Crash during back channel SLO

Description

shibd crashes when processing a back channel SP initiated global logout. The logout request is sent to the IdP but shibd crashes after reading the IdP's answer (see attached shibd log on DEBUG). Steps to reproduce: 1) log in at the SP 2) visit /Shibboleth.sso/BackChannelLogout to start the logout process.

The LogoutInitiator is defined this way:
<LogoutInitiator type="Chaining" Location="/BackChannelLogout" relayState="cookie">
<LogoutInitiator type="SAML2" outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
<LogoutInitiator type="Local"/>
</LogoutInitiator>

Stack trace of the crash:
(gdb) c
Continuing.
[New Thread 0xb3bfeb90 (LWP 11639)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb3bfeb90 (LWP 11639)]
0xb7e53bd8 in shibsp::SAML2LogoutInitiator::doRequest (this=0xb5106b98, application=@0xb5100b40, httpRequest=@0x9c89820, httpResponse=@0x9b9eed8, session=0x9ca2578)
at handler/impl/SAML2LogoutInitiator.cpp:370
370 partial = XMLString::equals(sc->getStatusCode()->getValue(), StatusCode::PARTIAL_LOGOUT);
(gdb) bt
#0 0xb7e53bd8 in shibsp::SAML2LogoutInitiator::doRequest (this=0xb5106b98, application=@0xb5100b40, httpRequest=@0x9c89820, httpResponse=@0x9b9eed8, session=0x9ca2578)
at handler/impl/SAML2LogoutInitiator.cpp:370
#1 0xb7e54758 in shibsp::SAML2LogoutInitiator::receive (this=0xb5106b98, in=@0xb3bfe22c, out=@0xb3bfe15c) at handler/impl/SAML2LogoutInitiator.cpp:269
#2 0xb7ecdba9 in shibsp::ListenerService::receive (this=0x9af166c, in=@0xb3bfe22c, out=@0xb3bfe15c) at remoting/impl/ListenerService.cpp:113
#3 0xb7ed0f9e in shibsp::ServerThread::job (this=0xb51d2758) at remoting/impl/SocketListener.cpp:539
#4 0xb7ed2017 in shibsp::ServerThread::run (this=0xb51d2758) at remoting/impl/SocketListener.cpp:479
#5 0xb7ed2117 in server_thread_fn (arg=0xb51d2758) at remoting/impl/SocketListener.cpp:413
#6 0xb6b274c0 in start_thread () from /lib/i686/cmov/libpthread.so.0
#7 0xb5ebb6de in clone () from /lib/i686/cmov/libc.so.6

Environment

Debian GNU/Linux 5.0 i386
gcc (Debian 4.3.2-1.1) 4.3.2
IdP 2.1.5-slo5 (from https://wiki.aai.niif.hu/index.php/Single_Logout_in_Shibboleth_IdP)

Attachments

1
  • 26 Nov 2009, 07:17 AM

Activity

Former user November 30, 2009 at 7:30 AM
Edited

Tested back channel logout with rev 3202 of the REL_2 branch and it did not crash.

Scott Cantor November 27, 2009 at 2:46 PM

http://svn.middleware.georgetown.edu/view/cpp-sp?view=rev&revision=3201

If either of you have the ability to test the fix using the latest rev of that source file, it would be appreciated.

Former user November 26, 2009 at 9:35 AM
Edited

The Apache module reports the following error:
shibsp::ListenerException at (https://xenos.unil.ch/Shibboleth.sso/BackChannelLogout)
Failure receiving response to remoted message (default/BackChannelLogout::run::SAML2LI).

Adam Lantos November 26, 2009 at 7:39 AM

This also happens in our demo environment, this is the log and the LogoutResponse which crashes shibd:

