From: Russ Allbery <rra@stanford.edu>
To: rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #4222] GSSAPI context being destroyed when ticket cache renewed
In-Reply-To: <rt-4222-18560.6.85385461877516@krbdev.mit.edu> (Quanah Gibson-Mount via's message of "Fri, 8 Sep 2006 12:08:59 -0400 (EDT)")
Organization: The Eyrie
References: <rt-4222-18560.6.85385461877516@krbdev.mit.edu>
Date: Fri, 08 Sep 2006 14:01:28 -0700
Message-Id: <87odtqcbtj.fsf@windlord.stanford.edu>
User-Agent: Gnus/5.110006 (No Gnus v0.6) XEmacs/21.4.19 (linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
RT-Send-Cc: 
Content-Length: 1284

Quanah Gibson-Mount via RT <rt-comment@krbdev.mit.edu> writes:

> Thanks Simon for the follow-up.  So it sounds like then, the error here
> really is inside cyrus-sasl then?

There is at least *some* error inside Cyrus SASL.  The behavior that we're
seeing (in a different context than the one Quanah originally raised) is
that Cyrus SASL will go into a tight loop inside the library logging
messages about expired contexts without ever returning to the application.
That's clearly broken.  I just haven't been able to find where the
brokenness is yet (mostly because I haven't had a chance to look in
depth).

Whether there's also a separate error in Kerberos is a different question.
It's looking to me like there's actually (arguable) incorrect behavior in
Heimdal, in that once a Kerberos ticket expires, I think a strong argument
can be made that the products of that ticket, such as the session key used
to provide confidentiality, are no longer valid either.

I don't know what that would mean for, say, a version of ssh that did
integrity protection using GSSAPI, though.  Having your login session go
away because your original ticket expired might be technically correct but
sounds rather bad.

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>