[krbdev.mit.edu #6893] error codes from error responses can be discarded when there's e-data

[nalin@redhat.com via RT]

On Tue, Apr 19, 2011 at 02:43:18PM -0400, Greg Hudson via RT wrote:
> Are you actually seeing unframed KRB-ERROR responses with e_data?  If so, 
> from what server, and what's in the e_data?
> 
> The intention of the code is to work around the specific interoperability 
> bug where an AD server returns an unframed KRB-ERROR message with no 
> e_data, which was a specific observed behavior.  If there are servers 
> returning unframed KRB-ERROR messages with e_data, we need to figure out 
> how to process it.  The current code intentionally treats the packet as 
> garbage (because plen is wrong and the circumstances don't meet the 
> specific interop workaround).

I had to cook up a fake server to trigger the code path, but the
original report [1] was in the context of a pair of Windows Server 2008
R2 domain controllers with one of the servers being down.

The error in the report has e_data that's a two byte octet string:
 [0x00, 0x03]

The packet capture shows the client sending one request, then
retransmitting it 4 seconds later.  Almost immediately, it gets the
KRB-ERROR back, but then 11 seconds later it gets a KRB-PRIV response
back, which I'm guessing would indicate success if it were decrypted.

HTH,

Nalin

[1] https://bugzilla.redhat.com/show_bug.cgi?id=658871