[JBoss JIRA] (ELY-1472) [native kerberos] setting channelBinding of gssContext when not used
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-1472?page=com.atlassian.jira.plugin.s... ]
Jan Kalina closed ELY-1472.
---------------------------
Resolution: Rejected
Fixing patch of JDK in ELY-283:
https://issues.jboss.org/secure/attachment/12429366/jkalina-openjdk-nativ...
Closing this, as this is not Elytron issue actually.
> [native kerberos] setting channelBinding of gssContext when not used
> --------------------------------------------------------------------
>
> Key: ELY-1472
> URL: https://issues.jboss.org/browse/ELY-1472
> Project: WildFly Elytron
> Issue Type: Bug
> Components: SASL
> Affects Versions: 1.2.0.Beta11
> Reporter: Jan Kalina
> Assignee: Jan Kalina
> Labels: kerberos
>
> Gs2SaslServer: gssContext's channelBinding setting leads to error when native Kerberos is used.
> This lead to following error when using native Kerberos library:
> {code}
> [GSSLibStub_acceptContext] before2: pCred=35810112, pContext=0
> [GSSLibStub_acceptContext] before3: inToken.length=515
> [GSSLibStub_acceptContext] after: pCred=35810112, pContext=0, pDelegCred=0
> [GSSLibStub_acceptContext] after2: major=262144, GSS_ERROR(major)=262144 minor=12
> [GSSLibStub_acceptContext] acceptSecContext JK Status major/minor = 40000/12
> c/r/s = 0/4/0
> {code}
> Which mean routine error 4 has occurred, which is GSS_S_BAD_BINDINGS - Incorrect channel bindings were supplied.
> This is fixed when I change cb (in native) to GSS_C_NO_CHANNEL_BINDINGS - equivalent of setting null into channelBinding in gssContext.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years
[JBoss JIRA] (ELY-283) Investigate Elytron and gssproxy interoperability
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-283?page=com.atlassian.jira.plugin.sy... ]
Jan Kalina commented on ELY-283:
--------------------------------
For needs of OpenJDK patch review I has prepared simple reproducer without AS: [^reproducer-gss.zip]
{panel}
Hi, I was just able to prepare usable reproducer (attaching in ZIP file) and fixing patch of JDK (attaching too).
Before I was able to make my usecase working, I has found second issue too - I has included it too.
Issues and their reproducing:
*1) already described problem of wrong initialized SunNativeProvider.INSTANCE*
This can be reproduced by recreating GSSManager before createGSSContext - ProviderList.factories
will be initialized as part of initSecContext/acceptSecContext which will cause using wrong initialized
SunNativeProvider.INSTANCE and described exception.
*2) when channel binding is used SIGSEGV occure*
This can be reproduced by setting channel binding without initAddr/acceptAddr.
This is caused by sending uninitialized (with random length) cb->initiator_address from JDK to the kerberos.
(It is used by krb library for messages checksum calculation even when addrtype is GSS_C_AF_NULLADDR.)
Attached reproducer-gss.zip reproduces both issues and attached patch fixes both.
I would welcome merging into OpenJDK. (I am covered by OCA of Red Hat)
This issue affect both tested JDKs, JKD8u121 and upstream JDK9 from mercurial master.
Thanks,
Jan
{panel}
> Investigate Elytron and gssproxy interoperability
> -------------------------------------------------
>
> Key: ELY-283
> URL: https://issues.jboss.org/browse/ELY-283
> Project: WildFly Elytron
> Issue Type: Task
> Components: SASL
> Reporter: Peter Skopek
> Assignee: Jan Kalina
> Fix For: 2.0.0.Alpha1
>
> Attachments: jkalina-openjdk-native-gss.patch, openjdk-patch-native-mechs.patch, reproducer-gss.zip
>
>
> Investigate Elytron and gssproxy interoperability.
> https://fedorahosted.org/gss-proxy/
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years