[strongSwan] attr_sql-plugin mysql_client crash when IP_pooling

Tue Apr 24 09:57:28 CEST 2018

Hi!

We are using strongswan 5.5.3 build from source.
Because we have some thousand client to connect through VPN we want to use 2 strongswan -Instances that should share an IP-pool using one attr-sql ip-pool.

So we set up the mysql-database as described in the strongswan documentation and it works fine when the rate of ip requests is low.

When many client at the same time want to get a tunnel the Charon crashes.

Do you have seen anything like that before?
Could it help to use /libmysqlclient.so.20?
What else can we do?

I hope you can help or give an advice!

Kind regards,
Mike.

Our software stack:
Mysql Clientlib libmysqlclient-devel-10.0.33-29.13.1.x86_64 build from mariadb-10.0.33-29.13.1.src.rpm
Server: SLES12 SP3

Charon.log shows (extract):

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec5ab20]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /usr/lib64/libmysqlclient.so.18 @ 0x7f9497fff000 [0x7f9498033d08]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /usr/lib64/libmysqlclient.so.18 @ 0x7f9497fff000 [0x7f94980347dd]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /usr/lib64/libmysqlclient.so.18 @ 0x7f9497fff000 [0x7f9498027fdd]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /usr/lib64/libmysqlclient.so.18 @ 0x7f9497fff000 [0x7f949802d16b]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /usr/lib64/libmysqlclient.so.18 @ 0x7f9497fff000 (mysql_ping+0x2d) [0x7f94980248fd]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec52724]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>   /lib64/libc.so.6 @ 0x7f949e6a5000 (clone+0x6d) [0x7f949e78ec9d]

Apr 23 11:00:36 06[LIB] <RU1-TI|70>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec5ab20]

Apr 23 11:00:36 04[LIB] <RU1-TI|73>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec5ab20]

Apr 23 11:00:36 08[LIB] <RU1-TI|118>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec5ab20]

Apr 23 11:00:36 09[LIB] <RU1-TI|92>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec5ab20]

Apr 23 11:00:36 14[LIB] <RU1-TI|75>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec5ab20]

Apr 23 11:00:36 10[LIB] <RU1-TI|91>   /lib64/libpthread.so.0 @ 0x7f949ec4a000 [0x7f949ec5ab20]

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libstrongswan/plugins/mysql/mysql_database.c:236

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libstrongswan/plugins/mysql/mysql_database.c:535

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/plugins/attr_sql/attr_sql_provider.c:112

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/plugins/attr_sql/attr_sql_provider.c:330

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/attributes/attribute_manager.c:75

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/sa/ikev2/tasks/ike_config.c:357

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/sa/ikev2/task_manager_v2.c:864

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/sa/ike_sa.c:1578

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/sa/ikev2/task_manager_v2.c:1282

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/sa/ikev2/task_manager_v2.c:1545

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/sa/ike_sa.c:1578

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libcharon/processing/jobs/process_message_job.c:74

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libstrongswan/processing/processor.c:235

Apr 23 11:00:36 05[LIB] <RU1-TI|97>     -> /src/strongswan-5.5.3/src/libstrongswan/threading/thread.c:332 (discriminator 2)

Debug-Infor gdb from core dump:

[ggapcadm at gtegklvn04148:APCPEGKR1ZGDKT2]/PEGK/vpnzgd/strongswan/etc:  gdb ../install/libexec/ipsec/charon core.charon.1524474036.27021

GNU gdb (GDB; SUSE Linux Enterprise 12) 8.0.1

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.  Type "show copying"

and "show warranty" for details.

This GDB was configured as "x86_64-suse-linux".

Type "show configuration" for configuration details.

For bug reporting instructions, please see:

<http://bugs.opensuse.org/>.

Find the GDB manual and other documentation resources online at:

<http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".

Type "apropos word" to search for commands related to "word"...

Reading symbols from ../install/libexec/ipsec/charon...done.

....

[New LWP 27039]

[Thread debugging using libthread_db enabled]

Using host libthread_db library "/lib64/libthread_db.so.1".

Core was generated by `strongswan/install/libexec/ipsec/charon --use-syslog --debug-cfg 2'.

Program terminated with signal SIGABRT, Aborted.

