Description of problem: Creating a netgroup with a leading + causes ns-slapd to segfault in the compat plugin. I opened this against slapi-nis because using ipa-compat-manage disable makes this operation work. Re-enabling the plugin after adding the entry causes 389-ds to not start. The backtrace seems to be in 389-ds itself. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f623b7fe700 (LWP 27025)] __strlen_sse2 () at ../sysdeps/x86_64/strlen.S:32 32 movdqu (%rdi), %xmm1 (gdb) where #0 __strlen_sse2 () at ../sysdeps/x86_64/strlen.S:32 #1 0x0000003931cb4caa in slapi_value_set_string_passin (value=0x7f623b7f7450, strVal=0x0) at ldap/servers/slapd/value.c:381 #2 0x0000003931cb657c in valueset_add_string (vs=0x7f623c0e0268, s=0x0, t=<optimized out>, csn=<optimized out>) at ldap/servers/slapd/valueset.c:1028 #3 0x0000003931c54d27 in slapi_entry_add_string (e=<optimized out>, type=<optimized out>, value=0x0) at ldap/servers/slapd/entry.c:2650 #4 0x00007f62583392b7 in backend_set_operational_attributes ( e=0x7f623c0e03e0, state=0x13baa30, timestamp=1329967375, n_subordinates=0) at back-sch.c:275 #5 0x00007f625833a83c in backend_set_entry (pb=0x1c1cd40, e=0x7f623c0df730, data=0x19becc0) at back-sch.c:336 #6 0x00007f625833da1a in backend_shr_add_entry_cb ( group=0x1537ae0 "cn=compat,dc=greyoak,dc=com", set=0x1535e00 "cn=ng", secure=<optimized out>, backend_data=0x19becc0, cbdata_ptr=0x7f623b7f7770) at back-shr.c:1545 #7 0x00007f62583482a8 in map_data_foreach_map (state=<optimized out>, domain_name=0x0, fn=0x7f625833d9d0 <backend_shr_add_entry_cb>, cbdata=0x7f623b7f7770) at map.c:347 #8 0x00007f625833ded7 in backend_shr_add_cb (pb=0x1c1cd40) at back-shr.c:1611 #9 backend_shr_add_cb (pb=0x1c1cd40) at back-shr.c:1551 #10 0x0000003931c8a359 in plugin_call_func (list=0x13bc790, operation=560, pb=0x1c1cd40, call_one=0) at ldap/servers/slapd/plugin.c:1450 #11 0x0000003931c8a554 in plugin_call_list (pb=0x1c1cd40, operation=560, list=<optimized out>) at ldap/servers/slapd/plugin.c:1412 #12 plugin_call_plugins (pb=0x1c1cd40, whichfunction=560) at ldap/servers/slapd/plugin.c:395 #13 0x00007f6259fecb45 in ldbm_back_add (pb=0x1c1cd40) at ldap/servers/slapd/back-ldbm/ldbm_add.c:918 #14 0x0000003931c3f3b7 in op_shared_add (pb=0x1c1cd40) at ldap/servers/slapd/add.c:680 #15 0x0000003931c404c8 in do_add (pb=0x1c1cd40) at ldap/servers/slapd/add.c:258 #16 0x0000000000417098 in connection_dispatch_operation (pb=<optimized out>, op=0x1c1ca30, conn=0x7f6250afc560) at ldap/servers/slapd/connection.c:576 #17 connection_threadmain () at ldap/servers/slapd/connection.c:2336 #18 0x0000003866e28553 in _pt_root (arg=0x148d4a0) at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:187 #19 0x0000003863e07b41 in start_thread (arg=0x7f623b7fe700) at pthread_create.c:305 #20 0x00000038636df49d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115 (gdb) up #1 0x0000003931cb4caa in slapi_value_set_string_passin (value=0x7f623b7f7450, strVal=0x0) at ldap/servers/slapd/value.c:381 381 value->bv.bv_len = strlen(strVal); (gdb) print strVal $1 = 0x0 Version-Release number of selected component (if applicable): 389-ds-base-1.2.10.1-1.fc15.x86_64 slapi-nis-0.36-1.fc15.x86_64 Steps to Reproduce: 1. yum install freeipa-server 2. ipa-server-install 3. kinit admin 4. ipa netgroup-add --desc=bad +bad
At line back-sch.c:275 we're trying setting the 'entryDN' to the entry's DN, which should already have been set in the calling function, so there's an error case here that the plugin's not handling right.
The plugin is failing to correctly escape values used in constructing the RDN, and that's letting it create entries with malformed DNs attached to them that sometimes get retrieved as NULL. I'm targeting 0.38 for the fix -- if you can test with a version dated after 2012-02-24-01:00:00Z, they should handle such cases (not just entries with names containing "+", but other important characters such as "=", ":", and the like) correctly.
Have you had a chance to test yet? If it passes muster, I can tag a release and start the ball rolling on updates.
Confirmed, no more core dump.
slapi-nis-0.38-1.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/slapi-nis-0.38-1.fc17
slapi-nis-0.38-1.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/slapi-nis-0.38-1.fc16
slapi-nis-0.38-1.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/slapi-nis-0.38-1.fc15
Package slapi-nis-0.38-1.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing slapi-nis-0.38-1.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-3187/slapi-nis-0.38-1.fc17 then log in and leave karma (feedback).
slapi-nis-0.38-1.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.
slapi-nis-0.38-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
slapi-nis-0.38-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.