Subject: [nfsv4] GSS kerberos

From: SaNtosh kuLkarni <[email-masked]>
Date: Tue, 18 Jun 2013 20:01:35 +0530

Hi,

I have doubt regarding the GSS implemention in nfsv4.

For the wrap and unwrap of message.I suppose the encryption and decryption
keys are initialization
from the gss context on the client and server.

1. I have few doubts for encryption and decryption should the  struct
krb5_keyblock    kc_keye;
be same on both client and server.

2. Is it possible  for either client or server to install wrong context
(due to improper context upcall handling ) (and hence wrong crypto keys to
be initialized on either server or client side).

Once such scenario would be client using kc_keye  to wrap messages and may
be for the server has wrong context installed and hence wrong crypto keys
initialized which results in wrong decryption of client messages.

-- 
*Regards,
Santosh*

---

From: Nico Williams <[email-masked]>
Date: Thu, 20 Jun 2013 11:35:26 -0500

> be same on both client and server.

There are separate keys for each direction.  The client and server
have to agree on those keys, otherwise nothing works.

> 2. Is it possible  for either client or server to install wrong context (due
> to improper context upcall handling ) (and hence wrong crypto keys to be
> initialized on either server or client side).

Only as a result of a bug.

> initialized which results in wrong decryption of client messages.

The wrap tokens include integrity protection.  If you use the wrong
gss context (keys) to unwrap a token the operation should fail
outright, and you will not get incorrect plaintext back.

Nico
--

---

From: SaNtosh kuLkarni <[email-masked]>
Date: Fri, 21 Jun 2013 12:58:28 +0530

Thanks for the quick reply Nico

The GSS module as such uses Sunrpc  cache management,upcall and downcall
features, it worked fine for RHEL5 but later on since RHEL6 the cache_check
for rsi upcalls to user space gss daemon  fail with ETIMEDOUT error
returns.(which probably might be causing context mismatches on clients and
servers.)

Would be great if you could share your  insight in any specific changes in
sunrpc upcall or cache_check feature from RHEL5 to 6,if you are aware of it.

Regards
Santosh

On Thu, Jun 20, 2013 at 10:05 PM, Nico Williams <[email-masked]>wrote:

> (due

-- 
*Regards,
Santosh*