Subject: [nfsv4] re: more on weak callback authentication

From: [email-masked]
Date: Fri, 31 Oct 2003 14:19:36 -0500 (EST)

[Bruce said]
> Can someone do damage by intercepting callbacks and forging succesful
> replies?  Or does just blocking the callbacks (which krb5 can't do anything
> about) have the same effect already?

I suspect this depends on the server implementation. Blocking the callbacks
would typically, I think, end up with a timeout waiting for the CBRecall
reply. At that point, my server would revoke the delegation. For a fake
successful reply to the CBRecall, the server would wait a while for the
Delegreturn and then do the revoke if the Delegreturn doesn't happen.
(I need to look at my code and see if I "wait forever" in this case.)

It seems to me any difference would be related to how long the server waits
before revoking the delegation?

rick

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Spencer Shepler <[email-masked]>
Date: Fri, 31 Oct 2003 14:46:27 -0600

> (I need to look at my code and see if I "wait forever" in this case.)

This is how the Solaris server behaves.  No response to CB_RECALL ->
revoke.  Response to CB_RECALL but delegation not returned (and no
writes seen by the server for that file -> revoke.

Spencer