FreeBSD hemlock.eden.le-fay.org 14.0-RELEASE-p3 FreeBSD 14.0-RELEASE-p3 #5 releng/14.0-n265398-20fae1e16990: Fri Dec 15 22:12:51 GMT 2023 root@hemlock.eden.le-fay.org:/data/src/obj/data/src/releng/14.0/amd64.amd64/sys/HEMLOCK amd64 kadmin -l crashes in addprinc --random-key: # gdb /usr/bin/kadmin GNU gdb (GDB) 13.2 [GDB v13.2 for FreeBSD] [...] (gdb) run -l Starting program: /usr/bin/kadmin -l kadmin> add --random-key host/thyme.eden.le-fay.org Max ticket life [1 day]:unlimited Max renewable life [1 week]:unlimited Principal expiration time [never]: Password expiration time [never]: Attributes []: Program received signal SIGSEGV, Segmentation fault. Address not mapped to object. 0x0000000000000000 in ?? () (gdb) where #0 0x0000000000000000 in ?? () #1 0x0000000801126e68 in ARCFOUR_string_to_key (context=0x80201a000, enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., opaque=..., key=0x802134958) at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt-arcfour.c:84 #2 0x0000000801127f97 in krb5_string_to_key_data_salt_opaque (enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, salt=..., opaque=..., context=<optimized out>, password=..., key=<optimized out>) at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:201 #3 krb5_string_to_key_data_salt (context=0x80201a000, enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., key=0x802134958) at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:173 #4 0x000000080112817b in krb5_string_to_key_salt (context=0x80204be90, context@entry=0x80201a000, enctype=-13001, password=0x0, password@entry=0x7fffffffd1b0 "ys4tdErYgu", salt=..., key=0x4) at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:225 #5 0x00000008010a93a5 in hdb_generate_key_set_password (context=0x80201a000, principal=<optimized out>, password=password@entry=0x7fffffffd1b0 "ys4tdErYgu", keys=keys@entry=0x7fffffffceb0, num_keys=num_keys@entry=0x7fffffffcea8) at /data/src/releng/14.0/crypto/heimdal/lib/hdb/keys.c:381 #6 0x00000008010939fa in _kadm5_set_keys (context=context@entry=0x80201a140, ent=ent@entry=0x7fffffffcef8, password=0x1 <error: Cannot access memory at address 0x1>, password@entry=0x7fffffffd1b0 "ys4tdErYgu") at /data/src/releng/14.0/crypto/heimdal/lib/kadm5/set_keys.c:51 #7 0x000000080108ea3c in kadm5_s_create_principal (server_handle=0x80201a140, princ=<optimized out>, mask=<optimized out>, password=0x7fffffffd1b0 "ys4tdErYgu") at /data/src/releng/14.0/crypto/heimdal/lib/kadm5/create_s.c:172 #8 0x000000000102b64b in add_one_principal (name=<optimized out>, rand_key=1, rand_password=0, use_defaults=0, password=0x7fffffffd1b0 "ys4tdErYgu", key_data=0x0, max_ticket_life=<optimized out>, max_renewable_life=<optimized out>, attributes=0x0, expiration=<optimized out>, pw_expiration=0x0) at /data/src/releng/14.0/crypto/heimdal/kadmin/ank.c:141 #9 add_new_key (opt=opt@entry=0x7fffffffd600, argc=argc@entry=1, argv=0x802049290, argv@entry=0x802049280) at /data/src/releng/14.0/crypto/heimdal/kadmin/ank.c:243 #10 0x000000000102f1ac in add_wrap (argc=<optimized out>, argv=0x802049280) at kadmin-commands.c:210 #11 0x00000000010349be in sl_command (cmds=<optimized out>, argc=3, argv=0x802049280) at /data/src/releng/14.0/crypto/heimdal/lib/sl/sl.c:209 #12 sl_command_loop (cmds=cmds@entry=0x10388b0 <commands>, prompt=prompt@entry=0x1026cca "kadmin> ", data=<optimized out>) at /data/src/releng/14.0/crypto/heimdal/lib/sl/sl.c:328 #13 0x000000000102e896 in main (argc=<optimized out>, argv=<optimized out>) at /data/src/releng/14.0/crypto/heimdal/kadmin/kadmin.c:275 (gdb) up #1 0x0000000801126e68 in ARCFOUR_string_to_key (context=0x80201a000, enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., opaque=..., key=0x802134958) at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt-arcfour.c:84 84 EVP_DigestUpdate (m, &p, 1); the same request in kadmin without -l causes kadmind to crash. specifying a password instead of using --random-key also crashes.
this seems to be caused by having arcfour-hmac-md5 in the kadmin default_keys list, which is present by default, along with OpenSSL's MD4 not working for some reason: # openssl md4 Error setting digest 00206156FE410000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:/data/src/releng/14.0/crypto/openssl/crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (MD4 : 72), Properties () 00206156FE410000:error:03000086:digital envelope routines:evp_md_init_internal:initialization error:/data/src/releng/14.0/crypto/openssl/crypto/evp/digest.c:254: i fixed the problem by setting 'default_keys = aes256-cts-hmac-sha1-96:pw-salt' in krb5.conf, but this should probably report a useful error instead of crashing. is a patch to fix the error reporting useful, or does this need to go to heimdal upstream first?
Created attachment 247295 [details] patch well, this patch fixes the crash in kadmin/kadmind by returning an error instead: kadmin> add -r host/test.example.org@EXAMPLE.ORG Max ticket life [1 day]: Max renewable life [1 week]: Principal expiration time [never]: Password expiration time [never]: Attributes []: kadmin: kadm5_create_principal: Cannot create digest kadmin: adding host/test.example.org@EXAMPLE.ORG: Cannot create digest kadmin> it doesn't fix the underlying issue with MD4 not being available. the default default_keys should probably be updated to remove arcfour-hmac-md5, since almost nothing requires this nowadays (including Windows).
*** Bug 276257 has been marked as a duplicate of this bug. ***
init DOMAIN.NAME segfaults as well. I was very confused since it's the first attempt to setup KDC. I'm building gdb atm, so probably I'd repeated your analysis, but since I've found this before, thanks for your investigation!
was your original crash with ports heimdal? i thought that wouldn't be affected by this particular issue since it includes its own libhcrypto library which is supposed to replace the missing algorithms in OpenSSL 3.0 libcrypto. i haven't tested that though.
Handbook doesn't mention that security/heimdal is optional and when it tells to install the port and invoke a kadmin, actually the base version is invoked. kadmin from security/heimdal doesn't work as well, init DOMAIN.NAME complains about rc4 instantiation failure and exits. security/krb5 works, but it far more complex software to setup. It even comes without rc.d scripts for some reason.
I believe we fixed this in stable/14 with c7db2e15e4045e1daba939bb151fc5878f791c7b and 17e941a0c88cac2d8cd28d6614448adbd65d4b72. Can you try these, please?
*** This bug has been marked as a duplicate of bug 272835 ***