTC
[root@qeos-99 ds]# py.test -v dirsrvtests/tests/suites/sasl/allowed_mechs.py
======================= test session starts =======================
platform linux2 -- Python 2.7.5, pytest-3.1.1, py-1.4.34, pluggy-0.4.0 -- /usr/bin/python
cachedir: .cache
metadata: {'Python': '2.7.5', 'Platform': 'Linux-3.10.0-675.el7.x86_64-x86_64-with-redhat-7.4-Maipo', 'Packages': {'py': '1.4.34', 'pytest': '3.1.1', 'pluggy': '0.4.0'}, 'Plugins': {'beakerlib': '0.7.1', 'html': '1.14.2', 'cov': '2.5.1', 'metadata': '1.5.0'}}
DS build: 1.3.6.1
389-ds-base: 1.3.6.1-16.el7
nss: 3.28.4-8.el7
nspr: 4.13.1-1.0.el7_3
openldap: 2.4.44-4.el7
svrcore: 4.1.3-2.el7

rootdir: /mnt/tests/rhds/tests/upstream/ds, inifile:
plugins: metadata-1.5.0, html-1.14.2, cov-2.5.1, beakerlib-0.7.1
collected 1 items

dirsrvtests/tests/suites/sasl/allowed_mechs.py::test_sasl_allowed_mechs PASSED

======================= 1 passed in 4.20 seconds =======================

Marking as verified.

Comment 25 errata-xmlrpc 2017-08-01 21:16:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2086