Skip Menu |
 

History Show all quoted text — Show full headers
# Wed Feb 25 20:09:08 2004 hartmans (Sam Hartman) - Ticket created
To: krb5-bugs@mit.edu
Subject: Replay cache not used in GSS_C_NO_CREDENTIAL case
From: Sam Hartman <hartmans@MIT.EDU>
Date: Wed, 25 Feb 2004 20:09:03 -0500
Download (untitled) / with headers
text/plain 198B

Apparently the context flags are set incorrectly and the replay cache is not used in the GSS_C_NO_CREDENTIAL case.

I am declaring this bug not a blocker for 1.3.2 although it is fairly
serious.
Download (untitled)
message/rfc822 3.1KiB
Return-Path: <cesarg@ms.com>
Received: from solipsist-nation ([unix socket])
by solipsist-nation (Cyrus v2.1.5-Debian2.1.5-1) with LMTP; Wed, 25 Feb
2004 15:49:47 -0500
X-Sieve: CMU Sieve 2.2
Return-Path: <cesarg@ms.com>
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
[18.7.21.83])
by suchdamage.org (Postfix) with ESMTP id 4BCA7131A2
for <hartmans@suchdamage.org>; Wed, 25 Feb 2004 15:49:47 -0500 (EST)
Received: from pivsbh2.ms.com (pivsbh2.ms.com [199.89.64.104])
by pacific-carrier-annex.mit.edu (8.12.4/8.9.2) with ESMTP id
i1PKni1G024046;
Wed, 25 Feb 2004 15:49:44 -0500 (EST)
Received: from pivsbh2.ms.com (localhost [127.0.0.1])
by localhost.ms.com (Postfix) with SMTP
id 148F073D0; Wed, 25 Feb 2004 15:49:44 -0500 (EST)
Received: from ny16im01.ms.com (unknown [144.14.206.242])
by pivsbh2.ms.com (internal Postfix) with ESMTP
id E9D956D25; Wed, 25 Feb 2004 15:49:43 -0500 (EST)
Received: from limus.ms.com (limus [144.14.15.176])
by ny16im01.ms.com (Sendmail MTA Hub) with ESMTP id i1PKnhu09966;
Wed, 25 Feb 2004 15:49:43 -0500 (EST)
Received: (cesarg@localhost) by limus.ms.com (8.11.6/sendmail.cf.client
v1.05) id i1PKnhF29022; Wed, 25 Feb 2004 15:49:43 -0500
X-Mailer: 21.4 (patch 12) "Portable Code" XEmacs Lucid (via feedmail 10 I);
VM 7.14 under 21.4 (patch 12) "Portable Code" XEmacs Lucid
Message-ID: <16445.2663.303712.613146@limus.ms.com>
Date: Wed, 25 Feb 2004 15:49:43 -0500
From: Cesar Garcia <Cesar.Garcia@morganstanley.com>
To: Sam Hartman <hartmans@MIT.EDU>
Cc: Cesar Garcia <Cesar.Garcia@morganstanley.com>,
Ken Hornstein <kenh@cmf.nrl.navy.mil>, kerberos@MIT.EDU
Subject: Re: Thread-safe libraries
In-Reply-To: <tslznb6udaa.fsf@konishi-polis.mit.edu>
References: <Nikola.Milutinovic@ev.co.yu>
<403C3D04.3080702@ev.co.yu>
<200402251612.i1PGCfg5024634@ginger.cmf.nrl.navy.mil>
<16444.64698.352328.702640@limus.ms.com>
<tslznb6udaa.fsf@konishi-polis.mit.edu>
X-Spam-Status: No, hits=-6.9 required=5.0
tests=BAYES_01,IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,
REPLY_WITH_QUOTES
version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
MIME-Version: 1.0

According to strace ...

1.2.8 app server with named credential - opens an rcache.
1.3.1 app server with no credential - no evidence of rcache being
opened.

wrt to krb5_rd_req - it looks like rcache is obtained only if
auth_context_flags includes KRB5_AUTH_CONTEXT_DO_TIME.

accept_sec_context clearly sets auth_context with
KRB5_AUTH_CONTEXT_DO_SEQUENCE.

