Subject: RE: Pending OpenSSH release: contains Kerberos/GSSAPI changes

From: "Wachdorf, Daniel R" <[email-masked]>
Date: Fri, 30 Jan 2004 16:57:29 -0700

Here is a patch.  it was based of the 2004-12-24 snapshot (I had trouble
getting todays to compile).

*** ../openssh/gss-serv.c       Mon Nov 17 04:18:22 2003
--- gss-serv.c  Fri Jan 30 16:35:24 2004
***************
*** 117,124 ****
         * we flag the user as also having been authenticated
         */

!       if (((flags == NULL) || ((*flags & GSS_C_MUTUAL_FLAG) &&
!           (*flags & GSS_C_INTEG_FLAG))) && (ctx->major == GSS_S_COMPLETE))
{
                if (ssh_gssapi_getclient(ctx, &gssapi_client))
                        fatal("Couldn't convert client name");
        }
--- 117,123 ----
         * we flag the user as also having been authenticated
         */

!       if(ctx->major == GSS_S_COMPLETE) {
                if (ssh_gssapi_getclient(ctx, &gssapi_client))
                        fatal("Couldn't convert client name");
        }

-dan

-----Original Message-----
From: Ben Lindstrom [mailto:[email-masked]] 
Sent: Friday, January 30, 2004 4:11 PM
To: Wachdorf, Daniel R
Cc: 'Sam Hartman'; 'Jeffrey Hutzelman'; [email-masked]; [email-masked];
[email-masked]; [email-masked]; OpenSSH Devel List
Subject: RE: Pending OpenSSH release: contains Kerberos/GSSAPI changes

On Fri, 30 Jan 2004, Wachdorf, Daniel R wrote:

> Well,
>
> It could be a problem. If someone has implemented a client and doesn't do
								^^^^^^^^^^
> mutual auth (as the standard says they should), they could be broken.
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This right here is the key to me.  If someone is not following the RFC.
Then I say let them complaint to their vendor.

Again I ask.. As the code stands are *WE* in RFC compliance?  If not we
need it fixed.

As for what to base it off of.  Pick a recent snapshot.  Not as if the
GSSAPI-WITH-MIC code has drasticly changed in the last few days.

- Ben

---

From: Simon Wilkinson <[email-masked]>
Date: Sat, 31 Jan 2004 00:42:32 +0000

Daniel,

My personal belief is that its too late in this release cycle to make 
this change. As the author of the GSSAPI code in OpenSSH, I completely 
accept your comments - we're not (currently) RFC compliant. However, I'm 
aware of a number of vendors who have successfully performed interop 
testing against the current code base. Given the extremely short 
timelines to release, I'd rather delay a change of this nature until we 
have more time to evaluate and test it.

Cheers,

Simon.