On Tue, 2011-06-28 at 13:42 +0200, Sumit Bose wrote:
Hi,
currently we have two competing features in the LDAP provider. One the
one hand we want to avoid further DNS lookups by the OpenLDAP client
libraries and want to talk to the same LDAP server as long as possible.
To achieve this we create LDAP URIs with the IP instead of the server
name and pass them to ldap_initialize(). But this in general leads to
failures when TLS/SSL certificates are validated, because here the node
part of the URI is extracted and compared to the common name and the
subject alternative names in the certificate. If the IP address of the
server is not among them, which in general is the case, the validation
fails.
To solve this this series of patches substitutes ldap_initialize() by a
sequence of socket(), connect() and ldap_init_fd(). Now we can use the
IP address during connect() and the URI iwth the server name in
ldap_init_fd().
The corresponding trac ticket is
https://fedorahosted.org/sssd/ticket/905 .
bye,
Sumit
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Nack.
These patches segfault when used with TLS (I haven't tested LDAPS yet).
Program terminated with signal 11, Segmentation fault.
#0 0x00007ff37d49b382 in sss_ldap_init_send (mem_ctx=0xc78590,
ev=0xc40500, uri=0xc78480 "ldap://10.16.78.53", addr=0x0, addr_len=128)
at ../src/util/sss_ldap.c:335
335 state->sd = socket(addr->ss_family, SOCK_STREAM, 0);
Missing separate debuginfos, use: debuginfo-install
sssd-1.6.0-0.20110624T1850Zgit203b6bc.fc15.x86_64
(gdb) bt
#0 0x00007ff37d49b382 in sss_ldap_init_send (mem_ctx=0xc78590,
ev=0xc40500, uri=0xc78480 "ldap://10.16.78.53", addr=0x0, addr_len=128)
at ../src/util/sss_ldap.c:335
#1 0x00007ff37d483b01 in sdap_connect_send (memctx=0xc78110,
ev=0xc40500, opts=0xc63350, uri=0xc78480 "ldap://10.16.78.53",
sockaddr=0x0,
use_start_tls=false)
at ../src/providers/ldap/sdap_async_connection.c:115
#2 0x00007ff37d4889c6 in sdap_cli_resolve_done (subreq=0x0)
at ../src/providers/ldap/sdap_async_connection.c:1192
#3 0x000000000040fa4b in be_resolve_server_done (subreq=0x0)
at ../src/providers/data_provider_fo.c:483
#4 0x0000000000415e4f in fo_resolve_service_done (subreq=0x0)
at ../src/providers/fail_over.c:912
#5 0x000000000041b795 in resolv_gethostbyname_done (subreq=0x0)
at ../src/resolv/async_resolv.c:1248
#6 0x00000031b7c03de2 in tevent_common_loop_immediate (ev=0xc40500)
at ../tevent_immediate.c:135
#7 0x00000031b7c05c06 in std_event_loop_once (ev=0xc40500,
location=<optimized out>) at ../tevent_standard.c:533
#8 0x00000031b7c035b0 in _tevent_loop_once (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:493
#9 0x00000031b7c0373b in tevent_common_loop_wait (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:594
#10 0x00000000004332f2 in server_loop (main_ctx=0xc41670)
at ../src/util/server.c:550
#11 0x000000000040e168 in main (argc=4, argv=0x7fff686a1bc8)
at ../src/providers/data_provider_be.c:1254
(gdb)
#0 0x00007ff37d49b382 in sss_ldap_init_send (mem_ctx=0xc78590,
ev=0xc40500, uri=0xc78480 "ldap://10.16.78.53", addr=0x0, addr_len=128)
at ../src/util/sss_ldap.c:335
#1 0x00007ff37d483b01 in sdap_connect_send (memctx=0xc78110,
ev=0xc40500, opts=0xc63350, uri=0xc78480 "ldap://10.16.78.53",
sockaddr=0x0,
use_start_tls=false)
at ../src/providers/ldap/sdap_async_connection.c:115
#2 0x00007ff37d4889c6 in sdap_cli_resolve_done (subreq=0x0)
at ../src/providers/ldap/sdap_async_connection.c:1192
#3 0x000000000040fa4b in be_resolve_server_done (subreq=0x0)
at ../src/providers/data_provider_fo.c:483
#4 0x0000000000415e4f in fo_resolve_service_done (subreq=0x0)
