Bug 569472

Description of problem:

Using /usr/kerberos/sbin/ftpd as ftp server with xinited without using the option "-a", the ftpd process will segfault if a non-existent user is passed.

Version-Release number of selected component (if applicable):

krb5-workstation-1.6.1-36.el5_4.1

How reproducible:

Always

Steps to Reproduce:

1. Configure gssftp with xinited:

   # vi /etc/xinetd.d/gssftp
   service ftp
   {
        disable = no
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/kerberos/sbin/ftpd
        server_args     = -l
        log_on_failure  += USERID
   }

   Note: Change "disable = yes" to "disable = no"
         Change "server_args = -a -l" to "server_args = -l"

2. Start or restart xinited

   # service xinetd restart
   Stopping xinetd:                                           [  OK  ]
   Starting xinetd:                                           [  OK  ]

3. Try to login via ftp using a non-existent login

   # ftp localhost
  
Actual results:

    # ftp localhost
    Connected to rhel54-64.
    220 rhel54-64 FTP server (Version 5.60) ready.
    334 Using authentication type GSSAPI; ADAT must follow
    GSSAPI accepted as authentication type
    GSSAPI error major: Unspecified GSS failure.  Minor code may provide more information
    GSSAPI error minor: Unknown code krb5 195
    GSSAPI error: initializing context
    GSSAPI authentication failed
    334 Using authentication type KERBEROS_V4; ADAT must follow
    KERBEROS_V4 accepted as authentication type
    Kerberos V4 krb_mk_req failed: You have no tickets cached
    Name (localhost:root): dummytest
    331 Password required for dummytest.
    Password:
    421 Service not available, remote server has closed connection
    Login failed.
    No control connection for command: No such file or directory
    ftp> 

=> Note "remote server has closed connection" and immediate return, the ftpd process has segfaulted thus closing the connection instantly.

On x86_64, this can be seen in the log as well:

    Mar  1 14:15:56 rhel54-64 ftpd[21764]: connection from 127.0.0.1 (rhel54-64) at Mon Mar  1 14:15:56 2010 
    Mar  1 14:15:56 rhel54-64 xinetd[21761]: START: ftp pid=21764 from=127.0.0.1
    Mar  1 14:16:01 rhel54-64 kernel: ftpd[21764]: segfault at 0000000000000000 rip 00002b59d002411d rsp 00007fff1d625570 error 4
    Mar  1 14:16:01 rhel54-64 xinetd[21761]: EXIT: ftp signal=11 pid=21764 duration=5(sec)


Expected results:

    # ftp localhost
    Connected to rhel54-64.
    220 rhel54-64 FTP server (Version 5.60) ready.
    334 Using authentication type GSSAPI; ADAT must follow
    GSSAPI accepted as authentication type
    GSSAPI error major: Unspecified GSS failure.  Minor code may provide more information
    GSSAPI error minor: Unknown code krb5 195
    GSSAPI error: initializing context
    GSSAPI authentication failed
    334 Using authentication type KERBEROS_V4; ADAT must follow
    KERBEROS_V4 accepted as authentication type
    Kerberos V4 krb_mk_req failed: You have no tickets cached
    Name (localhost:root): dummytest
    331 Password required for dummytest.
    Password:

[... 5 seconds wait ...]

    530 Login incorrect.
    Login failed.
    Remote system type is UNIX.
    Using binary mode to transfer files.

=> No segfault of ftpd

Additional info:

This is caused by the code added by the patch "krb5-1.6.1-pam.patch" (ie the problem is not upstream).

2 problems:

1. in user() from ftpd.c, line 812 appl_pam_acct_mgmt() uses pw->pw_name without checking if pw is null:

     739         pw = sgetpwnam(name);
     740         if (pw) {
     741                 if ((shell = pw->pw_shell) == NULL || *shell == 0)
     742                         shell = "/bin/sh";
         [...]
     762         }
     763 
         [...]
     810 #ifdef USE_PAM
     811                 if (appl_pam_enabled(kcontext, "ftpd")) {
     812                         if (appl_pam_acct_mgmt(FTP_PAM_SERVICE, 0,
     813                                                pw->pw_name, "",
     814                                                hostname,
     815                                                NULL,
     816                                                FTP_PAM_SERVICE) != 0) {
     817                                 reply(530, "Login incorrect.");
     818                                 return;
     819                         }
     820                 }
     821 #endif


2. in pass() from ftpd.c, a but more tricky, a missing parenthesis prevents gdb from optimizing the test and therefore evaluates the second part of the OR even if pw == NULL:

    1096                 if ((pw == NULL) ||
    1097 #ifdef USE_PAM
    1098                     appl_pam_enabled(kcontext, "ftpd") ?
    1099                     (appl_pam_authenticate(FTP_PAM_SERVICE, 0,
    1100                                            pw->pw_name, passwd,
    1101                                            hostname,
    1102                                            NULL,
    1103                                            FTP_PAM_SERVICE) != 0) :
    1104 #endif
    1105                     (!kpass(pw->pw_name, passwd) &&
    1106                      (want_creds ||
    1107                       !*pw->pw_passwd ||
    1108                       strcmp(xpasswd, pw->pw_passwd)))) {

Proposed patch attached.