Re: Running xinetd 2.3.12
Marco Di Benedetto <[email protected]> Thu, 14 Aug 2003 12:26:16 -0700 (PDT)
| Newsgroups | gmane.network.xinetd |
|---|---|
| Message-ID | <[email protected]> |
I did some more testing, and I'm now realizing the problem happens only
if I have at least 6 services in /etc/xinetd.d. I tried to remove a
random number of services from /etc/xinetd.d, and as long as I have
less than 6 services in /etc/xinetd.d, everything works just fine.
I don't know what would happen with more than 6 services (I don't have
a 7th service to enable), but I know that this happens with exactly
6 services:
- start xinetd, everything looks ok.
- send HUP a first time. All the services get deactivated.
- send HUP a second time -> SIGSEGV.
The core (when I compile xinetd with the -DDEBUG option) goes to the
root directory, even though I did start xinetd in a different place
(some call to chdir() in the code?). The cmdline is
"./xinetd -dontfork -reuse -d &", and here is the backtrace of one case:
> Program terminated with signal 11, Segmentation fault.
> Reading symbols from /lib/libm.so.6...done.
> Loaded symbols for /lib/libm.so.6
> Reading symbols from /lib/libcrypt.so.1...done.
> Loaded symbols for /lib/libcrypt.so.1
> Reading symbols from /lib/libc.so.6...done.
> Loaded symbols for /lib/libc.so.6
> Reading symbols from /lib/ld-linux.so.2...done.
> Loaded symbols for /lib/ld-linux.so.2
> Reading symbols from /lib/libnss_files.so.2...done.
> Loaded symbols for /lib/libnss_files.so.2
> Reading symbols from /lib/libnss_dns.so.2...done.
> Loaded symbols for /lib/libnss_dns.so.2
> Reading symbols from /lib/libresolv.so.2...done.
> Loaded symbols for /lib/libresolv.so.2
> #0 0x2ab86c87 in malloc () from /lib/libc.so.6
> (gdb) where
> #0 0x2ab86c87 in malloc () from /lib/libc.so.6
> #1 0x2ab86a26 in malloc () from /lib/libc.so.6
> #2 0x08065368 in setup_read_buffer (idp=0x8072950, buf_size=8192)
> at siosup.c:351
> #3 0x08064fd1 in __sio_switch (idp=0x8072950, fd=6) at siosup.c:211
> #4 0x0806461d in Srdline (fd=6) at sio.c:169
> #5 0x080562c3 in next_line (fd=6) at parsesup.c:32
> #6 0x08055510 in find_next_entry (fd=6, snamep=0x7ffff760) at parse.c:304
> #7 0x080552e0 in parse_conf_file (fd=6, confp=0x7ffff92c,
> filename=0x806980c "/etc/xinetd.conf") at parse.c:221
> #8 0x080500ac in get_conf (fd=6, confp=0x7ffff92c) at confparse.c:833
> #9 0x08050110 in cnf_get (confp=0x7ffff92c) at confparse.c:859
> #10 0x08058d7e in hard_reconfig () at reconfig.c:70
> #11 0x0805e4fc in check_pipe () at signals.c:558
> #12 0x0805493f in main_loop () at main.c:153
> #13 0x08054796 in main (argc=4, argv=0x7ffffaa4) at main.c:88
> #14 0x2ab31819 in __libc_start_main () from /lib/libc.so.6
> (gdb)
Unfortunately I don't think a backtrace like this can give you much info
about what's going on. :-(
Here is the log of the console:
> Linux(debug)# ./xinetd -dontfork -reuse -d &
> [1] 3656
> 04/9/3@19:28:03: DEBUG: 3656 {handle_includedir} Reading included configuration file: /etc/xinetd.d/ftp [file=/etc/xinetd.conf] [line=38]
> 04/9/3@19:28:03: DEBUG: 3656 {handle_includedir} Reading included configuration file: /etc/xinetd.d/rexec [file=/etc/xinetd.d/rexec] [line=12]
> 04/9/3@19:28:03: DEBUG: 3656 {handle_includedir} Reading included configuration file: /etc/xinetd.d/rlogin [file=/etc/xinetd.d/rlogin] [line=15]
> 04/9/3@19:28:03: DEBUG: 3656 {handle_includedir} Reading included configuration file: /etc/xinetd.d/rsh [file=/etc/xinetd.d/rsh] [line=15]
> 04/9/3@19:28:03: DEBUG: 3656 {handle_includedir} Reading included configuration file: /etc/xinetd.d/ssh [file=/etc/xinetd.d/ssh] [line=16]
> 04/9/3@19:28:03: DEBUG: 3656 {handle_includedir} Reading included configuration file: /etc/xinetd.d/telnet [file=/etc/xinetd.d/telnet] [line=30]
> Service defaults
> Instances = 60
> Bind = All addresses.
> Only from: All sites
> No access: No blocked sites
> No logging
>
> Service configuration: ftp
> id = ftp
> flags = IPv4
> socket_type = stream
> Protocol (name,number) = (tcp,6)
> port = 21
> wait = no
> user = 0
> Groups = no
> PER_SOURCE = -1
> Bind = All addresses.
> Server = /usr/sbin/in.ftpd
> Server argv = in.ftpd
> Only from: 127.0.0.0/255.0.0.0(NET)
> No access: No blocked sites
> No logging
>
> Service configuration: exec
> id = exec
> flags = IPv4
> socket_type = stream
> Protocol (name,number) = (tcp,6)
> port = 512
> wait = no
> user = 0
> Groups = no
> PER_SOURCE = -1
> Bind = All addresses.
> Server = /usr/sbin/in.rexecd
> Server argv = in.rexecd
> Only from: 127.0.0.0/255.0.0.0(NET)
> No access: No blocked sites
> No logging
>
> Service configuration: login
> id = login
> flags = IPv4
> socket_type = stream
> Protocol (name,number) = (tcp,6)
> port = 513
> wait = no
> user = 0
> Groups = no
> PER_SOURCE = -1
> Bind = All addresses.
> Server = /usr/sbin/in.rlogind
> Server argv = in.rlogind
> Only from: 127.0.0.0/255.0.0.0(NET)
> No access: No blocked sites
> No logging
>
> Service configuration: shell
> id = shell
> flags = IPv4
> socket_type = stream
> Protocol (name,number) = (tcp,6)
> port = 514
> wait = no
> user = 0
> Groups = no
> PER_SOURCE = -1
> Bind = All addresses.
> Server = /usr/sbin/in.rshd
> Server argv = in.rshd
> Only from: 127.0.0.0/255.0.0.0(NET)
> No access: No blocked sites
> No logging
>
> Service configuration: ssh
> id = ssh
> flags = IPv4
> socket_type = stream
> Protocol (name,number) = (tcp,6)
> port = 22
> wait = no
> user = 0
> Groups = no
> PER_SOURCE = -1
> Bind = All addresses.
> Server = /isan/sbin/sshd
> Server argv = sshd -i
> Only from: All sites
> No access: No blocked sites
> No logging
>
> Service configuration: telnet
> id = telnet
> flags = REUSE IPv4
> socket_type = stream
> Protocol (name,number) = (tcp,6)
> port = 23
> wait = no
> user = 0
> Groups = no
> PER_SOURCE = -1
> Bind = All addresses.
> Server = /usr/sbin/in.telnetd
> Server argv = in.telnetd
> Only from: All sites
> No access: No blocked sites
> No logging
>
> 04/9/3@19:28:03: DEBUG: 3656 {cnf_start_services} Started service: ftp
> 04/9/3@19:28:03: DEBUG: 3656 {cnf_start_services} Started service: exec
> 04/9/3@19:28:03: DEBUG: 3656 {cnf_start_services} Started service: login
> 04/9/3@19:28:03: DEBUG: 3656 {cnf_start_services} Started service: shell
> 04/9/3@19:28:03: DEBUG: 3656 {cnf_start_services} Started service: ssh
> 04/9/3@19:28:03: DEBUG: 3656 {cnf_start_services} Started service: telnet
> 04/9/3@19:28:07: DEBUG: 3656 {cnf_start_services} mask_max = 11, services_started = 6
> 04/9/3@19:28:07: NOTICE: 3656 {main} xinetd Version 2.3.12 started with no options compiled in.
