Project

General

Profile

Actions
Copy link

Bug #57881

open

LDAP invalid password resource leak fix

Added by Johannes Liebl over 1 year ago. Updated about 1 year ago.

Status:
Pending Backport
Priority:
Normal
Assignee:
Matt Benjamin
Target version:
Ceph - v18.0.0
% Done:

0%

Source:
Community (user)
Tags:
ldap backport_processed
Backport:
pacific, quincy
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
Ceph - v18.0.0
ceph-qa-suite:
Pull request ID:
48509
Crash signature (v1):
Crash signature (v2):

Description

I have noticed that in the case a User tries to log in using LDAP with a wrong password, two new LDAP sessions will be opend but not closed.
This has resulted in a massive increase in open connections to our central LDAP after a while.

The issue lies in the ldap implementation (/src/rgw/ldap.h) since it does not unbind the ldap connection if the requests fail.
I will open a pull request shortly.

Related issues 2 (0 open — 2 closed)

Copied to rgw - Backport #59091: pacific: LDAP invalid password resource leak fixResolvedLaura FloresActions
Copied to rgw - Backport #59092: quincy: LDAP invalid password resource leak fixResolvedLaura FloresActions
Actions
Copy link
 #1

Updated by Johannes Liebl over 1 year ago

I created a pull request for a possible fix:
https://github.com/ceph/ceph/pull/48509

Actions
Copy link
 #2

Updated by Casey Bodley over 1 year ago

  • Status changed from New to Fix Under Review
  • Tags set to ldap
  • Pull request ID set to 48509
Actions
Copy link
 #3

Updated by Casey Bodley over 1 year ago

  • Assignee set to Matt Benjamin
Actions
Copy link
 #4

Updated by J. Eric Ivancich over 1 year ago

  • Status changed from Fix Under Review to Pending Backport
Actions
Copy link
 #5

Updated by Backport Bot over 1 year ago

  • Tags changed from ldap to ldap backport_processed
Actions
Copy link
 #6

Updated by Johannes Liebl about 1 year ago

Is there something I can do to help with Backporting?
We would like this fix to be included in v16.2.12 and v17.2.6 if possible.

Actions
Copy link
 #7

Updated by Laura Flores about 1 year ago

  • Backport changed from Pacific, Quincy to pacific, quincy
Actions
Copy link
 #8

Updated by Laura Flores about 1 year ago

  • Copied to Backport #59091: pacific: LDAP invalid password resource leak fix added
Actions
Copy link
 #9

Updated by Laura Flores about 1 year ago

  • Copied to Backport #59092: quincy: LDAP invalid password resource leak fix added
Actions
Copy link
 #10

Updated by Laura Flores about 1 year ago

@Johannes, I created the backports using the "backport-create-issue" and "ceph-backport.sh" scripts under src/scripts in the Ceph repository. This is a very simple way to semi-automate backports.

You can see details on how to use those scripts here:
https://github.com/ceph/ceph/blob/main/SubmittingPatches-backports.rst

Actions
Copy link
 #11

Updated by Johannes Liebl about 1 year ago

Thank you very much @Laura

I already created #59090 and #59089 with the intention of creating the pull requests later. Those can be deleted since they are now redundant (Which I can't for some reason).
I will use the Backport script next time

Actions
Copy link

Also available in: Atom PDF