PacketFence - BTS - PacketFence
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001370PacketFencehardware modulespublic2012-01-24 15:312012-02-28 14:31
Reporterobilodeau 
Assigned Toobilodeau 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version 
Target Version3.2.0Fixed in Version3.2.0 
fixed in git revision
fixed in mtn revision5b3395f89f9fff65ed9bdd165e11a4688f599d73
Summary0001370: Net::Appliance::Session privilege detection broken resulting into a thread crash
DescriptionIn setPortSecurityMaxSecureMacAddrVlanAccessByIfIndex (from lib/pf/SNMP/Cisco/Catalyst_2950.pm) the privilege detection doesn't work when a user gets in with an already privileged user (level 15).

thread failed to start: Failed to get first privileged prompt at
    /usr/local/pf/lib/pf/SNMP/Cisco/Catalyst_2950.pm line 678 (0000001)
    (W threads)(S) The entry point function of threads->create() failed for some reason.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
related to 0000900closed  we should detect if we are enabled everytime it's relevant for Net::Appliance::Session 
Attached Filespatch net-appliance-session-disable-begin-privilege-fix-1370.patch (8,111) 2012-01-25 14:46
https://www.packetfence.org/bugs/file_download.php?file_id=134&type=bug
Issue History
Date ModifiedUsernameFieldChange
2012-01-24 15:31obilodeauNew Issue
2012-01-24 15:31obilodeauStatusnew => assigned
2012-01-24 15:31obilodeauAssigned To => obilodeau
2012-01-24 15:32obilodeauRelationship addedrelated to 0000900
2012-01-24 15:33obilodeauDescription Updated
2012-01-25 12:29obilodeauNote Added: 0002547
2012-01-25 14:46obilodeauFile Added: net-appliance-session-disable-begin-privilege-fix-1370.patch
2012-01-25 14:47obilodeauNote Added: 0002548
2012-01-25 14:48obilodeauNote Added: 0002549
2012-01-25 15:18obilodeaumtn revision => 5b3395f89f9fff65ed9bdd165e11a4688f599d73
2012-01-25 15:18obilodeauNote Added: 0002551
2012-01-25 15:18obilodeauStatusassigned => resolved
2012-01-25 15:18obilodeauFixed in Version => trunk
2012-01-25 15:18obilodeauResolutionopen => fixed
2012-01-26 14:29obilodeauNote Added: 0002553
2012-02-28 14:22obilodeauTarget Version+1 => 3.2.0
2012-02-28 14:22obilodeauFixed in Versiontrunk => 3.2.0
2012-02-28 14:31obilodeauNote Added: 0002584
2012-02-28 14:31obilodeauStatusresolved => closed

Notes
(0002547)
obilodeau   
2012-01-25 12:29   
in_privileged_mode() doesn't do a verification on the remote end. It simply reflects the state of what was done with the module so far.
See http://search.cpan.org/~oliver/Net-Appliance-Session-1.36/lib/Net/Appliance/Session/Cookbook/Recipe05.pod [^]

I filed an upstream ticket:
https://github.com/ollyg/Net-Appliance-Session/issues/13 [^]

For now, I'll disable all privileged mode escalation in the code and document that until I hear from what the Net::Appliance guys think about my issue. Anyway, if they fix it upstream and release i'll still have to get the new version packaged up because rpmforge is stuck at 1.36 and there's an API breakage between 1.36 and later.
(0002548)
obilodeau   
2012-01-25 14:47   
workaround to disable all begin_privilege calls patch attached.
(0002549)
obilodeau   
2012-01-25 14:48   
All except Trapeze since by default users get in unprivileged.
(0002551)
obilodeau   
2012-01-25 15:18   
disabled privilege detection in all but trapeze. Once I get upstream's opinion on the issue we'll see what we'll do.

commit contains changes to docs, upgrade, etc. which the attached patch doesn't have.
(0002553)
obilodeau   
2012-01-26 14:29   
oops, yesterday's fix introduced a problem. here's the blurb to fix it:

--- pf/lib/pf/SNMP/Cisco/WLC_2106.pm        7547d8900dbfc841f270d05056f46f3fecb65b88
+++ pf/lib/pf/SNMP/Cisco/WLC_2106.pm        87810d1392683519de0550517bff2af107cbbb36
@@ -86,7 +86,7 @@ sub deauthenticateMac {
         );
         # Session not already privileged are not supported at this point. See 0001370
         #$session->begin_privileged( $this->{_cliEnablePwd} );
-        $session->->do_privileged_mode(0);
+        $session->do_privileged_mode(0);
         $session->begin_configure();
     };
(0002584)
obilodeau   
2012-02-28 14:31   
Fixed in recently released 3.2.0.