2009-11-26 13:31:22 DEBUG XMLTooling.SOAPClient [1]: received XML:
<soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/"><soap11:Body><saml2p:LogoutResponse xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_c1cee1394a363724cfb7211eecc1e82a" InResponseTo="_953b3f252de8456162bb8a18afcd0c4c" IssueInstant="2009-11-26T12:31:22.020Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://sandbox.slotest.aai.niif.hu/idp/shibboleth</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_c1cee1394a363724cfb7211eecc1e82a">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10
/xml-exc-c14n#" PrefixList="ds saml2 saml2p"/></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>gxWxxfykL7V8BvkqoUfWuL6zeEw=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
I5DsPKEVEWrTqtsDGgtEQAE/lN6niirQaBBffUBrtDqyJE6kUYoZTJdcavpPXTW+ArsIxhmsw8rQ
eFN2TgyJyHHlC0KpS1b1Vw2oS9Gknh+KGD6l3HR+UZFdptgqKm+RNLmgG1/9nqXzkCwEpYh0wsTk
g0+LBcRw0lnnjZmehj2GcfsRCxJHHtgRlKQn6b2sF5RLAL8eh/2Spk1JIUISEp6W/RuvKMideOC+
bgKJSce3aneMpvK0Q7HpUMWmOFd41YStsahZ6GTauHXbJSy/7laQTG4R7TfRQ4Uc3c3faeZlfb8M
vSeWeN/j5HZpuT73B+wKEJXLNG1qIaI/QnAhJQ==
</ds:SignatureValue>
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDVzCCAj+gAwIBAgIUOUTcndbLEtMNdhADkR8pIkmbXdcwDQYJKoZIhvcNAQEFBQAwJjEkMCIG
A1UEAxMbc2FuZGJveC5zbG90ZXN0LmFhaS5uaWlmLmh1MB4XDTA5MDgxMDA5NDg1OFoXDTI5MDgx
MDA5NDg1OFowJjEkMCIGA1UEAxMbc2FuZGJveC5zbG90ZXN0LmFhaS5uaWlmLmh1MIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkJjqDaWt64ZX8DAGfNnzlnlT0kRrP9xztYg7aEByFs1r
9AAsOqTygDTb6RjGOpv86grddXsm2NMEC2M0YrlnTHVkXUvcJOQ4FwUAJ1kXqPo0z6+Umk202VPR
rL86oY+jJicepgAaFqKhkLsslGfjGoXi0lh11grzFhdGWLFX5PNzmk3mtl9Kip8BjUhdsV4Qhcsg
xd14ZrUWVV0K4OgMIY+9unuLI60mhF5+NRM5pH81ixxcbtiBDtQgxWf/hOGYoBfytFbNEQcyW0rq
ezWoAn/09ZX3yFadrrRT4NQAepm4l64Uqo0YSaU8sH+5bPcuBT5I5KY/borkr/0RPJjeEQIDAQAB
o30wezBaBgNVHREEUzBRghtzYW5kYm94LnNsb3Rlc3QuYWFpLm5paWYuaHWGMmh0dHBzOi8vc2Fu
ZGJveC5zbG90ZXN0LmFhaS5uaWlmLmh1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQWBBRVfTvyTLuo
K3++LaTvKG1Lp9R/tzANBgkqhkiG9w0BAQUFAAOCAQEAcX5HujOzGOVlm0EvfyPN8gGimyWQ8t8F
wSE4YFHTFyIbu5QKAkPAgptxSfLCQ7xoUyq+Gp2pGIklbbKjJBJQ7NnGfaGvnnoO4WX+KCqW9KQy
/b3c1Xgv/VcybTVBS8/x3ttQa9G9CJmtzAd4Xt+VdtiSJ1t1/FMcVz4XBsYEYEbfYKx0V7Osn26f
ae9brOIiHS4lVLdfpPciysdzASflp69yY3eJyfsvVuzklwWOy6RnROVFY1YDYoXCu5WfW7mct5Vl
XHC4N+OAaeVi86Loe0vLM/zpZYCCbUogN6PwTKyTviVHWbyeKrl1AmKlQ3a8zp9bQh0r02hRczHp
tBnoIQ==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status></saml2p:LogoutResponse></soap11:Body></soap11:Envelope>
2009-11-26 13:31:22 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: evaluating message flow policy (replay checking on, expiration 60)
2009-11-26 13:31:22 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: evaluating message flow policy (replay checking on, expiration 60)
2009-11-26 13:31:22 DEBUG XMLTooling.StorageService [1]: inserted record (_c1cee1394a363724cfb7211eecc1e82a) in context (MessageFlow)
2009-11-26 13:31:22 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: validating signature profile
2009-11-26 13:31:22 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: attempting to validate signature with the peer's credentials
2009-11-26 13:31:22 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: signature validated with credential
2009-11-26 13:31:22 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: signature verified against message issuer

Fixed

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Created November 26, 2009 at 7:17 AM
Updated June 24, 2021 at 2:56 PM
Resolved November 27, 2009 at 2:46 PM