ports/188631: net/freeradius3 rlm_krb5 + -X + security/krb5 = fail

[Garrett Wollman]

>Number:         188631
>Category:       ports
>Synopsis:       net/freeradius3 rlm_krb5 + -X + security/krb5 = fail
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 14 22:30:00 UTC 2014
>Closed-Date:
>Last-Modified:
>Originator:     Garrett Wollman
>Release:        FreeBSD 9.2-RELEASE-p3 amd64
>Organization:
MIT Computer Science & Artificial Intelligence Laboratory
>Environment:
System: FreeBSD truechimer.csail.mit.edu 9.2-RELEASE-p3 FreeBSD 9.2-RELEASE-p3 #3 r260650M: Tue Jan 14 17:08:30 EST 2014 wollman at xyz.csail.mit.edu:/usr/obj/usr/src/sys/CSAIL amd64

freeradius3-3.0.2_1            A free RADIUS server implementation
krb5-1.12.1                    Authentication system developed at MIT, successor to Kerberos IV

Options:
OPTIONS_FILE_SET+=DEVELOPER
OPTIONS_FILE_UNSET+=EDIR
OPTIONS_FILE_UNSET+=EXPERIMENTAL
OPTIONS_FILE_UNSET+=FIREBIRD
OPTIONS_FILE_UNSET+=FREETDS
OPTIONS_FILE_UNSET+=HEIMDAL
OPTIONS_FILE_UNSET+=HEIMDAL_PORT
OPTIONS_FILE_UNSET+=IDN
OPTIONS_FILE_SET+=KERBEROS
OPTIONS_FILE_UNSET+=LDAP
OPTIONS_FILE_UNSET+=MYSQL
OPTIONS_FILE_SET+=PERL
OPTIONS_FILE_SET+=PGSQL
OPTIONS_FILE_UNSET+=PYTHON
OPTIONS_FILE_UNSET+=REDIS
OPTIONS_FILE_UNSET+=REST
OPTIONS_FILE_UNSET+=RUBY
OPTIONS_FILE_SET+=SSL_PORT
OPTIONS_FILE_UNSET+=UDPFROMTO
OPTIONS_FILE_UNSET+=UNIXODBC
OPTIONS_FILE_SET+=USER

>Description:

When using rlm_krb5 to check passwords inside an EAP-TTLS tunnel, if a
user attempts to authenticate using an incorrect password, the server
crashes.  This happens whether or not rlm_krb5 is compiled with
KRB5_IS_THREAD_SAFE.

Apparently the rlm_krb5 code was never properly tested with MIT
Kerberos, and is missing a goto for error recovery (which is present
in the Heimdal version of the code, in the other branch of the giant
#ifdef block).

>How-To-Repeat:

Configure rlm_krb5 so that it works when password is correct, then
supply an incorrect password.

>Fix:

I added this patch to the port.  Unfortunately the freeradius bug
tracker requires an account, and their mailing-list server is
unreachable.

--- src/modules/rlm_krb5/rlm_krb5.c.orig	2014-04-14 18:02:22.083233370 -0400
+++ src/modules/rlm_krb5/rlm_krb5.c	2014-04-14 18:03:11.530236104 -0400
@@ -457,6 +457,7 @@
 					   NULL, NULL, 0, NULL, inst->gic_options);
 	if (ret) {
 		rcode = krb5_process_error(request, conn, ret);
+		goto cleanup;
 	}
 
 	RDEBUG("Attempting to authenticate against service principal");
>Release-Note:
>Audit-Trail:
>Unformatted: