Re: NegoEx broke GSSAPI in BIND 9

Ondřej Surý <[email protected]> Wed, 20 May 2020 23:52:59 +0200

Newsgroups	gmane.comp.encryption.kerberos.devel
Message-ID	<[email protected]>

Hi Greg,

Actually, my colleague already run git bisect on the repository, and identified the culprit
to be NegoEx (c2ca2f26eaf817a6a7ed42257c380437ab802bd9) and I have just confirmed
that with an independent test, the c088f56a62702a2cc99c26185681efee1555b7fa is still
part of the repository, but I reverted the tree to c2ca2f26eaf817a6a7ed42257c380437ab802bd9~
(commit before NegoEx) and our tests work again.

Going forward to c2ca2f26eaf817a6a7ed42257c380437ab802bd9 makes our tests to be
broken again.  So, actually there is something in the NegoEx implementation that makes
gss_accept_sec_context() in BIND 9 to return with:

20-May-2020 21:49:46.670 failed gss_accept_sec_context: GSSAPI error: Major = Unspecified GSS failure.  Minor code may provide more information, Minor = SPNEGO cannot find mechanisms to negotiate.

I will try to isolate a minimal test case (if I can) tomorrow.

Thanks,
Ondrej
--
Ondřej Surý
[email protected]

> On 20 May 2020, at 18:14, Greg Hudson <[email protected]> wrote:
> 
> Given the error message, my best guess is that this is related to commit
> c088f56a62702a2cc99c26185681efee1555b7fa ("Restrict SPNEGO acceptor
> mechs by cred acquisition").  It should be possible to individually
> revert that commit to confirm.  I still wouldn't really know why it
> caused a regression, though.

_______________________________________________
krbdev mailing list             [email protected]
https://mailman.mit.edu/mailman/listinfo/krbdev

signature.asc (application/pgp-signature, 963 B)