[+ adding back security-dev]<br><br>Hi Henry,<br><br>Thank you for your reply. My answers are below.<br><br><div class="gmail_quote">On Fri, Mar 25, 2011 at 1:26 AM, Henry B. Hotz <span dir="ltr"><<a href="mailto:hbhotz@dslextreme.com">hbhotz@dslextreme.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">No-list reply since I'm subscribed with an alias which my ISP won't let me send with.<br>
<div class="im"><br>
On Mar 23, 2011, at 5:16 AM, Szabolcs Pota wrote:<br>
<br>
> Our global krb5.conf files have 'noaddresses=false' for both client<br>
> and server hence we get this exception. Please correct me if someone<br>
> thinks that setting this flag to false on the server side would be<br>
> incorrect.<br>
<br>
</div>There are two issues here. The one you're not looking at is that that config option is different for every one of the major C implementations of Kerberos.<br>
<br>
[appdefaults]<br>
no-addresses = true # Heimdal<br>
no_addresses = true # Sun<br>
<br>
[lidefaults]<br>
noaddresses = true # MIT<br>
<br>
I have no idea which of these is understood by Java, though I would guess the Sun one, and hope that all of them are. Also the default value varies with the version. AFAIK all now default to disable address checking.<br>
<br></blockquote><div><br>As I've seen in sun.security.krb5.Config#useAddresses() it reads either the 'noaddresses' or the 'no-addresses' flag and indeed the default is no-addresses=true. We are using 'noaddresses' that is parsed without problems by the current code.<br>
</div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
------<br>
<br>
As for what you are actually asking about: almost all of us have stopped worrying about addresses because the address check does not work in the real world with ubiquitous NAT and multiple private IP spaces. (Are you sure you're not running into one of those?) I personally would not care if Java simply stopped supporting address checking.<br>
<br>
That may not be an appropriate thing for the universal JGSS implementation to do though.<br>
<br>
What's *supposed* to happen (without reading the RFC) is the endpoint gets the IP from the socket for the other end, and compares it with the appropriate field in the ticket. If they don't match, then the ticket *may* have been copied and is being injected from someplace it shouldn't be.<br>
<br>
Since (almost) nobody is using the feature anymore I would actually be surprised if it works on IPv6 networks. As I said it is guaranteed to fail if there is a NAT involved.<br>
<br>
-----<br>
<br>
To answer the specific question in the above paragraph, I would say checking addresses on a server is actually wrong if *any* of the clients are connecting via VPN, or through your typical home router box. It can only be guaranteed correct if all clients are on the same corporate network as the server.<br>
<br></blockquote><div><br>I agree with you that checking the client address is error prone and even the RFC says so. It could be done only on a best effort basis. At the moment I think that the server should do one of the followings:<br>
<ol><li>If EncTicketPart.caddr is set then try to get the client IP and check if it is in the list. If it is not then it *may* throw and exception.</li><li>Skip the whole no-addresses processing because of the unreliable client IP check.</li>
</ol>My problem is that the current logic in KrbApReq java does non of these but throws an Exception. This prevents us using OpenJDK with 'noaddresses=false' in Kerberos configuration.<br><br>Regards,<br><br>Szabolcs<br>
</div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
------------------------------------------------------<br>
The opinions expressed in this message are mine,<br>
not those of Caltech, JPL, NASA, or the US Government.<br>
<font color="#888888"><a href="mailto:Henry.B.Hotz@jpl.nasa.gov">Henry.B.Hotz@jpl.nasa.gov</a>, or <a href="mailto:hbhotz@oxy.edu">hbhotz@oxy.edu</a><br>
<br>
<br>
<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Szabolcs Pota<br>Morgan Stanley | MSJava, EAI (MSSM)<br>Lechner Odon fasor 8 | Floor 07<br>Budapest, 1095<br>Phone: +36 1 881-3979<br><a href="mailto:Szabolcs.Pota@morganstanley.com" target="_blank">Szabolcs.Pota@morganstanley.com</a><br>
<br>