Re: NSLCD: Resource temporarily unavailable

[Arthur de Jong <arthur [at] arthurdejong.org>]

On Thu, 2014-01-23 at 16:00 +0100, Alexey Tyurikov wrote:
> I haven't noticed any special requests but it looks like the daemon
> crashes if there are two requests on the same gid simultaneously (s.
> below)

Thanks for this information and thanks for the backtraces.

Two threads seem to be simultaneously calling krb5_encrypt(). Perhaps
libkrb5 is not thread-safe (or perhaps libgssapi_krb5, libgssapiv2 or
libsasl2). At least the libldap_r used should be thread-safe (nslcd
should use it correctly already).

I'll try to set up a FreeBSD test environment with Kerberos
authentication but that may take a while. In the meantime, if you can
install debug symbols for libcrypto, libkrb5 and libgssapi_krb5 (I'm
unsure how to do that on FreeBSD so tips are welcome) the backtraces
should be a little more useful.

A workaround to avoid the crashes is to set the threads option in
nslcd.conf to 1 but this could cause deadlocks (will time out after a
minute) if one application is doing parallel NSS requests.

> Thread 7 (Thread 801c09400 (LWP 102086/nslcd)):
> #0  0x0000000801798d7a in SHA1_Init () from /lib/libcrypto.so.6
> #1  0x0000000801799fd6 in SHA1_Update () from /lib/libcrypto.so.6
> #2  0x000000080176300b in RAND_SSLeay () from /lib/libcrypto.so.6
> #3  0x0000000804079c30 in krb5_generate_random_block () from 
> /usr/lib/libkrb5.so.10
> #4  0x000000080407adc9 in krb5_encrypt_ivec () from /usr/lib/libkrb5.so.10
> #5  0x000000080407b1a1 in krb5_encrypt () from /usr/lib/libkrb5.so.10
> #6  0x0000000806215a21 in _gssapi_wrap_cfx () from 
> /usr/lib/libgssapi_krb5.so.10
> #7  0x000000080620f2c1 in _gsskrb5_wrap () from /usr/lib/libgssapi_krb5.so.10
> #8  0x0000000803a18e0e in gssapiv2_client_plug_init () from 
> /usr/local/lib/sasl2/libgssapiv2.so.3
> #9  0x0000000801221084 in sasl_done () from /usr/local/lib/libsasl2.so.3
> #10 0x00000008012215a1 in sasl_encodev () from /usr/local/lib/libsasl2.so.3
> #11 0x000000080122170f in sasl_encode () from /usr/local/lib/libsasl2.so.3
> #12 0x0000000800853e45 in sb_sasl_cyrus_encode () from 
> /usr/local/lib/libldap_r-2.4.so.8
> #13 0x00000008008561f9 in sb_sasl_generic_write () from 
> /usr/local/lib/libldap_r-2.4.so.8
> #14 0x000000080100fec4 in sb_debug_write () from 
> /usr/local/lib/liblber-2.4.so.8
> #15 0x00000008010101d3 in ber_int_sb_write () from 
> /usr/local/lib/liblber-2.4.so.8
> #16 0x000000080100e0f8 in ber_flush2 () from /usr/local/lib/liblber-2.4.so.8
> #17 0x0000000800860e9c in ldap_int_flush_request () from 
> /usr/local/lib/libldap_r-2.4.so.8
> #18 0x0000000800861329 in ldap_send_server_request () from 
> /usr/local/lib/libldap_r-2.4.so.8
> #19 0x0000000800861532 in ldap_send_initial_request () from 
> /usr/local/lib/libldap_r-2.4.so.8
> #20 0x0000000800851701 in ldap_pvt_search () from 
> /usr/local/lib/libldap_r-2.4.so.8
> #21 0x0000000800851940 in ldap_search_ext () from 
> /usr/local/lib/libldap_r-2.4.so.8
> #22 0x000000000040754a in ?? ()
> #23 0x0000000000408529 in ?? ()
> #24 0x00000000004115ea in ?? ()
> #25 0x0000000000404eb5 in ?? ()
> #26 0x0000000800a91d34 in pthread_getprio () from /lib/libthr.so.3
> #27 0x0000000000000000 in ?? ()
> 
> 
> Thread 3 (Thread 801c08400 (LWP 101016/nslcd)):
> #0  0x0000000800db61d0 in memcpy () from /lib/libc.so.7
> #1  0x000000080407bb8a in _krb5_n_fold () from /usr/lib/libkrb5.so.10
> #2  0x0000000804076d19 in krb5_crypto_destroy () from /usr/lib/libkrb5.so.10
> #3  0x000000080407a2d5 in krb5_generate_random_keyblock () from 
> /usr/lib/libkrb5.so.10
> #4  0x000000080407b09d in krb5_encrypt_ivec () from /usr/lib/libkrb5.so.10
> #5  0x000000080407b1a1 in krb5_encrypt () from /usr/lib/libkrb5.so.10
[...]

-- 
-- arthur - arthur@arthurdejong.org - http://arthurdejong.org/ --

-- 
To unsubscribe send an email to
nss-pam-ldapd-users-unsubscribe@lists.arthurdejong.org or see
http://lists.arthurdejong.org/nss-pam-ldapd-users/