gssapi / gssproxy

A proxy for GSSAPI | Docs at https://github.com/gssapi/gssproxy/tree/main/docs
Other
44 stars 28 forks source link

Idle timeout not working #105

Closed ygorre closed 2 months ago

ygorre commented 3 months ago

Hello,

I don't know if this issue is distro-related or upstream, but I am trying to build the latest gssproxy version on an openSUSE Tumbleweed system. Building was successful, but the idle timeouts for gssuserproxy are not working here.

Attached below is a full build log (from opensuse build service). I have disabled the tests because the userproxy test was failing (likely related to this issue). Also below, a command output showing the timeout not working:

> gssproxy -u -i -d --debug-level=2 --idle-timeout=3 -s ./tstsock.sock
[2024/08/17 02:03:46]: Debug Level changed to 2
[2024/08/17 02:03:46]: Keytab FILE:/etc/krb5.keytab has no content (-1765328203)
[2024/08/17 02:03:46]: Service: user-proxy, Enckey: [ephemeral], Enctype: 18
[2024/08/17 02:03:46]: Initialization complete.
^C
[2024/08/17 02:04:01]: Exiting after receiving a signal

buildlog.txt

Thanks.

simo5 commented 3 months ago

I do not see anything wrong in your setup, what event library is being pulled by libverto?

ygorre commented 3 months ago

The only libverto backend installed is libev.

A systemd service log below shows the service not stopping after the expected timeout (1000s by default).

● gssuserproxy.service - GSS User Proxy
     Loaded: loaded (/usr/lib/systemd/user/gssuserproxy.service; static)
     Active: active (running) since Wed 2024-08-21 11:00:05 -03; 22min ago
 Invocation: c83519a8f82340748a896dfe6c4cddec
TriggeredBy: ● gssuserproxy.socket
       Docs: man:gssproxy(8)
   Main PID: 236683 (gssproxy)
      Tasks: 3 (limit: 19008)
        CPU: 23ms
     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/gssuserproxy.service
             └─236683 /usr/sbin/gssproxy -i -u

ago 21 11:00:05 desktop systemd[2278]: Starting GSS User Proxy...
ago 21 11:00:05 desktop systemd[2278]: Started GSS User Proxy.
ago 21 11:00:20 desktop gssproxy[236683]: Problem with /proc; program name matching won't work: 2 (No such file or directory)

The userproxy is working, only this timeout is not triggering.

simo5 commented 3 months ago

Any chance you can install another event library like libtevent and see if that makes it work? It could be a bug with libev.

ygorre commented 3 months ago

According to https://github.com/latchset/libverto, libtevent support was dropped.

Also, the system packages on openSUSE only support glib and libev, and I have read somewhere the glib backend is incomplete. Tried using it instead, gssproxy did not even run.

Sorry about the delay.

simo5 commented 3 months ago

That's really sad, tevent is a pretty good library, I missed that. Unfortunately I have no way to know why it does not work for you, but you could gdb the daemon on startup and see if the timeout event is actually set and with what timeout.

ygorre commented 2 months ago

Did it, looks like the gpctx->term_timeout (src/gp_mgmt.c) is not being set.

GDB output:

> gdb --args ~/usr/sbin/gssproxy -u -i -d --debug-level=2 --idle-timeout=3 -s ./tstsock.sock
GNU gdb (GDB; openSUSE Tumbleweed) 14.2
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-suse-linux".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://bugs.opensuse.org/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/yasregados/.distrobox/devtmp/usr/sbin/gssproxy...
(gdb) break idle_
idle_handler    idle_terminate  
(gdb) break idle_handler 
Breakpoint 1 at 0x409640: idle_handler. (2 locations)
(gdb) run
Starting program: /home/yasregados/.distrobox/devtmp/usr/sbin/gssproxy -u -i -d --debug-level=2 --idle-timeout=3 -s ./tstsock.sock
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[2024/09/03 14:48:25]: Debug Level changed to 2
[2024/09/03 14:48:25]: Keytab FILE:/etc/krb5.keytab has no content (-1765328203)
[2024/09/03 14:48:25]: Service: user-proxy, Enckey: [ephemeral], Enctype: 18
[New Thread 0x7ffff72006c0 (LWP 17112)]
[New Thread 0x7ffff68006c0 (LWP 17113)]
[2024/09/03 14:48:25]: Initialization complete.

Thread 1 "gssproxy" hit Breakpoint 1.1, idle_handler (gpctx=0x423040) at src/gp_mgmt.c:31
31      if (gpctx->userproxymode == false || gpctx->term_timeout == 0) {
(gdb) print gpctx->userproxymode 
$1 = true
(gdb) print gpctx->term_timeout
$2 = 0
(gdb) backtrace
#0  idle_handler (gpctx=0x423040) at src/gp_mgmt.c:31
#1  0x00007ffff7e523a8 in verto_fire (ev=0x427300) at /usr/src/debug/libverto-0.3.2/src/verto.c:1020
#2  0x00007ffff7cc4636 in ev_invoke_pending (loop=0x7ffff7cd0060 <default_loop_struct>) at /usr/src/debug/libev-4.33/ev.c:3770
#3  0x00007ffff7cc81dc in ev_run (flags=0, loop=0x7ffff7cd0060 <default_loop_struct>) at /usr/src/debug/libev-4.33/ev.c:4190
#4  ev_run (loop=0x7ffff7cd0060 <default_loop_struct>, flags=0) at /usr/src/debug/libev-4.33/ev.c:4021
#5  0x0000000000406610 in main (argc=<optimized out>, argv=<optimized out>) at src/gssproxy.c:201
(gdb)
simo5 commented 2 months ago

Uhm in setup_socket() we explicitly disable termination by setting term_timeout to 0 if the daemon is not being passed a socket by systemd.

So I guess idle-timeout can't be used outside of a systemd run socket-activated unit.

simo5 commented 2 months ago

Perhaps these two lines in your build log are the problem:

[   27s] checking for SYSTEMD_DAEMON... no
[   27s] configure: Build without libsystemd-daemon support
simo5 commented 2 months ago

Yes confirmed by later on:

[   28s] src/gp_init.c: In function ‘setup_socket’:
[   28s] src/gp_init.c:138:36: warning: unused parameter ‘with_activation’ [-Wunused-parameter]
[   28s]   138 |                               bool with_activation)
[   28s]       |                                    ^

which happens only when HAVE_SYSTEMD_DAEMON is not defined

simo5 commented 2 months ago

Sounds like there is no bug here, feel free to re-open if this still does not work with proper systemd support.

ygorre commented 2 months ago

Tested it after adding the missing systemd packages on build, now the timeout works indeed.

Looks like the userproxy unit tests needs a check to ignore the timeout if systemd support is disabled/not available, it fails otherwise.

simo5 commented 2 months ago

I'd welcome a contribution in that sense