Recent changes to bugs

debugging get's enabled also with --disable-debug

hanno boeck — Thu, 09 Sep 2010 22:18:09 -0000

Due to a bug in the configure-script, --disable-debug also enables debugging.

This can lead to a security issue as debugging leaks information to a file in /tmp. This is documented, so it generally isn't a problem, but as this configure-bug can cause debugging to be enabled when the user explicitely wants to disable it, I consider this a security threat. I've assigned CVE-2010-1483 to this issue.

More efficient query for group members

Sylvain — Sun, 23 Aug 2009 10:46:57 -0000

I reported this bug directory to the maintainer, but I copy it here so it doesn't get reported several times:
http://lists.gnu.org/archive/html/savannah-hackers-public/2009-08/msg00004.html

Hi,

Thanks for developing libnss-mysql, it looks like I'll be able to drop
our db->system cron job ( at http://savannah.gnu.org/ ) :)

I have a suggestion to improve the 'getgrent' query quite a lot. Are
you still maintaining the package?

I noticed that 'getent group' is particularly slow, as libnss-mysql
makes one query per group (this is the only place where it performs
poorly compared to libnss-ldap ;)).

Since I'm using joins in that query this is taking several minutes for
3000 groups (0.2s per query * 3000 = 10mn).

As far as I can see this is a design decision, to get the group
members from in a separate table, with a separate query for each
group.

However it's now possible to easily grab all those members in a single
"getgrent" query, for example

SELECT unix_group_name, 'x', gidNumber,
GROUP_CONCAT(user_name SEPARATOR ',')
FROM user_group
JOIN user ON user.user_id = user_group.user_id
JOIN groups ON groups.group_id = user_group.group_id
GROUP BY groups.group_id;

with a simple many2many relationship:
- user
- user_id PK
- user_name
- uidNumber
- group
- group_id PK
- unix_group_name
- gidNumber
- user_group
- user_id FK
- group_id FK

and GROUP_CONCAT
http://dev.mysql.com/doc/refman/5.0/en/group-by-functions.html#function_group-concat

(If GROUP_CONCAT sounds edgy, although it's here since 4.1, it's still
possible to drop the grouping and concat manually in the C code.)

That query would take 0.4s. With the current version 'getent group'
takes several minutes with the joins, and no less than 4s if I cache
the user and group fields in the 'user_group' table (for 3000 groups).

Are you interested in improving the performances of getgrent / 'getent group'?
I'm willing to work on a patch.

Group skipped on buffer resize

Sylvain — Fri, 07 Aug 2009 17:56:30 -0000

Hi,

When the buffer is too small, libnss-mysql returns NSS_TRYAGAIN so that the OS doubles the buffer size and call the function again.
However the MySQL resultset is not reset, so when the function is called again, it uses the next row, and hence skips an entry.

I experienced this while using "getent group" (getgrent) with many users: it skipped a group at each buffer resize.

Attach is a proof-of-concept patch that use mysql_row_tell and mysql_row_seek to fix this issue.

_nss_mysql_load_memsbygid

SyncOps — Wed, 28 Feb 2007 20:54:36 -0000

When I add a user to a group (gid=3000) which has 63 members suddenly all users are removed from the group.

executing id [user] showed following in debug:

_nss_mysql_run_query: Executing query: SELECT username FROM grouplist WHERE gid='3000'
_nss_mysql_connect_sql: ENTER
_nss_mysql_check_existing_connection: ENTER
_nss_mysql_validate_socket: ENTER
_nss_mysql_is_same_sockaddr: ENTER
_nss_mysql_is_same_sockaddr: EXIT (TRUE)
_nss_mysql_is_same_sockaddr: ENTER
_nss_mysql_is_same_sockaddr: EXIT (TRUE)
_nss_mysql_validate_socket: EXIT (TRUE)
_nss_mysql_check_existing_connection: EXIT (TRUE)
_nss_mysql_connect_sql: Using existing connection
_nss_mysql_connect_sql: EXIT (NSS_SUCCESS)
_nss_mysql_run_query: EXIT (NSS_SUCCESS)
_nss_mysql_load_memsbygid: ENTER
_nss_mysql_fetch_row: ENTER
_nss_mysql_fetch_row: EXIT (NSS_SUCCESS)
[ removed multiple repeats of same 2 lines]
_nss_mysql_fetch_row: ENTER
_nss_mysql_fetch_row: EXIT (NSS_SUCCESS)
_nss_mysql_load_memsbygid: EXIT (NSS_TRYAGAIN)
_nss_mysql_close_result: ENTER
_nss_mysql_close_result, calling mysql_free_result()
_nss_mysql_close_result: EXIT
_nss_mysql_lookup: EXIT (NSS_TRYAGAIN)
_nss_mysql_load_group: EXIT (NSS_TRYAGAIN)
_nss_mysql_lookup: EXIT (NSS_TRYAGAIN)
_nss_mysql_getgrent_r: EXIT (NSS_TRYAGAIN)

