Since the univention-policy package was rebuild for Bug #57159, one cannot authenticate with a password file that contains a password shorter than 20 characters anymore. If the password is shorter than 20 characters, the result of the read_password_file function will contain garbage at the end. An example for the password "2iYKLXXqT" (gdb) p buffer $4 = 0x555555559600 "2iYKLXXqT\374\364\367\377\177" While with a 20 character password, it will contain the correct password like this (gdb) p buffer $2 = 0x5555555595b0 "FnKICJzppEzSIHR5H1PTUU" This led to 01_base.16_policy-update.test_policy_update_config_registry failing in jenkins. This is not a problem in the vanilla problem, since the univention-policy-result script uses machine.secret and it contains 20 characters as default.
Contrary to my opinion before, the behaviour seems to be completely undefined. We saw problems with passwords of length 20 too. The problems are just happening in some environments, in some not. The observed problem is still, that the password can not be read correctly from a file. What always works is giving the command the password directly instead of a file. Since I can't explain or fix the error right now, but this may create a big impact, I reverted the changes in univention-policy. We should release this today, the jenkins tests were successful and don't show that problematic behaviour anymore. Committed and build yesterday: b16fbf6fc0 (HEAD -> 5.0-7, origin/5.0-7) fixup! Bug #57169: Revert UCR changes, they break LDAP bind for password readability d84eec461b Bug #57169: Revert UCR changes, they break LDAP bind for password readability Successful build Package: univention-policy Version: 11.0.4-2 Branch: ucs_5.0-0 Scope: errata5.0-7
Verified: * Package source code reverted back to state of 5.0-6 (basically 5.0-3) * Reverting changes for Bug #57159 * New package version 11.0.4-2 is installable * Basic test worked (manual and 16_policy-update.py -f) * Advisory: Ok
<https://errata.software-univention.de/#/?erratum=5.0x998>
<man:read(2)> is used to read *binary* data, which may contain NUL; as that the buffer is never *NUL* terminated. If you read a string, you must append the trailing NUL youself. PS: read_password_file() is total overkill to read a password of maximum size "MAX_PASSWORD_SIZE=256" See https://git.knut.univention.de/univention/ucs/-/merge_requests/1134 for cleanup