PowerFlex 3.x LDAP 驗證在 Ubuntu 16.04 及更新版本中失敗

劇本
在 Ubuntu 16.04 和更新版本上執行的 PowerFlex 3.5 及更高版本不會使用 LDAP 登入，並會重新啟動 MDM 服務。 

症狀
SCLI 命令失敗：

 root@ubuntu16-mdm1# date; scli --login --username test_user --password test_password --ldap_authentication
Wed Dec 15 03:09:03 EST 2021
Error: MDM failed command. Status: Communication error

MDM 追蹤顯示 LDAP 驗證嘗試甚至未啟動，MDM 服務會正常重新啟動，mdmNet_AbnormalExitCK：00334: 將使用訊號 6 暫停網路 （SIGABRT = 如果出現嚴重錯誤，通常用於中止程式）：

 15/12 03:09:03.974587 7efef1ce2db0:mosEventLog_PostInternal:00609: New event added. Message: "Command login received, User: 'test_user'. [9]". Additional info: ". Originating source IP: 127.0.0.1" Severity: Info
15/12 03:09:03.974601 7efef1ce2db0:ldapAuthMgr_GetLdapServiceRefByKey:02332: Failed to get LDAP service object by name - rc: LDAP_SERVICE_NOT_FOUND
15/12 03:09:03.982275 7efef1ce2db0:mdmNet_AbnormalExitCK:00334: Will pause network     <<<<<--- MDM service gracefully prepares for a restart
15/12 03:09:03.982290 7efef1ce2db0:net_Pause:02235: Net paused 1 (reversible 0)
15/12 03:09:03.982310 7efef6a9ddb0:netListen_Mit:00170: Error (ABORTED) accepting on socket 26
15/12 03:09:03.982322 7efef1ce2db0:net_Pause:02235: Net paused 1 (reversible 0)
15/12 03:09:03.982346 7efef1ce2db0:mosOsThrd_DumpBacktraceToTraces:01120: Dumping thread 0x33af7d0 backtrace:
15/12 03:09:03.982347 7efef1ce2db0:mosOsThrd_DumpBacktraceToTraces:01133: Thread 0x33af7d0: frame 0: __fortify_fail+0x5c [0x7eff1426e21c]
15/12 03:09:03.982349 7efef1ce2db0:mosDbg_SignalHandler:00723: ---Termination due to signal 6. PID 16584 Faulting address 0x40c8. errno 0---
15/12 03:09:04.133079 0:mosTrcLayer_Create:00239: ---------- Process started. Version private PowerFlex R3_5.1400.104_Release, CodeBase , Sep 12 2021. PID 20567 ----------
15/12 03:09:04.133096 0:mosTrcLayer_Create:00251: No debug actions enabled
15/12 03:09:04.133162 0:mosXmti_SetLastSdbgOpStatus:00750: Last XMTI status set to XMTI is online.
15/12 03:09:04.133169 0:mosDynamicLib_Open:00093: lib-name: libblkid.so.1
15/12 03:09:04.133304 0:mosDynamicLib_Open:00103: load success lib-name: libblkid.so.1
15/12 03:09:04.133909 0:mosDynamicLib_Open:00093: lib-name: libpmem.so.1.0.0:libpmem.so.1:libpmem.so:/usr/lib64/libpmem.so.1.0.0:/usr/lib64/libpmem.so.1:/usr/lib64/libpmem.so