When i remove the grouplist record, other users are back in the group. logging shows:

_nss_mysql_load_memsbygid: EXIT (NSS_SUCCESS)
_nss_mysql_close_result: ENTER
_nss_mysql_close_result, calling mysql_free_result()
_nss_mysql_close_result: EXIT
_nss_mysql_lookup: EXIT (NSS_SUCCESS)
_nss_mysql_load_group: EXIT (NSS_SUCCESS)
_nss_mysql_lookup: EXIT (NSS_SUCCESS)
_nss_mysql_getgrent_r: EXIT (NSS_SUCCESS)

Return Type Error on _nss_mysql_run_query

Anonymous — Mon, 12 Jun 2006 16:06:08 -0000

EMAIL: matteo.faleschini(AT)fisica.unimi.it

We found errors using this library with mysql cluster.
When mysqld are functioning but the storage (ndbd) is
down, we incurred in a SUCCESS of the db connection but
a FAILURE of the query

Proto of _nss_mysql_run_query
is
NSS_STATUS
_nss_mysql_run_query (char *query, MYSQL_RES **mresult,
int *attempts)

Instead the return value of this function in case of
query error is the return value of mysql_query
function. This is the mysql error code, not the
NSS_STATUS requested by the function.

retval = mysql_query (&ci.link, query);
if (retval != RETURN_SUCCESS)
{
--(*attempts);
if (*attempts > 0)
{
_nss_mysql_log (LOG_ALERT,
"mysql_query failed : %s,
trying again (%d)",
mysql_error (&ci.link),
*attempts);
DSRETURN (_nss_mysql_run_query (query,
mresult, attempts));
}
else
{
_nss_mysql_log (LOG_ALERT, "mysql_query
failed (with retval): %s",
mysql_error (&ci.link));
//DSRETURN (retval);
DSRETURN (NSS_UNAVAIL);
}
}

We solved this problem, substituting last line

"DESTDIR=/another/root make install" fails

Christian Skarby — Thu, 26 Jan 2006 19:09:45 -0000

As pacakged in libnss-mysql-1.5.tar.gz (md5sum:a34d41a38e426ba26ffde07d03beef8e) an error will occur when the "${DESTDIR]/etc"-directory does not exist when doing "make install". Many times this will not be troublesome, but on some systems package builders install packages to a sandbox before copying the files into the real system. Please fix for next release.

mysql client initialization DEF_TIMEOUT is bad

David Beck — Mon, 25 Jul 2005 14:03:01 -0000

Take a look at these:

https://sourceforge.net/forum/forum.php?thread_id=1324028&fo

http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/82731

A small problem is in Sample SQL.

Tadashi Jokagi — Mon, 19 Jul 2004 12:44:26 -0000

A small problem is in Sample SQL.
In the present SQL, two or more users of a same name
can create.
A problem is below avoidable.

CREATE TABLE users (
username varchar(16) NOT NULL default '',
uid int(11) NOT NULL auto_increment,
gid int(11) NOT NULL default '5000',
gecos varchar(128) NOT NULL default '',
homedir varchar(255) NOT NULL default '',
shell varchar(64) NOT NULL default '/bin/bash',
password varchar(34) NOT NULL default 'x',
lstchg bigint(20) NOT NULL default '1',
min bigint(20) NOT NULL default '0',
max bigint(20) NOT NULL default '99999',
warn bigint(20) NOT NULL default '0',
inact bigint(20) NOT NULL default '0',
expire bigint(20) NOT NULL default '-1',
flag bigint(20) unsigned NOT NULL default '0',
PRIMARY KEY (uid),
- KEY username (username),
+ UNIQUE KEY `username` (`username`),
KEY username (username),
KEY uid (uid)
) TYPE=MyISAM AUTO_INCREMENT=5000;

Please check.
Regards.

No syslog message upon wrong # of returned columns?

Ben Goodwin — Thu, 10 Jun 2004 11:45:54 -0000

http://sourceforge.net/forum/forum.php?
thread_id=1083028&forum_id=187504

Aborted connection - Got an error reading communication ...

Ben Goodwin — Thu, 10 Jun 2004 11:43:09 -0000

With 'warnings' enabled in my.cnf:

xxxxxx xx:xx:xx Aborted connection x to db: 'auth'
user: 'nss-user' host: `x.x.x.x' (Got an error reading
communication packets)

this happens *every* time a process exits - eg every
time you type 'id cinergi'

I believe this is harmless, but should be fixed. It's
probably due to the fact that mysql_close() isn't called
upon process exit. I may be able to add an atexit()
handler.. I hope it's a portable function/construct.