Solaris 10 update 5 - nss_ldap makes nscd dump core

[Bernhard Thalmayr]

Hi experts,
after patching the boxes to Solaris Update 5, my previous working
nss_ldap now makes nscd dump core.

I've built nss_ldap (and pam_ldap) to use libldap.so.5 (comming with
Solaris 10) and Network Security Services SSL implementation (also
comming with Solaris 10).

I've created many cores  and truss outputs for different kind of calls -
like 'gepwuid_r' or 'getgrnam_r'.

Analysing the core revealed that problem always happens in function

_nss_ldap_parse_pw

( line 99 ldap-pwd.c)

pw->pw_passwd = buffer;

Hower 'pw' is 'NULL'.

pw is 'retrieved' from the 'args' pointer argument of f.e.
_nss_ldap_getpwuid_r

nscd calls it's internal (not the one from libc) nss_search with
nss_search(NULL,...).

If nscd is shut down, nss_search from libc is used and this one doesn't
call nss_search(NULL,...) but nss_search(<Adress_of_some_structure>,...)

Unfortunately I can not shut down nscd because I've some legacy
application running which have been linked to libldap.so.4 and which do
no allow to use LD_PRELOAD.

How could this problem be solved?

Thanks in advance,
Bernhard

[Thomas Glanzmann]

Hello Bernhard,
SUN changed the API so with Solaris 10 Update 5 nss_ldap does no longer
work, even when you fixed the bug that is triggering your core dump. But
you can stop nscd which of course triggers a ldap query for every getpw*
function.

        Thomas

[Patrick Radtke]

I haven't been following these Sol 10 threads so this may have already
been suggested.
We had issues with our own nss module and Solaris 10 and found that this
patch makes things better

http://sunsolve.sun.com/search/document.do?assetkey=1-21-138046-01-1

It fixes bug '6644077 nscd rejects foreign nsswitch backends'

-Patrick

Thomas Glanzmann wrote:
> Hello Bernhard,
> SUN changed the API so with Solaris 10 Update 5 nss_ldap does no longer
> work, even when you fixed the bug that is triggering your core dump. But
> you can stop nscd which of course triggers a ldap query for every getpw*
> function.
>
>         Thomas
>  

[Thomas Glanzmann]

Hallo Patrick,

> I haven't been following these Sol 10 threads so this may have already been
> suggested.
> We had issues with our own nss module and Solaris 10 and found that this
> patch makes things better

> http://sunsolve.sun.com/search/document.do?assetkey=1-21-138046-01-1

> It fixes bug '6644077 nscd rejects foreign nsswitch backends'

actually I applied that patch and nothing changed for me. Do you have
a different experiences?

        Thomas

[Bernhard Thalmayr]

Hi Thomas,

thanks for your statement.
I know that Sun has changed the API (AFAIK it's a private one so this
can be done any time).

However only the way 'nscd' is calling getXbyY function seems to be an
issue - and as far I could see only the 'reentrant' versions of the
calls are affected.

As you may have seen in my post I can not shutdown 'nscd' because the
process calling 'getpwuid_r' has been linked to libldap.so.4 whereas
nss_ldap has been linked to libldap.so.5. This makes nss_ldap  not to
communicate with the directory server at all. (See the posting from
Larry Low)

Furthermore I can not use LD_PRELOAD.

I wonder why 'getpwuid_r' (or all the other calls) are working fine if
they are called by 'libc' instead of 'nscd'. In general I would think if
the API has changed completley neither the one nor the other should work
- however I'm not an OS expert.

Unfortunatley I'm not a C-programmer, so I can not tell if it's a good
practice to rely on a structure without checking if there's something at
all.

As 'nscd' calls 'nss_search(NULL,...' I guess the argument is not needed
an the underlying code should not rely on it beeing created.

I also wonder what might happen having an official support-contract with
PADL. Will 'nss_ldap' be fixed to deal with the new architecture of the
nameservice-switch in Solaris 10 / OpenSolaris?

Thanks and regards,
Bernhard

Thomas Glanzmann schrieb:
> Hello Bernhard,
> SUN changed the API so with Solaris 10 Update 5 nss_ldap does no longer
> work, even when you fixed the bug that is triggering your core dump. But
> you can stop nscd which of course triggers a ldap query for every getpw*
> function.
>
>         Thomas
>

[Lukeh-3]

> I also wonder what might happen having an official support-contract  
> with PADL. Will 'nss_ldap' be fixed to deal with the new  
> architecture of the nameservice-switch in Solaris 10 / OpenSolaris?

