Public bug reported: Install ocserv and setup for PAM authentication. On second connection, ocserv crashes due to a double free in PAM.
Repro steps: 1. Create Dockerfile that installs ocserv + libpam-cap ``` FROM ubuntu:20.04 RUN apt update && apt install -y ocserv libpam-cap && apt autoremove && apt clean COPY server-cert.pem /etc/ssl/ocserv_test.cert COPY server-key.pem /etc/ssl/ocserv_test.key COPY ca-cert.pem /etc/ssl/certs/ssl-cert-snakeoil.pem COPY ocserv.conf /etc/ocserv/ocserv.conf RUN useradd test RUN echo "test\ntest" | passwd test ENV MALLOC_CHECK_=3 CMD ocserv -f -d 1 ``` 2. Build container: ``` sudo docker build -t ocserv:20.04 . ``` 3. Launch container: ``` docker run -p 443:443/tcp -p 443:443/udp -it --rm --device /dev/net/tun --cap-add net_admin ocserv:20.04 ``` 4. From another console, connect / disconnect: ``` while true; do echo test | openconnect https://localhost -u test --passwd-on-stdin --servercert pin-sha256:qBLVTyoXiFdn+0pW+eSGqnVCEnMbLigVf5vAl1ZewW4= --background && sleep 2 && pkill openconnect && sleep 2;done ``` 5. ocserv crashes: free(): invalid pointer ocserv[8]: main: main-sec-mod-cmd.c:106: command socket for sec-mod closed ocserv[8]: main: main.c:1179: error in command from sec-mod ocserv[8]: main: termination request received; waiting for children to die For more details see: https://gitlab.com/openconnect/ocserv/-/issues/361 ** Affects: libcap2 (Ubuntu) Importance: Undecided Status: New ** Attachment added: "Self-contained repro of the failure in the form of Dockerfile + config + certs" https://bugs.launchpad.net/bugs/1899103/+attachment/5419801/+files/repro.tgz -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to libcap2 in Ubuntu. https://bugs.launchpad.net/bugs/1899103 Title: libpam-cap causes PAM applications to crash Status in libcap2 package in Ubuntu: New Bug description: Install ocserv and setup for PAM authentication. On second connection, ocserv crashes due to a double free in PAM. Repro steps: 1. Create Dockerfile that installs ocserv + libpam-cap ``` FROM ubuntu:20.04 RUN apt update && apt install -y ocserv libpam-cap && apt autoremove && apt clean COPY server-cert.pem /etc/ssl/ocserv_test.cert COPY server-key.pem /etc/ssl/ocserv_test.key COPY ca-cert.pem /etc/ssl/certs/ssl-cert-snakeoil.pem COPY ocserv.conf /etc/ocserv/ocserv.conf RUN useradd test RUN echo "test\ntest" | passwd test ENV MALLOC_CHECK_=3 CMD ocserv -f -d 1 ``` 2. Build container: ``` sudo docker build -t ocserv:20.04 . ``` 3. Launch container: ``` docker run -p 443:443/tcp -p 443:443/udp -it --rm --device /dev/net/tun --cap-add net_admin ocserv:20.04 ``` 4. From another console, connect / disconnect: ``` while true; do echo test | openconnect https://localhost -u test --passwd-on-stdin --servercert pin-sha256:qBLVTyoXiFdn+0pW+eSGqnVCEnMbLigVf5vAl1ZewW4= --background && sleep 2 && pkill openconnect && sleep 2;done ``` 5. ocserv crashes: free(): invalid pointer ocserv[8]: main: main-sec-mod-cmd.c:106: command socket for sec-mod closed ocserv[8]: main: main.c:1179: error in command from sec-mod ocserv[8]: main: termination request received; waiting for children to die For more details see: https://gitlab.com/openconnect/ocserv/-/issues/361 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libcap2/+bug/1899103/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
