(racoon 816) Re: GSS-API endpoint id modifications?

I appreciate your pointers into the code, but my company policy prohibits me
from looking at Open Source (implementation) code, so I am restricted to
treating racoon as a black box. I can ask questions of the developer
community. I can sniff packets and look at what is on the wire.

My particular question is how the GSSAPI endpoint id is put into SA
attribute 0x4000. From packet sniffing, the attribute buffer contains an
ISO-Latin-1 character string with an extraneous trailing null (the attribute
already has a buffer length -- why have the trailing null?).

However, what I have seen on the wire and what the code is doing/supposed to
do are two separate things, and so I'm asking racoon-ml what the code is
doing.

For creating your own GSS-API attribute 0x4000:
1) Are you taking the default, or the gssapi_id item in racoon.conf and
directly putting that C-string on the wire?
2) Are you putting the default or the gssapi_id item in racoon.conf through
gss_import_name() (using GSS_KRB5_NT_PRINCIPAL_NAME), gss_canonicalize_name,
gss_export_name() and either
   a) using just the name buffer part of the exported name
   b) using the whole exported name (this doesn't seem likely from my wire
sniffs)
3) some other way entirely?

And how do you consume the GSS-API attribute 0x4000 information?
1) Do you use gss_import_name() using GSS_KRB5_NT_PRINCIPAL_NAME?
2) Do you use gss_import_name() using GSS_C_NT_EXPORT_NAME?
(again, this seems unlikely since the wire sniffs would seem to suggest that
you're not putting the whole exported name structure on the wire.)
3) Any string type "sniffing" before doing #1? e.g., to handle UTF-16LE
which Win2000, WinXP, Win2k3 all put on the wire in attribute 0x4000
(Previous responses have suggested that this is not the case.)
4) other?

Thanks for your effort (and patience!),
Nathan Herring
MacBU SDE/Dev

> From: YAMASHITA Yutaka <[email protected]>
> Reply-To: <[email protected]>
> Date: Wed, 20 Oct 2004 13:35:20 +0900
> To: <[email protected]>
> Subject: (racoon 813) Re: GSS-API endpoint id modifications?
> 
> On Tue, 12 Oct 2004 15:45:04 -0700
> "Nathan Herring" <[email protected]> wrote:
> 
>> Does racoon perform any string operations or gss-api name operations on
>> the default endpoint name or the gssapi_id entry in racoon.conf?
>> 
>> I am specifically wondering if there is any canonization going on, e.g.,
>> gss_import_name / gss_canonicalize_name / gss_export_name (and then the
>> name pulled from the NAME_LEN / NAME sections of the exported name
>> structure)?
> 
> 
> Hi,
> 
> I'm not very familiar with GSS-API ,but
> gss_import_name/gss_canonicalize_name/gss_export_name seem
> to be treated in in gssapi.c.
> http://orange.kame.net/dev/cvsweb.cgi/kame/kame/kame/racoon/gssapi.c?rev=1.20
> 
> thanks,
> 
> -- 
> -----------------------------
>    - YAMASHITA Yutaka -
>  Keio Univ. ICS. Teraoka Lab
>  [email protected]
> -----------------------------