If someone wants to buy enough consulting hours to get it done,  
certainly.

Another possibility is to approach Symas.

-- Luke

[Matthew Hardin]

Hi All,

We're in the process of testing the changes required to support  
Solaris 10u5. We'll be sending along patches when we're done.

Cheers,

-Matt



Matthew Hardin
Symas Corporation - The LDAP Guys
http://www.symas.com


On Aug 24, 2008, at 8:02 AM, Luke Howard wrote:

>> I also wonder what might happen having an official support-contract  
>> with PADL. Will 'nss_ldap' be fixed to deal with the new  
>> architecture of the nameservice-switch in Solaris 10 / OpenSolaris?
>
> If someone wants to buy enough consulting hours to get it done,  
> certainly.
>
> Another possibility is to approach Symas.
>
> -- Luke

[Thomas Glanzmann]

Hello Matt,

> We're in the process of testing the changes required to support
> Solaris 10u5. We'll be sending along patches when we're done.

thanks a lot! Please keep me posted.

        Thomas

[Matthew Hardin]

Hi All,

We have completed the work to make nss_ldap work with Solaris 10u5.  
We've released a *TEST* package that contains compiled and linked  
pam_ldap and nss_ldap libraries for x86 and made it freely  
downloadable from our portal at http://www.symas.net/portal/ 
index.fcgi. We're currently working on a release for SPARC, and I'll  
let the list know when it is ready for testing.

We're still trying to get to the bottom of why nscd decides to stop  
processing lookups for no apparent reason, and if anyone has any  
insights we'd be very grateful if you shared them with us.

For now, we'd appreciate any feedback you'd care to provide on the  
test package.

Cheers,

Matthew Hardin
Symas Corporation - The LDAP Guys
http://www.symas.com


On Dec 8, 2008, at 1:15 PM, Matthew Hardin wrote:

> Hi All,
>
> We're in the process of testing the changes required to support  
> Solaris 10u5. We'll be sending along patches when we're done.
>
> Cheers,
>
> -Matt
>
>
>
> Matthew Hardin
> Symas Corporation - The LDAP Guys
> http://www.symas.com
>
>
> On Aug 24, 2008, at 8:02 AM, Luke Howard wrote:
>
>>> I also wonder what might happen having an official support-
>>> contract with PADL. Will 'nss_ldap' be fixed to deal with the new  
>>> architecture of the nameservice-switch in Solaris 10 / OpenSolaris?
>>
>> If someone wants to buy enough consulting hours to get it done,  
>> certainly.
>>
>> Another possibility is to approach Symas.
>>
>> -- Luke
>
>
>

[Lukeh-3]

Hi Matt,

> We have completed the work to make nss_ldap work with Solaris 10u5.  
> We've released a *TEST* package that contains compiled and linked  
> pam_ldap and nss_ldap libraries for x86 and made it freely  
> downloadable from our portal at http://www.symas.net/portal/ 
> index.fcgi. We're currently working on a release for SPARC, and I'll  
> let the list know when it is ready for testing.
>
> We're still trying to get to the bottom of why nscd decides to stop  
> processing lookups for no apparent reason, and if anyone has any  
> insights we'd be very grateful if you shared them with us.
>
> For now, we'd appreciate any feedback you'd care to provide on the  
> test package.

Can you direct me to the source code for these patches, so I can  
integrate them? I couldn't find them on your web site.

regards,

-- Luke

[Matthew Hardin]

Hi Luke,

We'll be happy to send them along! We need to wrap up some other work  
first, though, so it'll be about a week before we can do this.

Cheers,

-Matt


On Jul 8, 2009, at 3:10 AM, Luke Howard wrote:

> Hi Matt,
>
>> We have completed the work to make nss_ldap work with Solaris 10u5.  
>> We've released a *TEST* package that contains compiled and linked  
>> pam_ldap and nss_ldap libraries for x86 and made it freely  
>> downloadable from our portal at http://www.symas.net/portal/index.fcgi 
>> . We're currently working on a release for SPARC, and I'll let the  
>> list know when it is ready for testing.
>>
>> We're still trying to get to the bottom of why nscd decides to stop  
>> processing lookups for no apparent reason, and if anyone has any  
>> insights we'd be very grateful if you shared them with us.
>>
>> For now, we'd appreciate any feedback you'd care to provide on the  
>> test package.
>
>
> Can you direct me to the source code for these patches, so I can  
> integrate them? I couldn't find them on your web site.
>
> regards,
>
> -- Luke