Skip to content
This repository has been archived by the owner on Dec 25, 2023. It is now read-only.

Hook causes denial of service when cannot contact LDAP server #4

Open
jirutka opened this issue Oct 12, 2020 · 0 comments
Open

Hook causes denial of service when cannot contact LDAP server #4

jirutka opened this issue Oct 12, 2020 · 0 comments
Assignees
Labels
bug Something isn't working

Comments

@jirutka
Copy link
Member

jirutka commented Oct 12, 2020

One of the main requirements for this hook was that unavailability of LDAP server must not compromise the functionality of the DHCP server, i.e. it must continue allocating addresses from static reservations and dynamic pools that don’t require the class assigned by the hook.

Unfortunately, this is not what happened today. During the power outage, the LDAP servers were down and the DHCP service basically stopped working. Kea log was full of the following messages:

kea-dhcp4: ERROR [kea-dhcp4.user-chk-ldap-hooks] USER_CHK_LDAP_ERROR DHCP UserCheckHook UserLdap unexpected error while performing LDAP operation: Can't contact LDAP server
kea-dhcp4: ERROR [kea-dhcp4.user-chk-ldap-hooks] USER_CHK_USER_SOURCE_ERROR DHCP UserCheckHook UserDataSource unexpected error: UserLdap: unexpected error while performing LDAP operationCan't contact LDAP server
kea-dhcp4: ERROR [kea-dhcp4.user-chk-ldap-hooks] USER_CHK_SUBNET_SELECT_ERROR DHCP UserCheckHook an unexpected error has occured during processing of pkt4_receive or pkt6_receive callback: UserLdap: unexpected error while performing LDAP operationCan't contact LDAP server

…and it seems that it even caused HA toggling.

As I read the code, I think that it may be caused by throwing exceptions from the hook to Kea, i.e. that Kea fails to handle the request when some of the hooks throw exception.

@geostarling, please fix this problem and verify that it works as excepted.

@jirutka jirutka added the bug Something isn't working label Oct 12, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants