[krbdev.mit.edu #9123] git commit

[Greg Hudson via RT]

Thu Jun 20 17:16:00 2024: Request 9123 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9123 >



Correct IAKERB protocol implementation

The initial implementation of IAKERB in MIT krb5 mistakenly used
draft-zhu-ws-kerb instead of draft-kitten-ietf-iakerb, and
additionally used the wrong ASN.1 tag value for the target-realm field
of the IAKERB-HEADER sequence.  Correct the following aspects of the
protocol implementation:

* Require and use framing on all messages, not just the initial
  context token.
* Use extension value 2 for the finish message instead of 1.
* Use key usage value 41 instead of 42 for the finish message
  checksum.
* Use UTF8String (12) for target-realm instead of OCTET STRING (4).

With these changes, the IAKERB implementation is interoperable with
other krb5 implementations, but not with the implementation before
these changes.

https://github.com/krb5/krb5/commit/04f9c19c98aed91d96afa377557da86e04db6b44
Author: Greg Hudson <ghudson at mit.edu>
Commit: 04f9c19c98aed91d96afa377557da86e04db6b44
Branch: master
 doc/appdev/refs/macros/index.rst         |  1 +
 src/include/krb5/krb5.hin                |  1 +
 src/lib/gssapi/krb5/accept_sec_context.c |  2 +-
 src/lib/gssapi/krb5/gssapiP_krb5.h       |  2 +-
 src/lib/gssapi/krb5/iakerb.c             | 45 +++++++++-----------------------
 src/lib/gssapi/krb5/init_sec_context.c   |  2 +-
 src/lib/krb5/asn.1/asn1_k_encode.c       |  2 +-
 src/tests/asn.1/krb5_decode_test.c       |  2 +-
 src/tests/asn.1/reference_encode.out     |  2 +-
 src/tests/asn.1/trval.c                  |  4 ++-
 src/tests/asn.1/trval_reference.out      |  7 ++---
 11 files changed, 26 insertions(+), 44 deletions(-)