LDAP 驗證和登入成功範例 （在 RHEL 作業系統上）：

 15/12 03:09:28.422220 0x7fd8b1cfddb0:mosEventLog_PostInternal:00609: New event added. Message: "Command login received, User: 'test_user'. [144]". Additional info: ". Originating source IP: 127.0.0.1" Severity: Info
15/12 03:09:28.422354 0x7fd8b1cfddb0:ldapAuthMgr_GetLdapServiceRefByKey:02332: Failed to get LDAP service object by name - rc: LDAP_SERVICE_NOT_FOUND
15/12 03:09:28.422404 0x7fd8b1cfddb0:ldapAuthMgr_Authenticate:00711: base-dn: dc=TESTLDAP,dc=LAB,dc=COM, uri: ldap://TESTLDAP.COM:389, user: test_user, num-groups: 4
15/12 03:09:28.422732 (nil):mosOsThrd_StartFunc:00576: Starting thread () tid 293046
15/12 03:09:28.422888 (nil):mosLdap_SearchUserInDomainGroupsIntr:00463: Initializing - timeout: 8 (1)...
15/12 03:09:28.422911 (nil):mosLdap_InitConInternal:00046: Before ldap_initialize - URI: ldap://TESTLDAP.COM:389
15/12 03:09:28.423112 (nil):mosLdap_InitConInternal:00048: After  ldap_initialize - rc: 0
15/12 03:09:28.423125 (nil):mosLdap_InitConnection:00205: Connection was successfully established to ldap://TESTLDAP.COM:389 ldap service
15/12 03:09:28.423169 (nil):mosLdap_SearchUserInDomainGroupsIntr:00478: username: test_user, search-user: test_user, bind-user: uid=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM
15/12 03:09:28.423172 (nil):mosLdap_SearchUserInDomainGroupsIntr:00481: Binding (1)...
15/12 03:09:28.423196 (nil):mosLdap_Bind:00120: Before ldap_sasl_bind - user-name: uid=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM, timeout-sec: 8
15/12 03:09:28.423198 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 8 seconds
15/12 03:09:28.433429 (nil):mosLdap_Bind:00130: After ldap_sasl_bind - rc: 0, msg-id: 1
15/12 03:09:28.433458 (nil):mosLdap_Bind:00141: Set timeout to 7 sec
15/12 03:09:28.434458 (nil):mosLdap_Bind:00153: ldap_result: res-type: 0x61, result: 0x7fd86c045260
15/12 03:09:28.434470 (nil):mosLdap_Bind:00182: User id=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM was successfully binded to LDAP service
15/12 03:09:28.434475 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 0: 10 ms
15/12 03:09:28.434478 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 0, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.434479 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.436388 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 0, rc: SUCCESS
15/12 03:09:28.436394 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 1: 10 ms
15/12 03:09:28.436398 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 1, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.436401 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.437628 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 1, rc: SUCCESS
15/12 03:09:28.437632 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 2: 20 ms
15/12 03:09:28.437634 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 2, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.437635 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.438884 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 2, rc: SUCCESS
15/12 03:09:28.438890 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 3: 20 ms
15/12 03:09:28.438894 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 3, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.438896 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.440113 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 3, rc: SUCCESS
15/12 03:09:28.440118 (nil):mosLdap_SearchUserInDomainGroupsIntr:00572: Un-binding...
15/12 03:09:28.441164 (nil):mosLdap_SearchUserInDomainGroupsIntr:00581: User test_user was found in 4 groups - search-user: ccmadm, bind-user: uid=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM, rc: SUCCESS, time: 20 ms
15/12 03:09:28.441647 0x7fd8b1cfddb0:ldapAuthMgr_Authenticate:00731: Completed - roles-mask: 0xF
15/12 03:09:28.441730 0x7fd8b1cfddb0:repType_AllocObjects:04767: Allocating 1 objects (first-index: 2) of type SESSION
15/12 03:09:28.441785 0x7fd8b16fadb0:repExtent_IO:03750: Writing to the repository - Extent: 7092, Page: 113778, Size: 8192, Batch size: 1, Last type: SESSION
15/12 03:09:28.445751 0x7fd8b170cdb0:repExtent_IO:03750: Writing to the repository - Extent: 7092, Page: 113778, Size: 8192, Batch size: 1, Last type: SESSION
15/12 03:09:28.447731 0x7fd8b1cfddb0:mosEventLog_PostInternal:00609: New event added. Message: "Command login succeeded. [144]". Additional info: "" Severity: Info

影響

 LDAP 驗證的使用者無法登入 MDM。每次嘗試 LDAP 時的 MDM 切換

這是作業系統相關的問題，在使用 OpenLDAP 時會發生 Ubuntu 特有的問題。

當 PowerFlex 內部功能嘗試將 baseDn 字元編號複製到驗證要求中時，它會使用硬編碼的 LdapDn char[256] 字元大小，即 256，其中啟動連線要求的最大字元為 128 個字元，由 FQDN（char[128]） 表示。

啟動連接請求的最大值為 128 個字元，因此，嘗試發送身份驗證請求會導致緩衝區溢出。

在其他操作系統中，複製操作複製 Fqdn （char[128]） 中的最小字元數，這是實際字元數（小於 128）。在 Ubuntu 中，它會複製 LdapDn char[256] 長度，也就是 256。

受影響的版本

PowerFlex 3.5.x.x

PowerFlex 3.6.x.x

已修正問題的版本

PowerFlex 3.5.1.6

PowerFlex 3.6.0.4