Uploaded image for project: 'Directory Kerberos'
  1. Directory Kerberos
  2. DIRKRB-614

Kerby (simplekdc) fails to handle unknown PADATA

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.0.0-RC2
    • Fix Version/s: 1.0.1
    • Component/s: None
    • Labels:
      None
    • Environment:
      SimpleKDC

      Description

      I am using simplekdc wrapped in an application to allow CI for Apache Airflow.

      While testing I found out that on my development system (OS X - Heimdal with MIT Shim) everything worked fine, but when moving over to the CI (MIT) system it stopped working with the following error.

      2016-11-26 17:08:51,974 ERROR [pool-1-thread-3] impl.DefaultKdcHandler: Error occured while processing request:
      org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
      	at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
      	at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
      	at org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
      	at org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
      	at org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
      	at org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
      	at org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      	at java.lang.Thread.run(Thread.java:745)
      Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0, off=0, len=3+198], expecting 0x30
      	at org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
      	at org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
      	at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
      	... 9 more
      

      Digging in with Wireshark showed that the MIT libraries are sending extra PAData which makes Kerby not respond (Wireshark records this as "Unknown 136"). This behavior can be replicated by using "kvno".

      Heimdal on OSX does not send this and gets a response.

        Attachments

        1. kerb.pcap
          5 kB
          Bolke de Bruin
        2. kerb_heimdal.pcapng
          6 kB
          Bolke de Bruin

          Issue Links

            Activity

              People

              • Assignee:
                jiajia Jiajia Li
                Reporter:
                bolke Bolke de Bruin
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: