(racoon 826) Re: GSS-API endpoint id modifications?

Hi,

GSSAPI code was implemented by Frank van der Linden <[email protected]> 
and commitied and maintained by Jason Thorpe <[email protected]>
, so you should ask them

thanks


On Wed, 20 Oct 2004 08:07:04 -0700
"Nathan Herring" <[email protected]> wrote:

> I appreciate your pointers into the code, but my company policy prohibits me
> from looking at Open Source (implementation) code, so I am restricted to
> treating racoon as a black box. I can ask questions of the developer
> community. I can sniff packets and look at what is on the wire.
> 
> My particular question is how the GSSAPI endpoint id is put into SA
> attribute 0x4000. From packet sniffing, the attribute buffer contains an
> ISO-Latin-1 character string with an extraneous trailing null (the attribute
> already has a buffer length -- why have the trailing null?).
> 
> However, what I have seen on the wire and what the code is doing/supposed to
> do are two separate things, and so I'm asking racoon-ml what the code is
> doing.
> 
> For creating your own GSS-API attribute 0x4000:
> 1) Are you taking the default, or the gssapi_id item in racoon.conf and
> directly putting that C-string on the wire?
> 2) Are you putting the default or the gssapi_id item in racoon.conf through
> gss_import_name() (using GSS_KRB5_NT_PRINCIPAL_NAME), gss_canonicalize_name,
> gss_export_name() and either
>    a) using just the name buffer part of the exported name
>    b) using the whole exported name (this doesn't seem likely from my wire
> sniffs)
> 3) some other way entirely?
> 
> And how do you consume the GSS-API attribute 0x4000 information?
> 1) Do you use gss_import_name() using GSS_KRB5_NT_PRINCIPAL_NAME?
> 2) Do you use gss_import_name() using GSS_C_NT_EXPORT_NAME?
> (again, this seems unlikely since the wire sniffs would seem to suggest that
> you're not putting the whole exported name structure on the wire.)
> 3) Any string type "sniffing" before doing #1? e.g., to handle UTF-16LE
> which Win2000, WinXP, Win2k3 all put on the wire in attribute 0x4000
> (Previous responses have suggested that this is not the case.)
> 4) other?
> 
> Thanks for your effort (and patience!),
> Nathan Herring
> MacBU SDE/Dev
> 
> > From: YAMASHITA Yutaka <[email protected]>
> > Reply-To: <[email protected]>
> > Date: Wed, 20 Oct 2004 13:35:20 +0900
> > To: <[email protected]>
> > Subject: (racoon 813) Re: GSS-API endpoint id modifications?
> > 
> > On Tue, 12 Oct 2004 15:45:04 -0700
> > "Nathan Herring" <[email protected]> wrote:
> > 
> >> Does racoon perform any string operations or gss-api name operations on
> >> the default endpoint name or the gssapi_id entry in racoon.conf?
> >> 
> >> I am specifically wondering if there is any canonization going on, e.g.,
> >> gss_import_name / gss_canonicalize_name / gss_export_name (and then the
> >> name pulled from the NAME_LEN / NAME sections of the exported name
> >> structure)?
> > 
> > 
> > Hi,
> > 
> > I'm not very familiar with GSS-API ,but
> > gss_import_name/gss_canonicalize_name/gss_export_name seem
> > to be treated in in gssapi.c.
> > http://orange.kame.net/dev/cvsweb.cgi/kame/kame/kame/racoon/gssapi.c?rev=1.20
> > 
> > thanks,
> > 
> > -- 
> > -----------------------------
> >    - YAMASHITA Yutaka -
> >  Keio Univ. ICS. Teraoka Lab
> >  [email protected]
> > -----------------------------
> 


-- 
-----------------------------
   - YAMASHITA Yutaka -    
 Keio Univ. ICS. Teraoka Lab 
 [email protected]
-----------------------------