Bug 7547 - VSM should not crash if a new session is created with a non-existent username
Summary: VSM should not crash if a new session is created with a non-existent username
Status: CLOSED FIXED
Alias: None
Product: ThinLinc
Classification: Unclassified
Component: VSM Server (show other bugs)
Version: trunk
Hardware: PC Unknown
: P2 Normal
Target Milestone: 4.13.0
Assignee: Niko Lehto
URL:
Keywords: ossman_tester, prosaic
Depends on:
Blocks:
 
Reported: 2020-08-20 16:28 CEST by Niko Lehto
Modified: 2020-08-25 10:32 CEST (History)
0 users

See Also:
Acceptance Criteria:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Niko Lehto cendio 2020-08-20 16:28:40 CEST 
The VSM file handler_newsession.py contains an check for username in handle(), and if this does not exist amongst the users, it tries to send the error code ERR_WRONG_AUTH.

This is not declared anywhere and will thus crash.
Comment 2 Niko Lehto cendio 2020-08-21 11:59:54 CEST 
Tested solution after I installed a newly built rpm on Fedora 31.
Tested the following:
✓ Basic functionality
  ✓ Sound redirection
  ✓ Continuous updates
  ✓ Keyboard/mouse input
✓ New session
✓ Reconnecting to an existing session
✓ End existing and creating new one
Comment 3 Niko Lehto cendio 2020-08-21 15:04:29 CEST 
(In reply to Niko Lehto from comment #2)
> ✓ Basic functionality
>   ✓ Sound redirection
>   ✓ Continuous updates
>   ✓ Keyboard/mouse input
> ✓ New session
> ✓ Reconnecting to an existing session
> ✓ End existing and creating new one

Tested these same things on a Jenkins build that included the changes. Tested aon a fresh installation of RHEL8.
Comment 4 Niko Lehto cendio 2020-08-21 15:15:25 CEST 
here's the crash traceback, forgot to add it earlier:
>  File "/home/nikle/dev/ctc/vsm/modules/thinlinc/vsm/handler_newsession.py", line 43, in handle
>    self.respond_with_errcode(ERR_WRONG_AUTH)
>NameError: global name 'ERR_WRONG_AUTH' is not defined
Comment 5 Niko Lehto cendio 2020-08-25 09:59:46 CEST 
If this crash would occur in normal usage the consequence would be a bad error message. Furthermore, in normal use case this crash should be very unlikely to happen.
This because handle_new_session will only ever receive a wrong uid call if the user exists during the creation but not during the first connection (e.g. if the server side user database crashes in that short interval).

No release notes needed.
Comment 7 Pierre Ossman cendio 2020-08-25 10:32:58 CEST 
Seems to work fine. Tested creating a new session on a Ubuntu 20.04.

Can't really provoke the bug manually, but the test looks fine and passes when I run it.
Note You need to log in before you can comment on or make changes to this bug.