search

openziti / ziti-sdk-py

Ziti SDK for Python
Apache License 2.0
70 stars 2 forks source link

enroll command gets segfault #16

Closed qrkourier closed 2 years ago

qrkourier commented 2 years ago

This failed enrollment produces an empty identity config file

 ❯ python -m openziti enroll --jwt=/tmp/pyclient1.jwt --identity=/opt/openziti/etc/identities/zeds-kentest1-pyclient1.json
[1]    1671904 segmentation fault (core dumped)  python -m openziti enroll --jwt=/tmp/pyclient1.jwt 

 ❯ ll /opt/openziti/etc/identities/zeds-kentest1-pyclient1.json 
-rw-rw-r-- 1 kbingham kbingham 0 Jun 15 12:55 /opt/openziti/etc/identities/zeds-kentest1-pyclient1.json

I have the Py SDK module installed as "editable" and have separately installed libziti.so with python tools/get_zitilib.py.

 ❯ valgrind -v python -m openziti enroll --jwt=/tmp/pyclient1.jwt --identity=/opt/openziti/etc/identities/zeds-kentest1-pyclient1.json ==1683157== Memcheck, a memory error detector
==1683157== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1683157== Using Valgrind-3.18.1-42b08ed5bd-20211015 and LibVEX; rerun with -h for copyright info
==1683157== Command: /home/kbingham/.pyenv/shims/python -m openziti enroll --jwt=/tmp/pyclient1.jwt --identity=/opt/openziti/etc/identities/zeds-kentest1-pyclient1.json
==1683157== 
--1683157-- Valgrind options:
--1683157--    -v
--1683157-- Contents of /proc/version:
--1683157--   Linux version 5.17.5-76051705-generic (jenkins@warp.pop-os.org) (gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #202204271406~1653440576~22.04~6277a18 SMP PREEMPT Wed May 25 01
--1683157-- 
--1683157-- Arch and hwcaps: AMD64, LittleEndian, amd64-cx16-lzcnt-rdtscp-sse3-ssse3-avx-avx2-bmi-f16c-rdrand-rdseed
--1683157-- Page sizes: currently 4096, max supported 4096
--1683157-- Valgrind library directory: /usr/libexec/valgrind
--1683157-- Reading syms from /usr/bin/env
--1683157--    object doesn't have a symbol table
--1683157-- Reading syms from /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
--1683157--   Considering /usr/lib/debug/.build-id/aa/1b0b998999c397062e1016f0c95dc0e8820117.debug ..
--1683157--   .. build-id is valid
--1683157-- Reading syms from /usr/libexec/valgrind/memcheck-amd64-linux
--1683157--    object doesn't have a symbol table
--1683157--    object doesn't have a dynamic symbol table
--1683157-- Scheduler: using generic scheduler lock implementation.
--1683157-- Reading suppressions file: /usr/libexec/valgrind/default.supp
==1683157== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-1683157-by-kbingham-on-???
==1683157== embedded gdbserver: writing to   /tmp/vgdb-pipe-to-vgdb-from-1683157-by-kbingham-on-???
==1683157== embedded gdbserver: shared mem   /tmp/vgdb-pipe-shared-mem-vgdb-1683157-by-kbingham-on-???
==1683157== 
==1683157== TO CONTROL THIS PROCESS USING vgdb (which you probably
==1683157== don't want to do, unless you know exactly what you're doing,
==1683157== or are doing some strange experiment):
==1683157==   /usr/bin/vgdb --pid=1683157 ...command...
==1683157== 
==1683157== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==1683157==   /path/to/gdb /home/kbingham/.pyenv/shims/python
==1683157== and then give GDB the following command
==1683157==   target remote | /usr/bin/vgdb --pid=1683157
==1683157== --pid is optional if only one valgrind process is running
==1683157== 
--1683157-- REDIR: 0x402aa60 (ld-linux-x86-64.so.2:strlen) redirected to 0x580bcec2 (???)
--1683157-- REDIR: 0x402a830 (ld-linux-x86-64.so.2:index) redirected to 0x580bcedc (???)
--1683157-- Reading syms from /usr/libexec/valgrind/vgpreload_core-amd64-linux.so
--1683157--    object doesn't have a symbol table
--1683157-- Reading syms from /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so
--1683157--    object doesn't have a symbol table
==1683157== WARNING: new redirection conflicts with existing -- ignoring it
--1683157--     old: 0x0402aa60 (strlen              ) R-> (0000.0) 0x580bcec2 ???
--1683157--     new: 0x0402aa60 (strlen              ) R-> (2007.0) 0x0484ee30 strlen
--1683157-- REDIR: 0x4027240 (ld-linux-x86-64.so.2:strcmp) redirected to 0x484fcd0 (strcmp)
--1683157-- REDIR: 0x402afc0 (ld-linux-x86-64.so.2:mempcpy) redirected to 0x4853840 (mempcpy)
--1683157-- Reading syms from /usr/lib/x86_64-linux-gnu/libc.so.6
--1683157--   Considering /usr/lib/debug/.build-id/89/c3cb85f9e55046776471fed05ec441581d1969.debug ..
--1683157--   .. build-id is valid
==1683157== WARNING: new redirection conflicts with existing -- ignoring it
--1683157--     old: 0x04923ce0 (memalign            ) R-> (1011.0) 0x0484e080 memalign
--1683157--     new: 0x04923ce0 (memalign            ) R-> (1017.0) 0x0484e050 aligned_alloc
==1683157== WARNING: new redirection conflicts with existing -- ignoring it
