Bug 1920500
| Summary: | Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Alexey Tikhonov <atikhono> |
| Component: | sssd | Assignee: | Iker Pedrosa <ipedrosa> |
| Status: | CLOSED ERRATA | QA Contact: | Madhuri <mupadhye> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.4 | CC: | abroy, chorn, dlavu, grajaiya, ipedrosa, jhrozek, lslebodn, mzidek, pbrezina, sgoveas, tscherf, yoguma |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-2.5.0-1.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-09 19:47:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Alexey Tikhonov
2021-01-26 12:24:41 UTC
Very short summary of bz 1839972: - read(), interrupted by a WD signal, makes ldap_install_tls() to fail: ``` tls_read: want=5 error=Interrupted system call TLS trace: SSL_connect:error in SSLv3/TLS write client hello TLS: can't connect: . ... => ldap_install_tls failed: [Connect error] [unknown error] ``` - re-try of failed() doesn't work (connection state either on client or on server side (or both) doesn't allow for this) - issue is reproducible on RHEL8 As a fix we should close connection and try to re-connect but: - only in case of this error / if WD signal was sent during operation (as an "evidence") - only once - make sure it is the same server (not next in the failover list) Pushed PR: https://github.com/SSSD/sssd/pull/5532 * `master` * da55e3e69707de416b7949d08c165c950090bbb6 - ldap: retry ldap_install_tls() when watchdog interruption On Server [root@vm-idm-023 ~]# tc qdisc add dev ens2 root netem delay 3s On Client [root@auto-hv-01-guest01 ~]# rpm -q sssd sssd-2.5.0-1.el8.x86_64 [root@auto-hv-01-guest01 offline]# systemctl stop sssd; rm -rf /var/lib/sss/db/*; rm -rf /var/log/sssd/*; systemctl start sssd [root@auto-hv-01-guest01 offline]# date; su - foo1@LDAP Mon Jun 14 05:37:40 EDT 2021 su: user foo1@LDAP does not exist [root@auto-hv-01-guest01 ~]# tail -f /var/log/sssd/*.log | grep -i 'Assuming TLS handshake was interrupted' (2021-06-14 5:37:42): [be[LDAP]] [sss_ldap_init_sys_connect_done] (0x0020): Assuming TLS handshake was interrupted On server [root@vm-idm-023 ~]# tc qdisc del dev ens2 root On client [root@auto-hv-01-guest01 offline]# date; su - foo1@LDAP Mon Jun 14 05:41:24 EDT 2021 Last login: Mon Jun 14 04:31:27 EDT 2021 on pts/1 su: warning: cannot change directory to /home/foo1: No such file or directory /usr/bin/id: cannot find name for group ID 10000 [foo1@auto-hv-01-guest01 offline]$ whoami foo1 [foo1@auto-hv-01-guest01 offline] Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:4435 *** Bug 2049178 has been marked as a duplicate of this bug. *** |