at ../src/providers/fail_over.c:912
#5 0x000000000041b795 in resolv_gethostbyname_done (subreq=0x0)
at ../src/resolv/async_resolv.c:1248
#6 0x00000031b7c03de2 in tevent_common_loop_immediate (ev=0xc40500)
at ../tevent_immediate.c:135
#7 0x00000031b7c05c06 in std_event_loop_once (ev=0xc40500,
location=<optimized out>) at ../tevent_standard.c:533
#8 0x00000031b7c035b0 in _tevent_loop_once (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:493
#9 0x00000031b7c0373b in tevent_common_loop_wait (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:594
#10 0x00000000004332f2 in server_loop (main_ctx=0xc41670)
at ../src/util/server.c:550
#11 0x000000000040e168 in main (argc=4, argv=0x7fff686a1bc8)
at ../src/providers/data_provider_be.c:1254
(gdb)
#0 0x00007ff37d49b382 in sss_ldap_init_send (mem_ctx=0xc78590,
ev=0xc40500, uri=0xc78480 "ldap://10.16.78.53", addr=0x0, addr_len=128)
at ../src/util/sss_ldap.c:335
#1 0x00007ff37d483b01 in sdap_connect_send (memctx=0xc78110,
ev=0xc40500, opts=0xc63350, uri=0xc78480 "ldap://10.16.78.53",
sockaddr=0x0,
use_start_tls=false)
at ../src/providers/ldap/sdap_async_connection.c:115
#2 0x00007ff37d4889c6 in sdap_cli_resolve_done (subreq=0x0)
at ../src/providers/ldap/sdap_async_connection.c:1192
#3 0x000000000040fa4b in be_resolve_server_done (subreq=0x0)
at ../src/providers/data_provider_fo.c:483
#4 0x0000000000415e4f in fo_resolve_service_done (subreq=0x0)
at ../src/providers/fail_over.c:912
#5 0x000000000041b795 in resolv_gethostbyname_done (subreq=0x0)
at ../src/resolv/async_resolv.c:1248
#6 0x00000031b7c03de2 in tevent_common_loop_immediate (ev=0xc40500)
at ../tevent_immediate.c:135
#7 0x00000031b7c05c06 in std_event_loop_once (ev=0xc40500,
location=<optimized out>) at ../tevent_standard.c:533
#8 0x00000031b7c035b0 in _tevent_loop_once (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:493
#9 0x00000031b7c0373b in tevent_common_loop_wait (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:594
#10 0x00000000004332f2 in server_loop (main_ctx=0xc41670)
at ../src/util/server.c:550
#11 0x000000000040e168 in main (argc=4, argv=0x7fff686a1bc8)
at ../src/providers/data_provider_be.c:1254
(gdb)
#0 0x00007ff37d49b382 in sss_ldap_init_send (mem_ctx=0xc78590,
ev=0xc40500, uri=0xc78480 "ldap://10.16.78.53", addr=0x0, addr_len=128)
at ../src/util/sss_ldap.c:335
#1 0x00007ff37d483b01 in sdap_connect_send (memctx=0xc78110,
ev=0xc40500, opts=0xc63350, uri=0xc78480 "ldap://10.16.78.53",
sockaddr=0x0,
use_start_tls=false)
at ../src/providers/ldap/sdap_async_connection.c:115
#2 0x00007ff37d4889c6 in sdap_cli_resolve_done (subreq=0x0)
at ../src/providers/ldap/sdap_async_connection.c:1192
#3 0x000000000040fa4b in be_resolve_server_done (subreq=0x0)
at ../src/providers/data_provider_fo.c:483
#4 0x0000000000415e4f in fo_resolve_service_done (subreq=0x0)
at ../src/providers/fail_over.c:912
#5 0x000000000041b795 in resolv_gethostbyname_done (subreq=0x0)
at ../src/resolv/async_resolv.c:1248
#6 0x00000031b7c03de2 in tevent_common_loop_immediate (ev=0xc40500)
at ../tevent_immediate.c:135
#7 0x00000031b7c05c06 in std_event_loop_once (ev=0xc40500,
location=<optimized out>) at ../tevent_standard.c:533
#8 0x00000031b7c035b0 in _tevent_loop_once (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:493
#9 0x00000031b7c0373b in tevent_common_loop_wait (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:594
#10 0x00000000004332f2 in server_loop (main_ctx=0xc41670)
at ../src/util/server.c:550
#11 0x000000000040e168 in main (argc=4, argv=0x7fff686a1bc8)
