[DMC-840] cgsi_plugin work-around for Globus GSS threadsafe issue Created: 18/May/16  Updated: 01/Aug/16  Resolved: 22/Jul/16

Status: Closed
Project: DMC - Development
Component/s: CGSI-gSOAP
Affects Version/s: CGSI-gSOAP 1.3.8
Fix Version/s: CGSI-gSOAP 1.3.9
Security Level: Public Data (This ticket is visible to anyone on the internet and will be indexed by search engines)

Type: Bug Priority: Major
Reporter: paul.millar@desy.de (Inactive) Assignee: Alejandro Alvarez Ayllon (Inactive)
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Debian Jessie


Component Watchers:

 Description   

Globus GSS code is not completely thread safe. At least the `gss_init_sec_context` is racy and can fail. This has been reported as issue 48:

https://github.com/globus/globus-toolkit/issues/48

There is a simple work-around, protect calls to gss_init_sec_context with a mutex. I have a patch that adds this work-around; the above link shows part of that code.



 Comments   
Comment by Alejandro Alvarez Ayllon (Inactive) [ 20/May/16 ]

About this particular ticket, I am wondering if it is rather an issue of rather calling CRYPTO_set_locking_callback?

Comment by paul.millar@desy.de (Inactive) [ 20/May/16 ]

It could be. To be honest, I haven't gotten to the bottom of this problem.

What I found is that protecting gss_init_sec_context with a separate mutex (separate from the one I used to work-around Globus module initialisation) "fixed" the problem for me.

I'm not sure if the contention is between two threads calling the same method, or any of the `gss_` methods and adding the mutex works-by-chance (serialising the threads, so avoiding further contention). Such a work-around might fix only my application and not be affective for others.

The Globus developers haven't commented on the above ticket. I can try to dig deeper and provide them with a bit more information, or provide a minimal test-case to demonstrate the problem.

Comment by Alejandro Alvarez Ayllon (Inactive) [ 20/May/16 ]

Ok, I fixed the others. I'll wait until the Globus developers reply for this.

Comment by paul.millar@desy.de (Inactive) [ 22/Jul/16 ]

Since Globus developers are being slow to respond to the issue, and there's a simple work-around, why not adopt the work-around for now?

Comment by Alejandro Alvarez Ayllon (Inactive) [ 22/Jul/16 ]

Yeah, I guess I'll go for it.
I already had to close a ticket after 1 year and a half without response, so...

Comment by Alejandro Alvarez Ayllon (Inactive) [ 22/Jul/16 ]

https://gitlab.cern.ch/dmc/cgsi-gsoap/commit/ef918cd47b658cb487b3e2a67f604ed2fc719f03

Comment by Clockwork Droid [ 22/Jul/16 ]

FAILURE: Integrated in Jenkins build (devel) cgsi-gsoap #17 (See https://jenkins.cern.ch/fts-dmc/job/(devel)%20cgsi-gsoap/17/)
DMC-840:Workaround for Globus GSS threadsafe issue (alejandro.alvarez.ayllon: rev ef918cd47b658cb487b3e2a67f604ed2fc719f03)

Comment by Clockwork Droid [ 01/Aug/16 ]

Alejandro Alvarez Ayllon mentioned this issue in a commit of dmc/cgsi-gsoap:
'DMC-840:Workaround for Globus GSS threadsafe issue'

Generated at Fri Apr 19 18:15:33 CEST 2019 using Jira 7.13.1#713001-sha1:5e06076c2d215a6f699b7e5c90ab2fae7ba5a1ce.