What am I missing?

Show quoted text
>>>>> "Sam" == Sam Hartman <hartmans@MIT.EDU> writes:

Show quoted text
>>>>> "Cesar" == Cesar Garcia <Cesar.Garcia@morganstanley.com> writes:
Show quoted text
Cesar> wrt to gssapi and 1.3.1 ...

Show quoted text
Cesar> Since we're pointing out lack of replay cache detection,
Cesar> note that if acquiring creds for GSS_C_NO_NAME, then no
Cesar> replay cache is used. (specifically looking at 1.3.1 -
Cesar> lib/gssapi/krb5/acquire_cred.c)

Show quoted text
Sam> I think that's false. I believe that krb5_rd_req will end up setting
Sam> up a rcache later.

Show quoted text
Sam> I don't have time to go look through the code now though, but I wrote
Sam> it and at least intended that a replay cache would get used even
Sam> though it does not get stored in the GSSAPI credentials structure.
# Wed Feb 25 20:25:06 2004 hartmans (Sam Hartman) - Component krb5-libs added
# Wed Feb 25 20:25:06 2004 hartmans (Sam Hartman) - Given to hartmans (Sam Hartman)
# Wed Feb 25 20:25:25 2004 hartmans (Sam Hartman) - Version_reported 1.3.1 added
# Thu Feb 26 16:48:16 2004 hartmans (Sam Hartman) - Requestor Cesar Garcia <Cesar.Garcia@morganstanley.com> added
# Thu Feb 26 16:52:06 2004 hartmans (Sam Hartman) - Status changed from 'new' to 'open'
# Thu Feb 26 16:52:06 2004 hartmans (Sam Hartman) - Correspondence added
From: hartmans@mit.edu
Subject: CVS Commit
Download (untitled) / with headers
text/plain 253B
Set context flags after calling krb5_rd_req so that the replay cache is set up.


To generate a diff of this commit:



cvs diff -r1.238 -r1.239 krb5/src/lib/gssapi/krb5/ChangeLog
cvs diff -r1.85 -r1.86
krb5/src/lib/gssapi/krb5/accept_sec_context.c
# Thu Mar 11 16:12:04 2004 tlyu (Taylor Yu) - Target_Version 1.3.3 added
# Mon Mar 15 14:44:45 2004 hartmans (Sam Hartman) - Tags pullup added
# Tue Mar 16 16:55:24 2004 tlyu (Taylor Yu) - Comments added
To: rt-comment@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #2284] Replay cache not used in GSS_C_NO_CREDENTIAL case
From: Tom Yu <tlyu@mit.edu>
Date: Tue, 16 Mar 2004 16:55:22 -0500
RT-Send-Cc:
Download (untitled) / with headers
text/plain 337B
More precisely, the explicit setting of KRB5_AUTH_CONTEXT_DO_SEQUENCE
by accept_sec_context() prior to its call of krb5_rd_req() prevents
krb5_rd_req() from setting up the temporary rcache. Setting the flag
clears the default flag KRB5_AUTH_CONTEXT_DO_TIME, which krb5_rd_req()
checks to determine whether to set up a temporary rcache.
# Tue Mar 16 16:58:36 2004 tlyu (Taylor Yu) - Status changed from 'open' to 'resolved'
# Tue Mar 16 16:58:37 2004 tlyu (Taylor Yu) - Version_Fixed 1.3.3 added
# Tue Mar 16 16:58:37 2004 tlyu (Taylor Yu) - Correspondence added
From: tlyu@mit.edu
Subject: CVS Commit
Download (untitled) / with headers
text/plain 211B
pullup from trunk


To generate a diff of this commit:



cvs diff -r1.218.2.17 -r1.218.2.18
krb5/src/lib/gssapi/krb5/ChangeLog
cvs diff -r1.77.2.8 -r1.77.2.9
krb5/src/lib/gssapi/krb5/accept_sec_context.c
# Wed Dec 16 18:02:42 2015 tlyu (Taylor Yu) - CustomField pullup deleted