Hi everybody,<div><br></div><div>I am currently investigating a crash of shibd (segfault). The access log of apache is showing that a LogoutRequest is responsible for it.</div><div>The only thing exceptional in this LogoutRequest is that there are several SessionIndex in the LogoutRequest.</div>
<div><br></div><div><br></div>Shibd logs shows that it crashes at the input validation:<br><br><font face="courier new, monospace">2012-07-09 14:19:17 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [92]: signing the message<br>
<br>2012-07-09 14:19:17 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [92]: message encoded, sending redirect to client<br><br>2012-07-09 14:19:27 DEBUG Shibboleth.Listener [90]: dispatching message (default/SLO/Redirect)<br>
<br>2012-07-09 14:19:27 DEBUG OpenSAML.MessageDecoder.SAML2Redirect [90]: validating input</font><br><br>(after that, it is just the restart of the service)<div><br></div><div>The LogoutRequest extracted from access log looks like:</div>
<div><p style="margin:0in;font-size:11pt"><font face="courier new, monospace"><samlp:LogoutRequest
ID="_3ba7deca-959e-4e34-b442-cdae747b5119" Version="2.0"
IssueInstant="2012-07-09T12:19:26.005Z"
Destination="<a href="https://XXX/Shibboleth.sso/SLO/Redirect">https://XXX/Shibboleth.sso/SLO/Redirect</a>"
Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
NotOnOrAfter="2012-07-09T12:24:26.005Z"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">XXX</Issuer><NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos"
xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><a href="mailto:XXX@domain.com">XXX@domain.com</a></NameID><samlp:SessionIndex>_8fafb292-03ce-4de0-be8a-8201496bec5f</samlp:SessionIndex><samlp:SessionIndex>_827fd115-5b17-4503-9596-8da4719a6502</samlp:SessionIndex><samlp:SessionIndex>_996cfa36-75d6-41a8-a180-59f916e100ae</samlp:SessionIndex><samlp:SessionIndex>_f2647ae0-365e-4fbd-bce0-c03977cd7d1d</samlp:SessionIndex><samlp:SessionIndex>_7d20fcce-07a7-47d3-b528-5b269deab931</samlp:SessionIndex><samlp:SessionIndex>_4d0f8911-e47c-436e-bb77-e7d35a2876e9</samlp:SessionIndex></samlp:LogoutRequest></font></p>
</div><div><br></div><div>All SessionIndexes were found in the transaction.log for the correct user.</div><div><br></div><div>Some information on my system:</div><div><div><font face="courier new, monospace"># shibd -v</font></div>
<div><font face="courier new, monospace">shibboleth 2.4.3</font></div><div><font face="courier new, monospace"># apachectl -v</font></div><div><font face="courier new, monospace">Server version: Apache/2.2.3</font></div><div>
<font face="courier new, monospace">Server built: Mar 4 2010 09:57:54</font></div><div><span style="font-family:'courier new',monospace"># cat /etc/redhat-release</span></div><div><font face="courier new, monospace">Red Hat Enterprise Linux Server release 5.5 (Tikanga)</font></div>
</div><div><br></div><div>I do not have core dumps for the moment. I will work on it but it is a production environment.</div><div><br></div><div>Do you see a test to perform?</div><div><br></div><div>Best regards,</div><div>
<br></div><div>Yannick Béot</div>