Bug 800625 - Bad netgroup name causes ns-slapd to segfault
Bad netgroup name causes ns-slapd to segfault
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: slapi-nis (Show other bugs)
6.2
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Nalin Dahyabhai
IDM QE LIST
:
Depends On: 796509
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-06 15:04 EST by Nalin Dahyabhai
Modified: 2013-05-21 08:32 EDT (History)
7 users (show)

See Also:
Fixed In Version: slapi-nis-0.38-1.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 796509
Environment:
Last Closed: 2012-06-20 09:36:49 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nalin Dahyabhai 2012-03-06 15:04:27 EST
+++ This bug was initially created as a clone of Bug #796509 +++

Description of problem:

Creating a netgroup with a leading + causes ns-slapd to segfault in the compat plugin.

I opened this against slapi-nis because using ipa-compat-manage disable makes this operation work. Re-enabling the plugin after adding the entry causes 389-ds to not start.

The backtrace seems to be in 389-ds itself.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f623b7fe700 (LWP 27025)]
__strlen_sse2 () at ../sysdeps/x86_64/strlen.S:32
32              movdqu  (%rdi), %xmm1
(gdb) where
#0  __strlen_sse2 () at ../sysdeps/x86_64/strlen.S:32
#1  0x0000003931cb4caa in slapi_value_set_string_passin (value=0x7f623b7f7450, 
    strVal=0x0) at ldap/servers/slapd/value.c:381
#2  0x0000003931cb657c in valueset_add_string (vs=0x7f623c0e0268, s=0x0, 
    t=<optimized out>, csn=<optimized out>)
    at ldap/servers/slapd/valueset.c:1028
#3  0x0000003931c54d27 in slapi_entry_add_string (e=<optimized out>, 
    type=<optimized out>, value=0x0) at ldap/servers/slapd/entry.c:2650
#4  0x00007f62583392b7 in backend_set_operational_attributes (
    e=0x7f623c0e03e0, state=0x13baa30, timestamp=1329967375, n_subordinates=0)
    at back-sch.c:275
#5  0x00007f625833a83c in backend_set_entry (pb=0x1c1cd40, e=0x7f623c0df730, 
    data=0x19becc0) at back-sch.c:336
#6  0x00007f625833da1a in backend_shr_add_entry_cb (
    group=0x1537ae0 "cn=compat,dc=greyoak,dc=com", set=0x1535e00 "cn=ng", 
    secure=<optimized out>, backend_data=0x19becc0, cbdata_ptr=0x7f623b7f7770)
    at back-shr.c:1545
#7  0x00007f62583482a8 in map_data_foreach_map (state=<optimized out>, 
    domain_name=0x0, fn=0x7f625833d9d0 <backend_shr_add_entry_cb>, 
    cbdata=0x7f623b7f7770) at map.c:347
#8  0x00007f625833ded7 in backend_shr_add_cb (pb=0x1c1cd40) at back-shr.c:1611
#9  backend_shr_add_cb (pb=0x1c1cd40) at back-shr.c:1551
#10 0x0000003931c8a359 in plugin_call_func (list=0x13bc790, operation=560, 
    pb=0x1c1cd40, call_one=0) at ldap/servers/slapd/plugin.c:1450
#11 0x0000003931c8a554 in plugin_call_list (pb=0x1c1cd40, operation=560, 
    list=<optimized out>) at ldap/servers/slapd/plugin.c:1412
#12 plugin_call_plugins (pb=0x1c1cd40, whichfunction=560)
    at ldap/servers/slapd/plugin.c:395
#13 0x00007f6259fecb45 in ldbm_back_add (pb=0x1c1cd40)
    at ldap/servers/slapd/back-ldbm/ldbm_add.c:918
#14 0x0000003931c3f3b7 in op_shared_add (pb=0x1c1cd40)
    at ldap/servers/slapd/add.c:680
#15 0x0000003931c404c8 in do_add (pb=0x1c1cd40) at ldap/servers/slapd/add.c:258
#16 0x0000000000417098 in connection_dispatch_operation (pb=<optimized out>, 
    op=0x1c1ca30, conn=0x7f6250afc560) at ldap/servers/slapd/connection.c:576
#17 connection_threadmain () at ldap/servers/slapd/connection.c:2336
#18 0x0000003866e28553 in _pt_root (arg=0x148d4a0)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:187
#19 0x0000003863e07b41 in start_thread (arg=0x7f623b7fe700)
    at pthread_create.c:305
#20 0x00000038636df49d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
(gdb) up
#1  0x0000003931cb4caa in slapi_value_set_string_passin (value=0x7f623b7f7450, 
    strVal=0x0) at ldap/servers/slapd/value.c:381
381             value->bv.bv_len = strlen(strVal);
(gdb) print strVal
$1 = 0x0

Version-Release number of selected component (if applicable):

389-ds-base-1.2.10.1-1.fc15.x86_64
slapi-nis-0.36-1.fc15.x86_64

Steps to Reproduce:
1. yum install freeipa-server
2. ipa-server-install
3. kinit admin
4. ipa netgroup-add --desc=bad +bad

--- Additional comment from nalin@redhat.com on 2012-02-23 14:10:32 EST ---

At line back-sch.c:275 we're trying setting the 'entryDN' to the entry's DN, which should already have been set in the calling function, so there's an error case here that the plugin's not handling right.