--1683157--     old: 0x04923ce0 (memalign            ) R-> (1011.0) 0x0484e080 memalign
--1683157--     new: 0x04923ce0 (memalign            ) R-> (1017.0) 0x0484e020 aligned_alloc
==1683157== WARNING: new redirection conflicts with existing -- ignoring it
--1683157--     old: 0x04923ce0 (memalign            ) R-> (1011.0) 0x0484e080 memalign
--1683157--     new: 0x04923ce0 (memalign            ) R-> (1017.0) 0x0484e050 aligned_alloc
==1683157== WARNING: new redirection conflicts with existing -- ignoring it
--1683157--     old: 0x04923ce0 (memalign            ) R-> (1011.0) 0x0484e080 memalign
--1683157--     new: 0x04923ce0 (memalign            ) R-> (1017.0) 0x0484e020 aligned_alloc
--1683157-- REDIR: 0x49267a0 (libc.so.6:strnlen) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4926a60 (libc.so.6:strpbrk) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4926360 (libc.so.6:strcmp) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4944d50 (libc.so.6:wcsnlen) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927750 (libc.so.6:memset) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49435c0 (libc.so.6:wcslen) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927c90 (libc.so.6:memcpy@@GLIBC_2.14) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49433f0 (libc.so.6:wcschr) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49262e0 (libc.so.6:index) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49269e0 (libc.so.6:rindex) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927620 (libc.so.6:memmove) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
==1683157== Preferring higher priority redirection:
--1683157--     old: 0x04a1e940 (__memcpy_avx_unalign) R-> (2018.0) 0x04850f90 __memcpy_avx_unaligned_erms
--1683157--     new: 0x04a1e940 (__memcpy_avx_unalign) R-> (2018.1) 0x04852880 memmove
--1683157-- REDIR: 0x4943470 (libc.so.6:wcscmp) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927a60 (libc.so.6:stpncpy) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4943a30 (libc.so.6:wmemchr) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49268b0 (libc.so.6:strncmp) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927af0 (libc.so.6:strcasecmp) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49264a0 (libc.so.6:strcspn) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49434f0 (libc.so.6:wcscpy) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4926250 (libc.so.6:strcat) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927be0 (libc.so.6:strncasecmp_l) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927500 (libc.so.6:bcmp) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x492f5f0 (libc.so.6:memrchr) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4929090 (libc.so.6:strchrnul) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4926410 (libc.so.6:strcpy) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927b90 (libc.so.6:strcasecmp_l) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4926720 (libc.so.6:strlen) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4926950 (libc.so.6:strncpy) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49279d0 (libc.so.6:stpcpy) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927470 (libc.so.6:memchr) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4926b80 (libc.so.6:strspn) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927850 (libc.so.6:mempcpy) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4927b40 (libc.so.6:strncasecmp) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4929000 (libc.so.6:rawmemchr) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x49b2430 (libc.so.6:__memcpy_chk) redirected to 0x483f220 (_vgnU_ifunc_wrapper)
--1683157-- REDIR: 0x4a1b790 (libc.so.6:__strrchr_avx2) redirected to 0x484e810 (rindex)
--1683157-- REDIR: 0x4a16f00 (libc.so.6:__strncmp_avx2) redirected to 0x484f3e0 (strncmp)
--1683157-- REDIR: 0x4a16ac0 (libc.so.6:__strcmp_avx2) redirected to 0x484fbd0 (strcmp)
--1683157-- REDIR: 0x4a1b960 (libc.so.6:__strlen_avx2) redirected to 0x484ed10 (strlen)
--1683157-- REDIR: 0x4a1b300 (libc.so.6:__strchr_avx2) redirected to 0x484e9f0 (index)
--1683157-- REDIR: 0x4a17440 (libc.so.6:__memchr_avx2) redirected to 0x484fd50 (memchr)
--1683157-- REDIR: 0x4a1b580 (libc.so.6:__strchrnul_avx2) redirected to 0x4853330 (strchrnul)
--1683157-- REDIR: 0x4923120 (libc.so.6:malloc) redirected to 0x4848820 (malloc)
--1683157-- REDIR: 0x4a1e900 (libc.so.6:__mempcpy_avx_unaligned_erms) redirected to 0x4853440 (mempcpy)
--1683157-- REDIR: 0x4a1e940 (libc.so.6:__memcpy_avx_unaligned_erms) redirected to 0x4852880 (memmove)
--1683157-- REDIR: 0x4923460 (libc.so.6:free) redirected to 0x484b210 (free)
--1683157-- REDIR: 0x49245a0 (libc.so.6:calloc) redirected to 0x484d9d0 (calloc)
--1683157-- REDIR: 0x4a1bae0 (libc.so.6:__strnlen_avx2) redirected to 0x484ecb0 (strnlen)

My libc and OS versions

❯ ldd --version
ldd (Ubuntu GLIBC 2.35-0ubuntu3) 2.35
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

❯ cat /etc/os-release
NAME="Pop!_OS"
VERSION="22.04 LTS"
ID=pop
ID_LIKE="ubuntu debian"
PRETTY_NAME="Pop!_OS 22.04 LTS"
VERSION_ID="22.04"
HOME_URL="https://pop.system76.com"
SUPPORT_URL="https://support.system76.com"
BUG_REPORT_URL="https://github.com/pop-os/pop/issues"
PRIVACY_POLICY_URL="https://system76.com/privacy"
VERSION_CODENAME=jammy
UBUNTU_CODENAME=jammy
LOGO=distributor-logo-pop-os
qrkourier commented 2 years ago

I reproduced this by creating a fresh identity enrollment token and running commands:

 ❯ python tools/get_zitilib.py
platform=Linux-x86_64
Downloading 1202029 from https://github.com/openziti/ziti-sdk-c/releases/download/0.28.7/ziti-sdk-0.28.7-Linux-x86_64.zip

# install latest from main after merging the enroll command fix for missing param 'args'
❯ pip install -i https://test.pypi.org/simple/ openziti==0.5.0.post0.dev7
...
Successfully installed openziti-0.5.0.post0.dev7

❯ pip show openziti
Name: openziti
Version: 0.5.0.post0.dev7
Summary: Ziti Python SDK
Home-page: https://github.com/openziti/ziti-sdk-py
Author: OpenZiti Developers
Author-email: developers@openziti.org
License: Apache 2.0
Location: /home/kbingham/.pyenv/versions/3.7.0/lib/python3.7/site-packages
Requires: 
Required-by: 

❯ ulimit -c unlimited

❯ export ZITI_LOG=4; valgrind -v python -m openziti enroll --jwt=/tmp/pyclient1.jwt --identity=/tmp/pyclient.json
...
qrkourier commented 2 years ago

resolved by @sabedevops in https://github.com/openziti/ziti-sdk-py/pull/18