Hi, We encounter a problem with an apache server in our system, when failing authentication with an Active Directory server. Environment: Suse linux ( kernel: vmlinuz-2.6.5-7.97-bigsmp ) apache 2.0.54, one patch applied ( attached ) openldap2-2.2.6-37.rpm ( integrated with subversion 1.2.0 ) integrated with Active Directory Description: Apache is providing DAV & authentication services in our subversion setup. For authentication, an external Active Directory is queried. This runs very well, except some random crashes as described here. Problem is, that at certain moments in time an httpd process will crash: child pid 19732 exit signal Segmentation fault (11) The way to reproduce it: 1. With a webbrowser, access a file that needs authentication ( in our case, in the subversion repository ) 2. Provide a not-existing user and password 3. Apache will lookup the user on the AD server, but this will fail. ( normally ), asking the user again for user & password. 4. Do another request ( user & password you type is not important here ) 5. The process handling request of step 1 will crash. This problem doesn't happen very often, a few times a day for 50 users, but has a lot of impact, since it can happen on a long-running commit to the subversion repository. I've searched in bug reports and mailing lists, but didn't find anything that resembled this problem. It seems to be related to freeing up resources? If anybody has a patch, or a way to workaround this problem, please let me know. I see that more of these types of problem reports exist, and people are Urged to wait for apache 2.1, which is now in beta. Can anyone tell me when it is supposed to be released? regards, Lieven. Extract from the error.log file: -------------------------------- [Thu Jun 23 16:19:35 2005] [warn] [client 10.102.65.39] [10137] auth_ldap authenticate: user govaerl authentication failed; URI /svn/test/trunk/test.txt [ldap_simple_bind_s() to check user credentials failed][Invalid credentials] [Thu Jun 23 16:19:35 2005] [warn] [client 10.102.65.39] [9168] auth_ldap authenticate: user govaerl authentication failed; URI /svn/test/trunk/test.txt [ldap_simple_bind_s() to check user credentials failed][Invalid credentials] [Thu Jun 23 16:19:35 2005] [notice] child pid 10137 exit signal Segmentation fault (11) [Thu Jun 23 16:21:04 2005] [warn] [client 10.102.65.39] [19732] auth_ldap authenticate: user govaerl authentication failed; URI /svn/test/trunk/test.txt [ldap_simple_bind_s() to check user credentials failed][Invalid credentials] [Thu Jun 23 16:21:04 2005] [warn] [client 10.102.65.39] [19733] auth_ldap authenticate: user govaerl authentication failed; URI /svn/test/trunk/test.txt [ldap_simple_bind_s() to check user credentials failed][Invalid credentials] [Thu Jun 23 16:21:04 2005] [warn] [client 10.102.65.39] [19733] auth_ldap authenticate: user govaerl authentication failed; URI /svn/test/trunk/test.txt [ldap_simple_bind_s() to check user credentials failed][Invalid credentials] [Thu Jun 23 16:21:04 2005] [notice] child pid 19732 exit signal Segmentation fault (11) Extract from httpd.conf: ------------------------ LoadModule dav_svn_module modules/mod_dav_svn.so LoadModule authz_svn_module modules/mod_authz_svn.so <Location /svn> DAV svn SVNParentPath /test/repos # access control policy AuthzSVNAccessFile /test/svnaccess.conf # try anonymous access first, resort to real authentication if necessary Satisfy Any Require valid-user # LDAP authentication AuthType Basic AuthName "Subversion Repository" AuthLDAPEnabled on AuthLDAPURL "XXXXXXXXXXXXXXXX" AuthLDAPAuthoritative on AuthLDAPBindDN "XXXXXXXXXXXXXX" AuthLDAPBindPassword xxxxxxxxxxx Require valid-user </Location> STRICTLY PERSONAL AND CONFIDENTIAL This message may contain confidential and proprietary material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies. Dit bericht is enkel bestemd voor de aangeduide ontvangers en kan vertrouwelijke informatie bevatten. Als u niet de ontvanger bent, dan mag u de inhoud van dit bericht niet bekendmaken noch kopiëren. Als u dit bericht per vergissing ontvangen heeft, gelieve er de afzender of De Post onmiddellijk van op de hoogte te brengen en het bericht vervolgens te verwijderen. Ce message est uniquement destiné aux destinataires indiqués et peut contenir des informations confidentielles. Si vous n'êtes pas le destinataire, vous ne devez pas révéler le contenu de ce message ou en prendre copie. Si vous avez reçu ce message par erreur, veuillez en informer l'expéditeur, ou La Poste immédiatement, avant de le supprimer.
Index: util_ldap.c
===================================================================
--- util_ldap.c (revision 165194)
+++ util_ldap.c (working copy)
@@ -241,6 +241,8 @@
int result = 0;
int failures = 0;
int version = LDAP_VERSION3;
+ int rc = LDAP_SUCCESS;
+ struct timeval timeOut = {10,0}; /* 10 second connection timeout */
util_ldap_state_t *st = (util_ldap_state_t *)ap_get_module_config(
r->server->module_config, &ldap_module); @@ -317,6 +319,19 @@
/* always default to LDAP V3 */
ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version);
+#ifdef LDAP_OPT_NETWORK_TIMEOUT
+ if (st->connectionTimeout > 0) {
+ timeOut.tv_sec = st->connectionTimeout;
+ }
+
+ if (st->connectionTimeout >= 0) {
+ rc = ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, (void *)&timeOut);
+ if (APR_SUCCESS != rc) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
+ "LDAP: Could not set the connection timeout" );
+ }
+ }
+#endif
}
@@ -1405,7 +1420,6 @@
void *data;
const char *userdata_key = "util_ldap_init";
- struct timeval timeOut = {10,0}; /* 10 second connection timeout */
/* util_ldap_post_config() will be called twice. Don't bother
* going through all of the initialization on the first call @@ -1630,20 +1644,6 @@
"LDAP: SSL support unavailable" );
}
-#ifdef LDAP_OPT_NETWORK_TIMEOUT
- if (st->connectionTimeout > 0) {
- timeOut.tv_sec = st->connectionTimeout;
- }
-
- if (st->connectionTimeout >= 0) {
- rc = ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, (void *)&timeOut);
- if (APR_SUCCESS != rc) {
- ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
- "LDAP: Could not set the connection timeout" );
- }
- }
-#endif
-
return(OK);
}
--------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|