pkinit makes application crash

[Osipov, Michael]

Hi Ben,

thanks for the quick response.

> 
> On Wed, 24 Jun 2015, Osipov, Michael wrote:
> 
> > Hi folks,
> >
> > we are trying to perform some LDAP requests with Perl against Active
> Directory
> > with Kerberos auth by MIT Kerberos.
> > A core file is dumped and following written to stderr:
> > $ ./ldap.pl
> > Assertion failed: __thread_init == NULL, file
> ../../../../../core/libs/libc/shared_em_32_perf/../core/threads/pthread_st
> ubs1.c, line 1045
> > Abbruchkommando (Speicherabzug geschrieben)
> >
> > I first have assumed that the Perl module is broken but I guess it
> isn't?!
> > Loading the core file into GDB gives me:
> >
> ==========================================================================
> =====
> > (gdb) where
> > #0  0x60000000c020f6d0:0 in _lwp_kill+0x30 ()
> >    from /usr/lib/hpux32/libpthread.so.1
> > #1  0x60000000c0174be0:0 in pthread_kill+0x9f0 ()
> >    from /usr/lib/hpux32/libpthread.so.1
> > #2  0x60000000c0403460:0 in raise+0xe0 () from /usr/lib/hpux32/libc.so.1
> > #3  0x60000000c05277b0:0 in abort+0x170 () from
> /usr/lib/hpux32/libc.so.1
> > #4  0x60000000c03ce5f0:0 in _assert+0x260 () from
> /usr/lib/hpux32/libc.so.1
> > #5  0x60000000c0590980:0 in pthread_once+0x80 () from
> /usr/lib/hpux32/libc.so.1
> > #6  0x60000000c4bab160:0 in pkinit_init_plg_crypto ()
> >     at pkinit_crypto_openssl.c:410
> 
> This pthread_once() stuff is in the library initializor for pkinit's use
> of openssl, thought it's not immediately clear what assertion is being
> made in the innards of libc.  The fact that the file named in the
> assertion failure message is named pthread_stubs1.c makes me wonder if
> there is an issue with an executable which was not compiled as threaded
> (i.e., is compiled to use the stub implementation) then loaded an object
> which uses the pthread interfaces, but that is basically pure speculation.
> I don't have enough experience with HP-UX to have any sense of how
> plausible that might be.

Based on your explanation, I have made some digging:
The Perl installation provided by HP says (perl -V) it is multithreaded.
After that I have recompiled and lined the GSSAPI Perl module against 1.13.1.
According to HP's compiler options -mt has to be passed. I have added that
to the Makefile. Calling gss_init_sec_context from Perl gives me the same
crash. So I guess, some C binding from Perl isn't multithreading aware. [1]

Unfortunately, I cannot go further than that because my experience stops here.

> [...]
> > As a workaround, I would recompile MIT Kerberos on all servers without
> pkinit
> > for now.
> 
> That workaround seems advisable for now.

At least I have one now. Maybe someone else will share some wisdom on that.

Thank you a lot,

Michael

[1] http://search.cpan.org/~perigrin/HTTP-Thin-UserAgent-0.011/local/lib/perl5/darwin-2level/Net/SSLeay.pod#Combining_Net::SSLeay_with_other_modules_linked_with_openssl