Skip Menu |
 

History Show all quoted text — Show full headers
# Wed Nov 29 11:18:28 2006 tlyu (Taylor Yu) - Ticket created
Subject: gc_frm_kdc doesn't adjust use_conf_ktypes in referrals case
Download (untitled) / with headers
text/plain 514B
If krb5_get_creds_from_kdc_opt() gets the final service ticket during referrals processing, it
does so with use_conf_ktypes = 1. This may be undesirable, as the application may have
requested to override the config file enctypes. The problem is that the referrals code should set
use_conf_ktypes = 1 when getting TGTs. There may need to be an explicit check to see if the
returned service ticket contains enctypes not requested by the application, and if so, to repeat
the request with use_conf_ktypes = 0.
# Wed Nov 29 11:18:45 2006 tlyu (Taylor Yu) - Ticket 4950 RefersTo ticket 2652.
# Fri Jan 12 17:45:19 2007 tlyu (Taylor Yu) - Target_Version 1.6 changed to 1.7
# Sun Apr 29 13:36:11 2007 hartmans (Sam Hartman) - Ticket #5550: - Ticket created
From: Sam Hartman <hartmans@MIT.EDU>
To: krb5-bugs@MIT.EDU
Subject: krb5_set_default_tgs_enctypes does not work in Kerberos 1.6
Date: Sun, 29 Apr 2007 13:35:57 -0400
Download (untitled) / with headers
text/plain 1022B


gss_set_allowable_enctypes eventually ends up causing
krb5_set_default_tgs_enctypes to be called on a krb5_context.

We've been seeing a problem on Debian for 1.6 and 1.6.1 where the NFS
rpc.gssd ends up with an aes context even though it only supports a
des context and requests same by calling gss_set_allowable_enctypes.


I walked through this in gdb and found that while tgs_ktypes is
getting set in the context passed into krb5_get_credentials it is not
being respected. The credentials coming back from
krb5_get_credentials are (in my case) aes. The request to the KDC
includes all the enctypes.

I suspect the referrals code interacts badly with use_conf_ktypes or
something like that.

I actually don't see how referrals could work well with
use_conf_ktypes because I think they have conflicting requirements.
Before fixing this bug it is important to first understand what is
going on and second have a discussion on krbdev about what should
happen instead. I don't think this will be a simple fix.

--Sam
# Sun Apr 29 13:42:14 2007 hartmans (Sam Hartman) - Ticket #5550: - Target_Version 1.6.2 added
# Sun Apr 29 21:22:27 2007 tlyu (Taylor Yu) - Ticket #5550: - Correspondence added
To: rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #5550] krb5_set_default_tgs_enctypes does not work in Kerberos 1.6
From: Tom Yu <tlyu@MIT.EDU>
Date: Sun, 29 Apr 2007 21:22:17 -0400
RT-Send-Cc:
Download (untitled) / with headers
text/plain 228B
This looks like a duplicate of ticket #4950. I think what we want to
do is if we get a final ticket via referrals with an enctype not in
the restricted application-requested set, retry with
use_conf_ktypes=old_use_conf_ktypes.
# Mon Apr 30 04:07:32 2007 hartmans (Sam Hartman) - Ticket #5550: - Correspondence added
From: Sam Hartman <hartmans@mit.edu>
To: rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #5550] krb5_set_default_tgs_enctypes does not work in Kerberos 1.6
Date: Mon, 30 Apr 2007 04:07:27 -0400
RT-Send-Cc:
Download (untitled) / with headers
text/plain 207B
You need to somehow order the enctypes though so that enctypes that
end up in the restricted application set come first (and in their
order) when using conf_ktypes.

If you do that, this sounds reasonable.
# Mon Apr 30 12:29:32 2007 tlyu (Taylor Yu) - Ticket #5550: - Correspondence added
To: rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #5550] krb5_set_default_tgs_enctypes does not work in Kerberos 1.6
From: Tom Yu <tlyu@MIT.EDU>
Date: Mon, 30 Apr 2007 12:29:22 -0400
RT-Send-Cc:
Download (untitled) / with headers
text/plain 407B
Show quoted text
>>>>> "Sam" == Sam Hartman via RT <rt-comment@krbdev.mit.edu> writes:

Show quoted text
Sam> You need to somehow order the enctypes though so that enctypes that
Sam> end up in the restricted application set come first (and in their
Sam> order) when using conf_ktypes.