> 04/9/3@19:28:07: NOTICE: 3656 {main} Started working: 6 available services
> 04/9/3@19:28:07: DEBUG: 3656 {main_loop} active_services = 6
> Linux(debug)# kill -HUP 3656
> Linux(debug)# 04/9/3@19:28:12: DEBUG: 3656 {main_loop} active_services = 6
> 04/9/3@19:28:12: DEBUG: 3656 {main_loop} select returned 1
> 04/9/3@19:28:12: DEBUG: 3656 {check_pipe} Got signal 1 (Hangup)
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} Starting reconfiguration
> Service defaults
> Bind = All addresses.
> Only from: All sites
> No access: No blocked sites
> No logging
>
> 04/9/3@19:28:12: DEBUG: 3656 {deactivate} 3656 Service ftp deactivated
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} service ftp deactivated
> 04/9/3@19:28:12: DEBUG: 3656 {svc_release} ref count of service ftp dropped to 0
> 04/9/3@19:28:12: DEBUG: 3656 {deactivate} 3656 Service exec deactivated
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} service exec deactivated
> 04/9/3@19:28:12: DEBUG: 3656 {svc_release} ref count of service exec dropped to 0
> 04/9/3@19:28:12: DEBUG: 3656 {deactivate} 3656 Service login deactivated
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} service login deactivated
> 04/9/3@19:28:12: DEBUG: 3656 {svc_release} ref count of service login dropped to 0
> 04/9/3@19:28:12: DEBUG: 3656 {deactivate} 3656 Service shell deactivated
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} service shell deactivated
> 04/9/3@19:28:12: DEBUG: 3656 {svc_release} ref count of service shell dropped to 0
> 04/9/3@19:28:12: DEBUG: 3656 {deactivate} 3656 Service ssh deactivated
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} service ssh deactivated
> 04/9/3@19:28:12: DEBUG: 3656 {svc_release} ref count of service ssh dropped to 0
> 04/9/3@19:28:12: DEBUG: 3656 {deactivate} 3656 Service telnet deactivated
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} service telnet deactivated
> 04/9/3@19:28:12: DEBUG: 3656 {svc_release} ref count of service telnet dropped to 0
> 04/9/3@19:28:12: DEBUG: 3656 {cnf_start_services} mask_max = 11, services_started = 0
> 04/9/3@19:28:12: NOTICE: 3656 {hard_reconfig} Reconfigured: new=0 old=0 dropped=6 (services)
> 04/9/3@19:28:12: DEBUG: 3656 {main_loop} active_services = 0
> kill -HUP 3656
> Linux(debug)# 04/9/3@19:28:19: DEBUG: 3656 {main_loop} active_services = 0
> 04/9/3@19:28:19: DEBUG: 3656 {main_loop} select returned 1
> 04/9/3@19:28:19: DEBUG: 3656 {check_pipe} Got signal 1 (Hangup)
> 04/9/3@19:28:19: NOTICE: 3656 {hard_reconfig} Starting reconfiguration
>
> [1]+ Segmentation fault (core dumped) ./xinetd -dontfork -reuse -d
> Linux(debug)#
I know my e-mail are too long, but as I've mentioned in my last e-mail,
there's another crash I get in a different case, let me give you the
backtrace for that as well. I get it when the following options are in use:
defaults
{
instances = 60
log_type = SYSLOG authpriv
log_on_success = HOST PID
log_on_failure = HOST
}
In this case the core is in the diractory where I start xinetd.
> Program terminated with signal 11, Segmentation fault.
> Reading symbols from /lib/libm.so.6...done.
> Loaded symbols for /lib/libm.so.6
> Reading symbols from /lib/libcrypt.so.1...done.
> Loaded symbols for /lib/libcrypt.so.1
> Reading symbols from /lib/libc.so.6...done.
> Loaded symbols for /lib/libc.so.6
> Reading symbols from /lib/ld-linux.so.2...done.
> Loaded symbols for /lib/ld-linux.so.2
> Reading symbols from /lib/libnss_files.so.2...done.
> Loaded symbols for /lib/libnss_files.so.2
> Reading symbols from /lib/libnss_dns.so.2...done.
> Loaded symbols for /lib/libnss_dns.so.2
> Reading symbols from /lib/libresolv.so.2...done.
> Loaded symbols for /lib/libresolv.so.2
> #0 0x2ab8c213 in strlen () from /lib/libc.so.6
> (gdb) where
> #0 0x2ab8c213 in strlen () from /lib/libc.so.6
> #1 0x08063827 in __sio_converter (odp=0x80728cc, fd=3, fmt=0x806c387 "s",
> ap=0x7ffff4e0) at sprint.c:579
> #2 0x08062c32 in Sprint (fd=3, fmt=0x806c385 " %s") at sprint.c:137
> #3 0x0805a510 in dump_log_data (fd=3, scp=0x8072618, tab_level=1)
> at sconf.c:211
> #4 0x0805b0e3 in sc_dump (scp=0x8072618, fd=3, tab_level=0, is_defaults=1)
> at sconf.c:426
> #5 0x0804deba in cnf_dump (confp=0x7ffffa14, fd=3) at conf.c:70
> #6 0x08050496 in cnf_get (confp=0x7ffffa14) at confparse.c:942
> #7 0x08052029 in init_services () at init.c:361
> #8 0x080546f5 in main (argc=4, argv=0x7ffffaa4) at main.c:50
> #9 0x2ab31819 in __libc_start_main () from /lib/libc.so.6
> (gdb)
This is probably much easier to fix than the other one...
To give some more context, this is happening right in the beginning if
the '-d' option is used:
> Linux(debug)# ./xinetd -dontfork -reuse -d &
> [1] 3505
> 04/9/3@19:02:39: DEBUG: 3505 {handle_includedir} Reading included configuration file: /etc/xinetd.d/ftp [file=/etc/xinetd.conf] [line=38]
> 04/9/3@19:02:39: DEBUG: 3505 {handle_includedir} Reading included configuration file: /etc/xinetd.d/rexec [file=/etc/xinetd.d/rexec] [line=13]
> 04/9/3@19:02:39: DEBUG: 3505 {handle_includedir} Reading included configuration file: /etc/xinetd.d/rlogin [file=/etc/xinetd.d/rlogin] [line=15]
> 04/9/3@19:02:39: DEBUG: 3505 {handle_includedir} Reading included configuration file: /etc/xinetd.d/rsh [file=/etc/xinetd.d/rsh] [line=15]
> 04/9/3@19:02:39: DEBUG: 3505 {handle_includedir} Reading included configuration file: /etc/xinetd.d/ssh [file=/etc/xinetd.d/ssh] [line=16]
> 04/9/3@19:02:39: DEBUG: 3505 {handle_includedir} Reading included configuration file: /etc/xinetd.d/telnet [file=/etc/xinetd.d/telnet] [line=30]
> Service defaults
> Instances = 60
> Bind = All addresses.
> Only from: All sites
> No access: No blocked sites
> Logging to syslog. Facility = authpriv, level = info
> Linux(debug)#
> [1]+ Segmentation fault (core dumped) ./xinetd -dontfork -reuse -d
> Linux(debug)#
Ok, this is all I have. Are you seeing a similar behavior with any random
6 services? Otherwise you can give me any private build of xinetd with
extra instrumentation, I can run it and send you back a core...
Regards.
Marco
Matthias Andree wrote:
>
> Marco Di Benedetto <[email protected]> writes:
>
> > Hi all.
> > A few days ago I've downloaded the sources of xinetd v2.3.12, and
> > I'm having a few problems running it.
> >
> > First of all, the built executable. I'm running xinetd on a pentium-based
> > linux box with a 2.4.17 kernel (sources built with the same).
>
> You know that this kernel has several exploitable bugs (DoS and
> information leaks)? Update unless some vendor applied all available
> security fixes (some as fresh as a couple of days old).
>
> Other than that, can you run xinetd under gdb and obtain a stack
> backtrace when it sees SIGSEGV?
>
> --
> Matthias Andree
> _______________________________________________
> xinetd mailing list
> [email protected]
> http://www.xinetd.org/mailman/listinfo/xinetd