at ../src/providers/data_provider_be.c:1254
(gdb) bt full
#0 0x00007ff37d49b382 in sss_ldap_init_send (mem_ctx=0xc78590,
ev=0xc40500, uri=0xc78480 "ldap://10.16.78.53", addr=0x0, addr_len=128)
at ../src/util/sss_ldap.c:335
ret = 0
req = 0xc78c30
state = 0xc78cf0
__FUNCTION__ = "sss_ldap_init_send"
subreq = 0x7ff37d46766d
#1 0x00007ff37d483b01 in sdap_connect_send (memctx=0xc78110,
ev=0xc40500, opts=0xc63350, uri=0xc78480 "ldap://10.16.78.53",
sockaddr=0x0,
use_start_tls=false)
at ../src/providers/ldap/sdap_async_connection.c:115
req = 0xc788c0
subreq = 0xc78140
state = 0xc78590
ret = 0
__FUNCTION__ = "sdap_connect_send"
#2 0x00007ff37d4889c6 in sdap_cli_resolve_done (subreq=0x0)
at ../src/providers/ldap/sdap_async_connection.c:1192
req = 0xc77fa0
state = 0xc78110
ret = 0
use_tls = false
__FUNCTION__ = "sdap_cli_resolve_done"
#3 0x000000000040fa4b in be_resolve_server_done (subreq=0x0)
at ../src/providers/data_provider_fo.c:483
req = 0xc781b0
state = 0xc78320
callback = 0x0
ret = 0
srv_status_change = 1309266651
__FUNCTION__ = "be_resolve_server_done"
#4 0x0000000000415e4f in fo_resolve_service_done (subreq=0x0)
at ../src/providers/fail_over.c:912
req = 0xc78c30
state = 0xc78510
common = 0xc62d80
resolv_status = 0
request = 0xc786a0
ret = 0
__FUNCTION__ = "fo_resolve_service_done"
#5 0x000000000041b795 in resolv_gethostbyname_done (subreq=0x0)
at ../src/resolv/async_resolv.c:1248
req = 0xc788c0
state = 0xc783a0
---Type <return> to continue, or q <return> to quit---
ret = 0
__FUNCTION__ = "resolv_gethostbyname_done"
#6 0x00000031b7c03de2 in tevent_common_loop_immediate (ev=0xc40500)
at ../tevent_immediate.c:135
im = 0xc78590
handler = 0x31b7c04430 <tevent_req_trigger>
private_data = 0xc78440
#7 0x00000031b7c05c06 in std_event_loop_once (ev=0xc40500,
location=<optimized out>) at ../tevent_standard.c:533
std_ev = 0xc405c0
tval = {tv_sec = 3, tv_usec = 77829}
#8 0x00000031b7c035b0 in _tevent_loop_once (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:493
ret = <optimized out>
nesting_stack_ptr = 0x0
#9 0x00000031b7c0373b in tevent_common_loop_wait (ev=0xc40500,
location=0x43e96a "../src/util/server.c:550") at ../tevent.c:594
ret = <optimized out>
#10 0x00000000004332f2 in server_loop (main_ctx=0xc41670)
at ../src/util/server.c:550
No locals.
#11 0x000000000040e168 in main (argc=4, argv=0x7fff686a1bc8)
at ../src/providers/data_provider_be.c:1254
opt = -1
pc = 0xc3f010
be_domain = 0xc3f410 "sgallagh-test.bos.redhat.com"
srv_name = 0xc3f0e0 "sssd[be[sgallagh-test.bos.redhat.com]]"
main_ctx = 0xc41670
confdb_path = 0xc3f160
"config/domain/sgallagh-test.bos.redhat.com"
ret = 0
long_options = {{longName = 0x0, shortName = 0 '\000', argInfo =
4, arg = 0x643e00, val = 0, descrip = 0x437803 "Help options:",
argDescrip = 0x0}, {
longName = 0x437811 "debug-level", shortName = 100 'd',
argInfo = 2, arg = 0x643dd4, val = 0, descrip = 0x43781d "Debug level",
argDescrip = 0x0}, {longName = 0x437829 "debug-to-files",
shortName = 102 'f', argInfo = 0, arg = 0x643ee0, val = 0,
descrip = 0x437838 "Send the debug output to files instead
of stderr", argDescrip = 0x0}, {longName = 0x437869 "debug-timestamps",
shortName = 0 '\000', argInfo = 2, arg = 0x643dd8, val = 0,
descrip = 0x43787a "Add debug timestamps", argDescrip = 0x0}, {
longName = 0x43788f "domain", shortName = 0 '\000', argInfo
= 1, arg = 0x7fff686a1aa0, val = 0,
descrip = 0x437898 "Domain of the information provider
(mandatory)", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\000',
argInfo = 0,
arg = 0x0, val = 0, descrip = 0x0, argDescrip = 0x0}}
__FUNCTION__ = "main"