Hi Max,<br><br>The client was Java in all cases. I've tried with the following combinations:<br><ul><li>Open JDK b133 with JGSS</li><li>Open JDK b133 with MIT native Kerberos</li><li>JDK 6u23 with JGSS</li><li>JDK 6u23with MIT native Kerberos</li>
</ul>The result is always the same:<br><br>Caused by: sun.security.krb5.internal.KrbApErrException: Incorrect net address (38)<br> at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:329) ~[na:na]<br> at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:146) ~[na:na]<br>
at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:108) ~[na:na]<br> at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:761) ~[na:na]<br><br>Regards,<br>
<br>Szabolcs<br>
<br><div class="gmail_quote">On Mon, Mar 28, 2011 at 2:21 PM, Weijun Wang <span dir="ltr"><<a href="mailto:weijun.wang@oracle.com">weijun.wang@oracle.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Sorry for the late reply.<br>
<br>
I suppose your client side program is not in Java? Because in JDK a service ticker's addresses field is always null.<br>
<br>
Thanks<br>
Max<div class="im"><br>
<br>
<br>
<br>
<br>
On 03/25/2011 07:53 PM, Szabolcs Pota wrote:<br>
</div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div class="im">
[+ adding back security-dev]<br>
<br>
Hi Henry,<br>
<br>
Thank you for your reply. My answers are below.<br>
<br>
On Fri, Mar 25, 2011 at 1:26 AM, Henry B. Hotz <<a href="mailto:hbhotz@dslextreme.com" target="_blank">hbhotz@dslextreme.com</a><br></div><div><div></div><div class="h5">
<mailto:<a href="mailto:hbhotz@dslextreme.com" target="_blank">hbhotz@dslextreme.com</a>>> wrote:<br>
<br>
No-list reply since I'm subscribed with an alias which my ISP won't<br>
let me send with.<br>
<br>
On Mar 23, 2011, at 5:16 AM, Szabolcs Pota wrote:<br>
<br>
> Our global krb5.conf files have 'noaddresses=false' for both client<br>
> and server hence we get this exception. Please correct me if someone<br>
> thinks that setting this flag to false on the server side would be<br>
> incorrect.<br>
<br>
There are two issues here. The one you're not looking at is that<br>
that config option is different for every one of the major C<br>
implementations of Kerberos.<br>
<br>
[appdefaults]<br>
no-addresses = true # Heimdal<br>
no_addresses = true # Sun<br>
<br>
[lidefaults]<br>
noaddresses = true # MIT<br>
<br>
I have no idea which of these is understood by Java, though I would<br>
guess the Sun one, and hope that all of them are. Also the default<br>
value varies with the version. AFAIK all now default to disable<br>
address checking.<br>
<br>
<br>
As I've seen in sun.security.krb5.Config#useAddresses() it reads either<br>
the 'noaddresses' or the 'no-addresses' flag and indeed the default is<br>
no-addresses=true. We are using 'noaddresses' that is parsed without<br>
problems by the current code.<br>
<br>
------<br>
<br>
As for what you are actually asking about: almost all of us have<br>
stopped worrying about addresses because the address check does not<br>
work in the real world with ubiquitous NAT and multiple private IP<br>
spaces. (Are you sure you're not running into one of those?) I<br>
personally would not care if Java simply stopped supporting address<br>
checking.<br>
<br>
That may not be an appropriate thing for the universal JGSS<br>
implementation to do though.<br>
<br>
What's *supposed* to happen (without reading the RFC) is the<br>
endpoint gets the IP from the socket for the other end, and compares<br>
it with the appropriate field in the ticket. If they don't match,<br>
then the ticket *may* have been copied and is being injected from<br>
someplace it shouldn't be.<br>
<br>
Since (almost) nobody is using the feature anymore I would actually<br>
be surprised if it works on IPv6 networks. As I said it is<br>
guaranteed to fail if there is a NAT involved.<br>
<br>
-----<br>
<br>
To answer the specific question in the above paragraph, I would say<br>
checking addresses on a server is actually wrong if *any* of the<br>
clients are connecting via VPN, or through your typical home router<br>
box. It can only be guaranteed correct if all clients are on the<br>
same corporate network as the server.<br>
<br>
<br>
I agree with you that checking the client address is error prone and<br>
even the RFC says so. It could be done only on a best effort basis. At<br>
the moment I think that the server should do one of the followings:<br>
<br></div></div>
1. If EncTicketPart.caddr is set then try to get the client IP and<div class="im"><br>
check if it is in the list. If it is not then it *may* throw and<br>
exception.<br></div>
2. Skip the whole no-addresses processing because of the unreliable<div class="im"><br>
client IP check.<br>
<br>
My problem is that the current logic in KrbApReq java does non of these<br>
but throws an Exception. This prevents us using OpenJDK with<br>
'noaddresses=false' in Kerberos configuration.<br>
<br>
Regards,<br>
<br>
Szabolcs<br>
<br>
------------------------------------------------------<br>
The opinions expressed in this message are mine,<br>
not those of Caltech, JPL, NASA, or the US Government.<br></div>
<a href="mailto:Henry.B.Hotz@jpl.nasa.gov" target="_blank">Henry.B.Hotz@jpl.nasa.gov</a> <mailto:<a href="mailto:Henry.B.Hotz@jpl.nasa.gov" target="_blank">Henry.B.Hotz@jpl.nasa.gov</a>>, or<br>
<a href="mailto:hbhotz@oxy.edu" target="_blank">hbhotz@oxy.edu</a> <mailto:<a href="mailto:hbhotz@oxy.edu" target="_blank">hbhotz@oxy.edu</a>><div class="im"><br>
<br>
<br>
<br>
<br>
<br>
<br>
--<br>
Szabolcs Pota<br>
Morgan Stanley | MSJava, EAI (MSSM)<br>
Lechner Odon fasor 8 | Floor 07<br>
Budapest, 1095<br>
Phone: +36 1 881-3979<br>
</div><a href="mailto:Szabolcs.Pota@morganstanley.com" target="_blank">Szabolcs.Pota@morganstanley.com</a> <mailto:<a href="mailto:Szabolcs.Pota@morganstanley.com" target="_blank">Szabolcs.Pota@morganstanley.com</a>><br>
<br>
</blockquote>
</blockquote></div><br><br clear="all"><br>-- <br>Szabolcs Pota<br>Morgan Stanley | MSJava, EAI (MSSM)<br>Lechner Odon fasor 8 | Floor 07<br>Budapest, 1095<br>Phone: +36 1 881-3979<br><a href="mailto:Szabolcs.Pota@morganstanley.com" target="_blank">Szabolcs.Pota@morganstanley.com</a><br>
<br>