Ticket History #684: There is a possible infinite loop when ftpd sends replies

From fcusack@ratbert.iconnet.net Fri Jan 22 18:41:11 1999
Received: from MIT.EDU (SOUTH-STATION-ANNEX.MIT.EDU [18.72.1.2]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id SAA26062 for <bugs@RT-11.MIT.EDU>; Fri, 22 Jan 1999 18:41:10 -0500
Received: from ratbert.iconnet.net by MIT.EDU with SMTP
id AA09391; Fri, 22 Jan 99 18:40:54 EST
Received: (from fcusack@localhost)
by ratbert.iconnet.net (8.9.1/8.9.1) id SAA03140;
Fri, 22 Jan 1999 18:42:52 -0500 (EST)
Message-Id: <199901222342.SAA03140@ratbert.iconnet.net>
Date: Fri, 22 Jan 1999 18:42:52 -0500 (EST)
From: fcusack@iconnet.net
Reply-To: fcusack@iconnet.net
To: krb5-bugs@MIT.EDU
Cc: fcusack@iconnet.net
Subject: infinite error loop in ftpd
X-Send-Pr-Version: 3.99

Qwest Comm.
Unix
System: SunOS ratbert 5.6 Generic_105181-09 sun4u sparc SUNW,Ultra-5_10
Architecture: sun4

If certain errors occur during reply(), it calls itself again,
which will probably generate the same errors, calling itself
again, ...

This patch is against -current from 10/12/1998; if the gssapi
or ftpd has changed since then they probably won't apply cleanly.
Index: ftpd.c
===================================================================
RCS file: /icon/d04/src/3rd-party/krb5-19981012/src/appl/gssftp/ftpd/ftpd.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 ftpd.c
--- ftpd.c 1998/10/14 00:47:31 1.1.1.1
+++ ftpd.c 1999/01/22 23:38:00
@@ -1619,13 +1619,19 @@
&in_buf, &conf_state,
&out_buf);
if (maj_stat != GSS_S_COMPLETE) {
+#if 0
+/* Don't setup an infinite loop */
/* generally need to deal */
secure_gss_error(maj_stat, min_stat,
(clevel==PROT_P)?
"gss_seal ENC didn't complete":
"gss_seal MIC didn't complete");
+#endif /* 0 */
} else if ((clevel == PROT_P) && !conf_state) {
+#if 0
+/* Don't setup an infinite loop */
secure_error("GSSAPI didn't encrypt message");
+#endif /* 0 */
} else {
memcpy(out, out_buf.value,
length=out_buf.length);
@@ -2511,12 +2517,15 @@
reply(code, "GSSAPI error: %s", s);
}

+#if 0
+/* Only called from reply, which would setup a loop */
secure_gss_error(maj_stat, min_stat, s)
OM_uint32 maj_stat, min_stat;
char *s;
{
return reply_gss_error(535, maj_stat, min_stat, s);
}
+#endif /* 0 */


#include <krb5.h>

Responsible-Changed-From-To: krb5-unassigned->tlyu
Responsible-Changed-By: tlyu
Responsible-Changed-When: Thu Feb 25 23:32:40 1999
Responsible-Changed-Why:

refiled

State-Changed-From-To: Open-closed
State-Changed-By: tlyu
State-Changed-When: Thu Feb 25 23:34:21 1999
State-Changed-Why:

applied


From: Tom Yu <tlyu@MIT.EDU>
To: fcusack@iconnet.net
Cc: krb5-bugs@MIT.EDU, fcusack@iconnet.net
Subject: Re: krb5-appl/684: There is a possible infinite loop when ftpd sends replies
Date: Thu, 25 Feb 1999 23:34:14 -0500 (EST)

Thanks for the report. I've applied your patch with a few changes;
you can't get rid of secure_gss_error() though, because something in
secure.c needs it.

---Tom