slapd + spasswd/saslauthd/kerberos5 segfaults

[João Pedro <joaopfp@mail.pt>]

Hi all, some time ago, I submitted a bug report about this problem: ITS# 2934, but until
now, got no response. 
I'm trying this list hoping that someone could shed some light on this issue...

As of Openldap 2.1.23, Kerberos support was deprecated and since most of our
authentication is done against a MIT kerberos v5 kdc (using simple binds), until
2.1.22 the {kerberos} (kpasswd) method was used.

I've been trying to get a working solution with cyrus saslauthd daemon and the
spasswd method.
The versions used were Openldap 2.1.25, 2.1.26, 2.2.4 and 2.2.5, with Cyrus SASL
2.1.17 (linked against both Heimdal and MIT Kerberos) and BDB 4.2.52

I start slapd and saslauthd with kerberos (saslauthd -a kerberos5) support. 
For some seconds/minutes slapd works fine, authentication works, all works as
expected.
After that period of time slapd segfaults/aborts, I can't really determine what
is going on, I've done some backtraces and as you'll see slapd doesn't always
crash the same way...

What I've determined is that when salsauthd is not running, slapd never crashes,
and works fine (except for the krb5 authentication part, of course).

Here's some backtraces, hope it helps:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 2051 (LWP 18416)]
0x4207ad9e in chunk_free () from /lib/i686/libc.so.6
(gdb) bt
#0  0x4207ad9e in chunk_free () from /lib/i686/libc.so.6
#1  0x4207ad24 in free () from /lib/i686/libc.so.6
#2  0x08089a58 in slap_sasl_authorize (sconn=0x69614d20, context=0x41298ea8,
   requested_user=0x8253e38 "someone@REALM", rlen=13,
   auth_identity=0x8253f39 "someone@REALM", alen=13,
   def_realm=0x0, urlen=0, props=0x69614d20) at sasl.c:743
#3  0x40026fda in do_authorization () from /usr/lib/libsasl2.so.2
#4  0x40027f68 in sasl_checkpass () from /usr/lib/libsasl2.so.2
#5  0x080a9077 in chk_sasl (sc=0x81b22a4, passwd=0x4002d414, cred=0x71869420,
   text=0x41ae27cc) at passwd.c:875
#6  0x080a889a in lutil_passwd (passwd=0x8254bd0, cred=0x41ae2874,
   schemes=0x0, text=0x4002d414) at passwd.c:325
#7  0x080782e6 in slap_passwd_check (conn=0x69614d20, a=0x69614d20,
   cred=0x8253528, text=0x0) at passwd.c:288
#8  0x080985fc in bdb_bind (be=0x8201eb0, conn=0x41298ea8, op=0x82544a8,
   dn=0x41ae2854, ndn=0x41ae285c, method=128, cred=0x41ae2874, edn=0x41ae2844)
   at bind.c:229
#9  0x0806b986 in do_bind (conn=0x41298ea8, op=0x82544a8) at bind.c:587
#10 0x080529d5 in connection_operation (ctx=0x69614d20, arg_v=0x0)
   at connection.c:908
#11 0x080ad674 in ldap_int_thread_pool_wrapper (xpool=0x81b1780) at tpool.c:432
#12 0x40169faf in pthread_start_thread () from /lib/i686/libpthread.so.0
#13 0x4016a09f in pthread_start_thread_event () from /lib/i686/libpthread.so.0

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1026 (LWP 11198)]
0x4207a351 in chunk_alloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x4207a351 in chunk_alloc () from /lib/i686/libc.so.6
#1  0x4207bcb7 in calloc () from /lib/i686/libc.so.6
#2  0x080ce216 in ber_memcalloc (n=8, s=1117782032) at memory.c:261
#3  0x08089d80 in slap_sasl_open (conn=0x412997a8) at sasl.c:1070
#4  0x08051764 in connection_init (s=21, listener=0x9,
   dnsname=0x8161657 "unknown", peername=0x416de8cc "IP=10.0.0.11:56540",
   tls_udp_option=0, ssf=0, authid=0x42a00010 "") at connection.c:559
#5  0x08050072 in slapd_daemon_task (ptr=0x0) at daemon.c:1684
#6  0x40169faf in pthread_start_thread () from /lib/i686/libpthread.so.0
#7  0x4016a09f in pthread_start_thread_event () from /lib/i686/libpthread.so.0

--//--

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 3076 (LWP 544)]
0x4207aa3b in chunk_alloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x4207aa3b in chunk_alloc () from /lib/i686/libc.so.6
#1  0x4207a158 in malloc () from /lib/i686/libc.so.6
#2  0x080ce19e in ber_memalloc (s=16) at memory.c:212
#3  0x080ca2f4 in ber_get_stringbvl (b=0x41ee274c, rlen=0x7) at decode.c:362
#4  0x080cad94 in ber_scanf (ber=0x42a09c68, fmt=0x81633a0 "M}}")
   at decode.c:778
#5  0x08053ec2 in do_search (conn=0x41299328, op=0x42a02030) at search.c:181
#6  0x08052a1f in connection_operation (ctx=0x89, arg_v=0x41ee286c)
   at connection.c:943
#7  0x080ad674 in ldap_int_thread_pool_wrapper (xpool=0x81b5cb0) at tpool.c:432
#8  0x40169faf in pthread_start_thread () from /lib/i686/libpthread.so.0
#9  0x4016a09f in pthread_start_thread_event () from /lib/i686/libpthread.so.0

--//--

slapd: sockbuf.c:82: ber_sockbuf_ctrl: Assertion `( (sb)->sb_opts.lbo_valid ==
0x3 )' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 2051 (LWP 7988)]
0x42029331 in kill () from /lib/i686/libc.so.6
(gdb) bt
#0  0x42029331 in kill () from /lib/i686/libc.so.6
#1  0x4016cbdb in raise () from /lib/i686/libpthread.so.0
#2  0x4202a8c2 in abort () from /lib/i686/libc.so.6
#3  0x42022ecb in __assert_fail () from /lib/i686/libc.so.6
#4  0x080ceee9 in ber_sockbuf_ctrl (sb=0x8255fc0, opt=6, arg=0x41ae283c)
   at sockbuf.c:142
#5  0x0806bb61 in do_bind (conn=0x8255fc0, op=0x8255d60) at bind.c:611
#6  0x080529d5 in connection_operation (ctx=0x0, arg_v=0x41ae283c)
   at connection.c:908
#7  0x080ad674 in ldap_int_thread_pool_wrapper (xpool=0x81b30b0) at tpool.c:432
#8  0x40169faf in pthread_start_thread () from /lib/i686/libpthread.so.0
#9  0x4016a09f in pthread_start_thread_event () from /lib/i686/libpthread.so.0

What could be causing all of this?

Best regards,
João