Shibd crashing on LogoutRequest

[Yannick Béot]

Hi everybody,

I am currently investigating a crash of shibd (segfault). The access log of
apache is showing that a LogoutRequest is responsible for it.
The only thing exceptional in this LogoutRequest is that there are several
SessionIndex in the LogoutRequest.


Shibd logs shows that it crashes at the input validation:

2012-07-09 14:19:17 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [92]:
signing the message

2012-07-09 14:19:17 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [92]:
message encoded, sending redirect to client

2012-07-09 14:19:27 DEBUG Shibboleth.Listener [90]: dispatching message
(default/SLO/Redirect)

2012-07-09 14:19:27 DEBUG OpenSAML.MessageDecoder.SAML2Redirect [90]:
validating input

(after that, it is just the restart of the service)

The LogoutRequest extracted from access log looks like:

<samlp:LogoutRequest ID="_3ba7deca-959e-4e34-b442-cdae747b5119"
Version="2.0" IssueInstant="2012-07-09T12:19:26.005Z" Destination="
https://XXX/Shibboleth.sso/SLO/Redirect"
Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
NotOnOrAfter="2012-07-09T12:24:26.005Z"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">XXX</Issuer><NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos"
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">XXX at domain.com
</NameID><samlp:SessionIndex>_8fafb292-03ce-4de0-be8a-8201496bec5f</samlp:SessionIndex><samlp:SessionIndex>_827fd115-5b17-4503-9596-8da4719a6502</samlp:SessionIndex><samlp:SessionIndex>_996cfa36-75d6-41a8-a180-59f916e100ae</samlp:SessionIndex><samlp:SessionIndex>_f2647ae0-365e-4fbd-bce0-c03977cd7d1d</samlp:SessionIndex><samlp:SessionIndex>_7d20fcce-07a7-47d3-b528-5b269deab931</samlp:SessionIndex><samlp:SessionIndex>_4d0f8911-e47c-436e-bb77-e7d35a2876e9</samlp:SessionIndex></samlp:LogoutRequest>

All SessionIndexes were found in the transaction.log for the correct user.

Some information on my system:
# shibd -v
shibboleth 2.4.3
# apachectl -v
Server version: Apache/2.2.3
Server built:   Mar  4 2010 09:57:54
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.5 (Tikanga)

I do not have core dumps for the moment. I will work on it but it is a
production environment.

Do you see a test to perform?

Best regards,

Yannick Béot
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120709/c8b4a72a/attachment.html