KDC not sending A Reply to AS Request

[Ken Raeburn]

On May 21, 2008, at 08:26, Chaitra Shankar wrote:
>    In our project we are using MIT kerberos KDC server and small
> variations are done to the code of the clients directory to suit our
> project requirements. As per the requirements we are supposed to use
> PKINIT. How to configure the KDC server to accept PKINIT Request?
> Also the KDC is not reponding to the AS Request sent to it. The  
> Request
> is conformant to the specifications of Kerberos.
> The log files show an entry which is ,as follows:
> krb5kdc:ASN.1 structure is missing a required field - while  
> despatching(udp)
> Please help us. We are not able to figure out where the problem  
> might be
> occuring.

The ASN.1 code is one of the ugliest bits of our code, IMO, and there  
is no good way to debug it.

A not-so-good way might be to intercept all the places where that  
error code can be generated, attach the KDC process under a debugger,  
and set a breakpoint at the intercept point.  If you're already making  
code modifications, I expect this won't be too difficult.

For example, in src/lib/krb5/asn.1, in the files asn1_k_decode.c,  
asn1buf.c, and krb5_decode.c, after the inclusion of the headers and  
before the function definitions, add something like this (untested)  
code:

   static krb5_error_code asn1_missing_field = ASN1_MISSING_FIELD;
   static krb5_error_code report_missing_field(int lineno) {
     fprintf(stderr, "missing field at %s line %d", __FILE__, lineno);
     abort();
     return asn1_missing_field; /* not actually reached */
   }
   #undef ASN1_MISSING_FIELD
   #define ASN1_MISSING_FIELD (report_missing_field())

Compile, start it up under gdb, with "-n" to keep it in foreground  
with stderr attached to the terminal, set a breakpoint in "abort", and  
trigger the problem again.  The stack trace will show you what lines  
in what decoding routines caused this error, and in each routine, the  
source code would indicate what field is being decoded.

(If you leave out the abort call, make the function external, and  
declare it instead of defining it in all but one source file, and  
compile it either without optimization or with function inline  
expansion disabled, you can set a breakpoint in the function itself,  
and still have a KDC that should function normally when you're not  
actually debugging the problem -- it'll print the message and continue  
on.)

Ken