--- Additional comment from nalin@redhat.com on 2012-02-23 20:01:38 EST ---

The plugin is failing to correctly escape values used in constructing the RDN, and that's letting it create entries with malformed DNs attached to them that sometimes get retrieved as NULL.

I'm targeting 0.38 for the fix -- if you can test with a version dated after 2012-02-24-01:00:00Z, they should handle such cases (not just entries with names containing "+", but other important characters such as "=", ":", and the like) correctly.

--- Additional comment from nalin@redhat.com on 2012-03-06 12:31:22 EST ---

Have you had a chance to test yet?  If it passes muster, I can tag a release and start the ball rolling on updates.

--- Additional comment from rcritten@redhat.com on 2012-03-06 14:11:42 EST ---

Confirmed, no more core dump.
Comment 3 Scott Poore 2012-03-16 17:47:32 EDT
Verified.

Version :: ipa-server-2.2.0-4.el6.x86_64

Automated Test Results :: ipa-server-2.2.0-4.el6.x86_64

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: netgroup_bz_800625: Bad netgroup name causes ns-slapd to segfault
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Running 'ldapmodify -a -x -D "cn=Directory Manager" -w "Secret123" -f /tmp/netgroup_crash.ldif'
:: [   PASS   ] :: Running 'ipactl status > /netgroup_bz_800625.22323.out 2>&1'
:: [   PASS   ] :: BZ 800625 not found...
:: [   LOG    ] :: Duration: 5s
:: [   LOG    ] :: Assertions: 3 good, 0 bad
:: [   PASS   ] :: RESULT: netgroup_bz_800625: Bad netgroup name causes ns-slapd to segfault

Manual Test Results ::

[root@hp-xw6600-01 ipa-netgroup-cli]# ipa-compat-manage status
Directory Manager password: 

Plugin Enabled

[root@hp-xw6600-01 ipa-netgroup-cli]# cat << EOF > /tmp/netgroup_crash.ldif
> dn: ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1b4,cn=ng,cn=alt,dc=testrelm,dc=com
> objectClass: ipaobject
> objectClass: ipaassociation
> objectClass: ipanisnetgroup
> cn: +badtestnetgroup
> description: netgroup_with_plus_kills_dirsrv
> nisDomainName: testrelm.com
> ipaUniqueID: 170df1b8-688b-11e1-9cfb-5254000ea1b4
> EOF

[root@hp-xw6600-01 ipa-netgroup-cli]# ldapmodify -a -x -D "cn=Directory Manager" -w "********" -f /tmp/netgroup_crash.ldif 
adding new entry "ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1b4,cn=ng,cn=alt,dc=testrelm,dc=com"

[root@hp-xw6600-01 ipa-netgroup-cli]# ipactl status
Directory Service: RUNNING
KDC Service: RUNNING
KPASSWD Service: RUNNING
DNS Service: RUNNING
MEMCACHE Service: RUNNING
HTTP Service: RUNNING
CA Service: RUNNING

[root@hp-xw6600-01 ipa-netgroup-cli]# ldapsearch -x -D "cn=Directory Manager" -w "*********" -b "ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1b4,cn=ng,cn=alt,dc=testrelm,dc=com"
# extended LDIF
#
# LDAPv3
# base <ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1b4,cn=ng,cn=alt,dc=testrelm,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# 170df1b8-688b-11e1-9cfb-5254000ea1b4, ng, alt, testrelm.com
dn: ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1b4,cn=ng,cn=alt,dc=testrelm,
 dc=com
objectClass: ipaobject
objectClass: ipaassociation
objectClass: ipanisnetgroup
cn: +badtestnetgroup
description: netgroup_with_plus_kills_dirsrv
nisDomainName: testrelm.com
ipaUniqueID: 170df1b8-688b-11e1-9cfb-5254000ea1b4

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1


Also did a quick Manual Test for = in name:
[root@hp-xw6600-01 ipa-netgroup-cli]# ldapmodify -a -x -D "$ROOTDN" -w "$ROOTDNPWD" 
dn: ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1a7,cn=ng,cn=alt,dc=testrelm,dc=com
objectClass: ipaobject
objectClass: ipaassociation
objectClass: ipanisnetgroup
cn: =badtestgroup
description: netgroup_with_plus_kills_dirsrv
nisDomainName: testrelm.com
ipaUniqueID: 170df1b8-688b-11e1-9cfb-5254000ea1a7
adding new entry "ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1a7,cn=ng,cn=alt,dc=testrelm,dc=com"

[root@hp-xw6600-01 ipa-netgroup-cli]# ldapsearch -x -D "$ROOTDN" -w "$ROOTDNPWD" -b ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1a7,cn=ng,cn=alt,dc=testrelm,dc=com
# extended LDIF
#
# LDAPv3
# base <ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1a7,cn=ng,cn=alt,dc=testrelm,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# 170df1b8-688b-11e1-9cfb-5254000ea1a7, ng, alt, testrelm.com
dn: ipaUniqueID=170df1b8-688b-11e1-9cfb-5254000ea1a7,cn=ng,cn=alt,dc=testrelm,
 dc=com
objectClass: ipaobject
objectClass: ipaassociation
objectClass: ipanisnetgroup
cn: =badtestgroup
description: netgroup_with_plus_kills_dirsrv
nisDomainName: testrelm.com
ipaUniqueID: 170df1b8-688b-11e1-9cfb-5254000ea1a7

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
Comment 4 errata-xmlrpc 2012-06-20 09:36:49 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0821.html

Note You need to log in before you can comment on or make changes to this bug.