Show quoted text
Sam> If you do that, this sounds reasonable.

Are you suggesting this as an alternative to repeating the request for
the final ticket using conf_ktypes=0?
# Tue May 01 12:17:20 2007 hartmans (Sam Hartman) - Ticket #5550: - Correspondence added
From: Sam Hartman <hartmans@mit.edu>
To: rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #5550] krb5_set_default_tgs_enctypes does not work in Kerberos 1.6
Date: Tue, 01 May 2007 12:16:36 -0400
RT-Send-Cc:
Download (untitled) / with headers
text/plain 669B
Show quoted text
>>>>> "Tom" == Tom Yu via RT <rt-comment@krbdev.mit.edu> writes:

Show quoted text
>>>>> "Sam" == Sam Hartman via RT <rt-comment@krbdev.mit.edu> writes:
Show quoted text
Sam> You need to somehow order the enctypes though so that
Sam> enctypes that end up in the restricted application set come
Sam> first (and in their order) when using conf_ktypes.

Show quoted text
Sam> If you do that, this sounds reasonable.

Show quoted text
Tom> Are you suggesting this as an alternative to repeating the
Tom> request for the final ticket using conf_ktypes=0?


No, in addition to. If the final result is one of the applications
enctypes you need to make sure that the right enctype was chosen.
That depends on ordering.
# Mon May 14 16:52:21 2007 tlyu (Taylor Yu) - Ticket #5550: - Ticket 5550 MergedInto ticket 4950.
# Mon May 14 18:58:51 2007 tlyu (Taylor Yu) - Status changed from 'new' to 'open'
# Mon May 14 18:58:51 2007 tlyu (Taylor Yu) - Given to tlyu (Taylor Yu)
# Mon May 14 18:58:52 2007 tlyu (Taylor Yu) - Version_reported 1.6 added
# Mon May 14 18:58:52 2007 tlyu (Taylor Yu) - Target_Version 1.7 changed to 1.6.2
# Thu Jul 05 15:23:41 2007 tlyu (Taylor Yu) - Target_Version 1.6.2 changed to 1.6.3
# Fri Aug 03 17:16:25 2007 tlyu (Taylor Yu) - Status changed from 'open' to 'resolved'
# Fri Aug 03 17:16:25 2007 tlyu (Taylor Yu) - Tags pullup added
# Fri Aug 03 17:16:25 2007 tlyu (Taylor Yu) - Correspondence added
From: tlyu@mit.edu
Subject: SVN Commit
Download (untitled) / with headers
text/plain 352B
Based on Apple's patch, during the referrals loop, check to see if the
session key enctype of a returned credential for the final service is
among the enctypes explicitly selected by the application, and retry
with old_use_conf_ktypes if it is not.


Commit By: tlyu



Revision: 19748
Changed Files:
_U trunk/
U trunk/src/lib/krb5/krb/gc_frm_kdc.c
# Fri Aug 03 20:30:53 2007 tlyu (Taylor Yu) - Version_Fixed 1.6.3 added
# Fri Aug 03 20:30:54 2007 tlyu (Taylor Yu) - Correspondence added
From: tlyu@mit.edu
Subject: SVN Commit
Download (untitled) / with headers
text/plain 409B
back-port r19748 from trunk

Based on Apple's patch, during the referrals loop, check to see if the
session key enctype of a returned credential for the final service is
among the enctypes explicitly selected by the application, and retry
with old_use_conf_ktypes if it is not.


Commit By: tlyu



Revision: 19751
Changed Files:
_U branches/krb5-1-6/
U branches/krb5-1-6/src/lib/krb5/krb/gc_frm_kdc.c
# Wed Dec 16 18:02:48 2015 tlyu (Taylor Yu) - CustomField pullup deleted