#0  0x00007f949e6d98c7 in raise () from /lib64/libc.so.6

[Current thread is 1 (Thread 0x7f949458c700 (LWP 27030))]

Missing separate debuginfos, use: zypper install glibc-debuginfo-2.22-62.6.2.x86_64 krb5-debuginfo-1.12.5-40.16.1.x86_64 libcom_err2-debuginfo-1.42.11-15.1.x86_64 libcurl4-debuginfo-7.37.0-37.14.1.x86_64 libgcc_s1-debuginfo-7.2.1+r253435-2.4.x86_64 libgmp10-debuginfo-5.1.3-2.121.x86_64 libidn11-debuginfo-1.28-4.1.x86_64 libkeyutils1-debuginfo-1.5.9-3.29.x86_64 libldap-2_4-2-debuginfo-2.4.41-18.37.5.x86_64 libmysqlclient18-debuginfo-10.0.33-29.13.1.x86_64 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2.x86_64 libpcre1-debuginfo-8.39-8.3.1.x86_64 libsasl2-3-debuginfo-2.1.26-8.7.1.x86_64 libselinux1-debuginfo-2.5-8.79.x86_64 libssh2-1-debuginfo-1.4.3-19.1.x86_64 libz1-debuginfo-1.2.8-11.1.x86_64

(gdb) bt

#0  0x00007f949e6d98c7 in raise () from /lib64/libc.so.6

#1  0x00007f949e6dac9a in abort () from /lib64/libc.so.6

#2  0x00000000004020ba in segv_handler (signal=11) at charon.c:181

#3  <signal handler called>

#4  0x00007f9464000208 in ?? ()

#5  0x00007f9498033d0e in ?? () from /usr/lib64/libmysqlclient.so.18

#6  0x00007f94980347dd in ?? () from /usr/lib64/libmysqlclient.so.18

#7  0x00007f9498027fdd in ?? () from /usr/lib64/libmysqlclient.so.18

#8  0x00007f949802d16b in mysql_set_character_set () from /usr/lib64/libmysqlclient.so.18

#9  0x00007f94980248fd in mysql_ping () from /usr/lib64/libmysqlclient.so.18

#10 0x00007f949855d13d in conn_get (this=0xa51be0, trans=<optimized out>) at mysql_database.c:236

#11 0x00007f949855d201 in transaction (this=0xa51be0, serializable=<optimized out>) at mysql_database.c:653

#12 0x00007f94979e5c0c in get_identity (ike_sa=<optimized out>, this=0xa0c290) at attr_sql_provider.c:57

#13 0x00007f94979e664b in acquire_address (this=0xa0c290, pools=0x7f944803f320, ike_sa=<optimized out>, requested=0x7f94480318d0) at attr_sql_provider.c:301

#14 0x00007f949f170ef3 in acquire_address (this=0xa04240, pools=0x7f944803f320, ike_sa=0x7f94540193b0, requested=0x7f94480318d0) at attributes/attribute_manager.c:74

#15 0x00007f949f1b0bc5 in build_r (this=0x7f94540150a0, message=0x7f944803dd20) at sa/ikev2/tasks/ike_config.c:357

#16 0x00007f949f1a4693 in build_response (request=0x7f9458035690, this=0x7f9454019770) at sa/ikev2/task_manager_v2.c:864

#17 process_request (message=<optimized out>, this=0x7f9454019770) at sa/ikev2/task_manager_v2.c:1225

#18 process_message (this=0x7f9454019770, msg=<optimized out>) at sa/ikev2/task_manager_v2.c:1554

#19 0x00007f949f1977ff in process_message (this=0x7f94540193b0, message=0x7f9458035690) at sa/ike_sa.c:1577

#20 0x00007f949f1a3a0c in handle_fragment (defrag=defrag at entry=0x7f9454019848, msg=msg at entry=0x7f948020bb20, this=0x7f9454019770) at sa/ikev2/task_manager_v2.c:1278

#21 0x00007f949f1a42f8 in process_message (this=0x7f9454019770, msg=0x7f948020bb20) at sa/ikev2/task_manager_v2.c:1544

#22 0x00007f949f1977ff in process_message (this=0x7f94540193b0, message=0x7f948020bb20) at sa/ike_sa.c:1577

#23 0x00007f949f18ef9f in execute (this=0x7f948034bd10) at processing/jobs/process_message_job.c:74

#24 0x00007f949f426872 in process_job (worker=0xa74cf0, this=0x9ffb90) at processing/processor.c:235

#25 process_jobs (worker=0xa74cf0) at processing/processor.c:321

#26 0x00007f949f436cf5 in thread_main (this=0xa74d20) at threading/thread.c:331

#27 0x00007f949ec52724 in start_thread () from /lib64/libpthread.so.0

#28 0x00007f949e78ec9d in clone () from /lib64/libc.so.6

(gdb)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180424/91633f39/attachment-0001.html>