[OpenAFS] Re: Mystery AFS/Kerberos packet
Kevin Coffman
kwc at citi.umich.edu
Fri Jan 23 10:26:23 EST 2004
It's a bit fuzzy now, but I recall a problem with the IBM Windows client a
couple (or more) years ago that required swapping out the authentication DLL
if you were not talking to a kaserver. If you are only seeing this on IBM
clients, that may be your problem. I _do_ remember that it manifested
itself with this kind of error (what looks like a mangled K4 packet). If
you think this may be the case, I'll look back through my mail to find the
specifics.
-----Original Message-----
From: openafs-info-admin at openafs.org [mailto:openafs-info-admin at openafs.org]
On Behalf Of John Hascall
Sent: Friday, January 23, 2004 10:05 AM
To: Jeffrey Altman
Cc: openafs-info at openafs.org; kerberos at mit.edu
Subject: Re: [OpenAFS] Re: Mystery AFS/Kerberos packet
> What operating system is the client running on?
> Is this a K4 request being produced from OpenAFS on Windows?
I have seen this from three systems, none of which are
under my group's management. One (the first one I
mentioned) exhibited it under both 2000 and XP and
was using the IBM client. The other two are PCs
whose OS and client version I do not know.
> I have suspected that there is a threading problem in the OpenAFS for
> Windows
> client which is overwriting buffers being written to the network but
> have been unable
> to catch it reliably. If you have a system which is consistently
> producing bad data
> at a known point it would be good to see if we can trace it down.
Tell me what would need to be done, and I'll see if the
owners are amenable...
John
> John Hascall wrote:
>
>
>>6303373b766d61124537XXXXXXXX0000494153544154452e4544550067710e403f61667300
0
0
> >>
> > c . 7 ; v m a . E 7 u s e r . . I A S T A T E . E D U . g q . @ ? a f s
.
.
> >
> >
> >>I'm not sure, but the tail bit of it looks like part of a krb4 initial
> >>ticket request by "user" for "afs at IASTATE.EDU", with lifetime 5 hours
> >>15 minutes, around 21 January 2004 (assuming little-endian).
> >>
> >
> >Yes, I've been convinced that this is a valid V4 packet whose
> >first two bytes (04 03) were somehow corrupted with 10 garbage
> >bytes (63 03 37 3b 76 6d 61 12 45 37) and I went off on a wrong
> >tangent upon seeing the 0x6X first byte). At this point, I'm going
> >to assume the user has either munged hardware or DLLs.
> >
> >It's really quite interesting to dump out rejected packets,
> >you see some fascinating crap, here's another:
> >
>
><04><03>__vmware_user__D2521F2GPKdgDby9P77qlo_w*glhuA3un*!sh!<00><00>IASTAT
E
.EDU<00>^HN<0e>@?afs<00><00
> >
> >(a 53 character principal name is too long for k4)
> >(curious how both of these invalid packets used '?', 5h15m, for the
lifetime
).
> >
> >
> >John
> >_______________________________________________
> >OpenAFS-info mailing list
> >OpenAFS-info at openafs.org
> >https://lists.openafs.org/mailman/listinfo/openafs-info
> >
>
> --------------090500050708080908070707
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <html>
> <head>
> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
> <title></title>
> </head>
> <body bgcolor="#ffffff" text="#000000">
> <font face="Bitstream Cyberbit">What operating system is the client
> running on?<br>
> Is this a K4 request being produced from OpenAFS on Windows?<br>
> <br>
> I have suspected that there is a threading problem in the OpenAFS for
> Windows<br>
> client which is overwriting buffers being written to the network but
> have been unable<br>
> to catch it reliably. If you have a system which is
consistently
> producing bad data<br>
> at a known point it would be good to see if we can trace it down.<br>
> <br>
> Jeffrey Altman<br>
> <br>
> <br>
> John Hascall wrote:</font>
> <blockquote cite="mid200401231435.IAA31736 at pvtest.ait.iastate.edu"
> type="cite">
> <blockquote type="cite">
> <pre wrap=""><font face="Bitstream
Cyberbit">6303373b766d61124537XXXXXXXX
0000494153544154452e4544550067710e403f6166730000
> </font></pre>
> </blockquote>
> <pre wrap=""><!----><font face="Bitstream Cyberbit"> c . 7 ; v m a . E
7 u
s e r . . I A S T A T E . E D U . g q . @ ? a f s . .
>
> </font></pre>
> <blockquote type="cite">
> <pre wrap=""><font face="Bitstream Cyberbit">I'm not sure, but the
tail b
it of it looks like part of a krb4 initial
> ticket request by "user" for <a class="moz-txt-link-rfc2396E"
href="mailto:af
s at IASTATE.EDU">"afs at IASTATE.EDU"</a>, with lifetime 5 hours
> 15 minutes, around 21 January 2004 (assuming little-endian).
> </font></pre>
> </blockquote>
> <pre wrap=""><!----><font face="Bitstream Cyberbit">
> Yes, I've been convinced that this is a valid V4 packet whose
> first two bytes (04 03) were somehow corrupted with 10 garbage
> bytes (63 03 37 3b 76 6d 61 12 45 37) and I went off on a wrong
> tangent upon seeing the 0x6X first byte). At this point, I'm going
> to assume the user has either munged hardware or DLLs.
>
> It's really quite interesting to dump out rejected packets,
> you see some fascinating crap, here's another:
>
>
<04><03>__vmware_user__D2521F2GPKdgDby9P77qlo_w*glhuA3un*!sh!<
;
00><00>IASTATE.EDU<00>^HN<0e>@?afs<00><00
>
> (a 53 character principal name is too long for k4)
> (curious how both of these invalid packets used '?', 5h15m, for the
lifetime)
.
>
>
> John
> _______________________________________________
> OpenAFS-info mailing list
> <a class="moz-txt-link-abbreviated"
href="mailto:OpenAFS-info at openafs.org">Op
enAFS-info at openafs.org</a>
> <a class="moz-txt-link-freetext"
href="https://lists.openafs.org/mailman/list
info/openafs-info">https://lists.openafs.org/mailman/listinfo/openafs-info</
a>
> </font></pre>
> </blockquote>
> </body>
> </html>
>
> --------------090500050708080908070707--
>
_______________________________________________
OpenAFS-info mailing list
OpenAFS-info at openafs.org
https://lists.openafs.org/mailman/listinfo/openafs-info
More information about the Kerberos
mailing list