[JIRA] (SSPCPP-964) crash while checking configuration

[Guillaume Rousse (Jira)]

Guillaume Rousse ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60e5b3911fd2a300702a15b7 ) *created* an issue

Shibboleth SP - C++ ( https://shibboleth.atlassian.net/browse/SSPCPP?atlOrigin=eyJpIjoiYzFjNzQxNjMwNjAwNGFmMTkyOGZjMzczOGUxMWQ1MTgiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/SSPCPP-964?atlOrigin=eyJpIjoiYzFjNzQxNjMwNjAwNGFmMTkyOGZjMzczOGUxMWQ1MTgiLCJwIjoiaiJ9 ) SSPCPP-964 ( https://shibboleth.atlassian.net/browse/SSPCPP-964?atlOrigin=eyJpIjoiYzFjNzQxNjMwNjAwNGFmMTkyOGZjMzczOGUxMWQ1MTgiLCJwIjoiaiJ9 ) crash while checking configuration ( https://shibboleth.atlassian.net/browse/SSPCPP-964?atlOrigin=eyJpIjoiYzFjNzQxNjMwNjAwNGFmMTkyOGZjMzczOGUxMWQ1MTgiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.4.0 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Configuration Created: 28/Nov/22 9:44 AM Priority: Trivial Reporter: Guillaume Rousse ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60e5b3911fd2a300702a15b7 )

On a CentOS Stream 8, using packages provided by the Shibboleth foundation, shibd runs perfectly, but crashes while checking configuration, using the same user (shibd):

$ sudo -u shibd shibd -tc /etc/shibboleth/shibboleth2.xml
overall configuration is loadable, check console or log for non-fatal problems
Erreur de segmentation

gdb shows the error happens while checking cached individual metadata entries, apparently while calling doFilters() method (see full gdb output attached). This is the corresponding metadata provider configuration, without any filter attached:

<MetadataProvider type="MDQ" cacheDirectory="fer" baseUrl= "https://mdq.federation.renater.fr/fer" ( https://mdq.federation.renater.fr/fer ) >
<TrustEngine type="StaticPKIX" certificate="/etc/pki/tls/certs/usertrust_rsa_certification_authority.crt"/>
</MetadataProvider>

strace (see full strace output attached) shows multiple process forked to check individual files, the crash occuring in process 445903, just after the processing of the file mentionned in gdb output (f6a059dab40b8813389547662102e7612acd5b27.xml).

Despite to my initial assertion, this is not 100% reproductible, merely 90%. But still only on our production cluster, not in other environments, with very few cached entries. This looks likes some kind of inter-processus locking issue.

It’s a recent issue, discovered during a trivial configuration change. As our maintenance process didn’t change (copy new configuration file, check configuration, restart), but we upgraded to version 3.4.0 recently, this is either due to a change in shibd itself, or eventually to the package build process.

I’m attaching full configuration also, in case it helps.

Regards

--

( https://shibboleth.atlassian.net/browse/SSPCPP-964#add-comment?atlOrigin=eyJpIjoiYzFjNzQxNjMwNjAwNGFmMTkyOGZjMzczOGUxMWQ1MTgiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-964#add-comment?atlOrigin=eyJpIjoiYzFjNzQxNjMwNjAwNGFmMTkyOGZjMzczOGUxMWQ1MTgiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:4037f92 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221128/b0bdd54d/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-99fec84a-c1e1-4c2b-9515-856bc1ce2fba
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221128/b0bdd54d/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-5814505f-97d5-4f6f-bef0-a591683d6785
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221128/b0bdd54d/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-1392e4e7-b7d0-4d79-92df-981aa2d136f9
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221128/b0bdd54d/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-e6bd28c3-ec28-4a21-ba00-fb5797d3dfa8
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221128/b0bdd54d/attachment-0007.png>