Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Date: Mon, 28 Nov 2016 09:53:58 +0000 (UTC)
From: "Kai Zheng (JIRA)" <jira@apache.org>
To: dev@directory.apache.org
Message-ID: <JIRA.13023524.1480182650000.376159.1480326838358@Atlassian.JIRA>
In-Reply-To: <JIRA.13023524.1480182650000@Atlassian.JIRA>
References: <JIRA.13023524.1480182650000@Atlassian.JIRA> <JIRA.13023524.1480182650617@arcas>
Subject: [jira] [Commented] (DIRKRB-614) Kerby (simplekdc) fails to handle
 unknown PADATA
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Mon, 28 Nov 2016 09:54:00 -0000


    [ https://issues.apache.org/jira/browse/DIRKRB-614?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15701485#comment-15701485 ] 

Kai Zheng commented on DIRKRB-614:
----------------------------------

If the PADATA is unexpectedly there then the sad thing is it's hard for Kerby to ignore it, as Kerby strictly follows the asn.1 definition in its common asn.1 underlying framework. Before to have a fix, maybe you could work around this by disabling the preauth check?

> Kerby (simplekdc) fails to handle unknown PADATA 
> -------------------------------------------------
>
>                 Key: DIRKRB-614
>                 URL: https://issues.apache.org/jira/browse/DIRKRB-614
>             Project: Directory Kerberos
>          Issue Type: Bug
>    Affects Versions: 1.0.0-RC2
>         Environment: SimpleKDC 
>            Reporter: Bolke de Bruin
>         Attachments: kerb.pcap, kerb_heimdal.pcapng
>
>
> I am using simplekdc wrapped in an application to allow CI for Apache Airflow.
> While testing I found out that on my development system (OS X - Heimdal with MIT Shim) everything worked fine, but when moving over to the CI (MIT) system it stopped working with the following error.
> {code}
> 2016-11-26 17:08:51,974 ERROR [pool-1-thread-3] impl.DefaultKdcHandler: Error occured while processing request:
> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> 	at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> 	at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> 	at org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
> 	at org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
> 	at org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
> 	at org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
> 	at org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
> 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> 	at java.lang.Thread.run(Thread.java:745)
> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0, off=0, len=3+198], expecting 0x30
> 	at org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
> 	at org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
> 	at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> 	... 9 more
> {code}
> Digging in with Wireshark showed that the MIT libraries are sending extra PAData which makes Kerby not respond (Wireshark records this as "Unknown 136"). This behavior can be replicated by using "kvno". 
> Heimdal on OSX does not send this and gets a response.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)