[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: heimdal 1.0.1 w2k interop



There is some new option in the latest version of the W2K3 tools that  
allows you to specifically enable rc4 with non-windows Kerberos.  I  
presume you are making use of that, and the problem persists?

On Oct 16, 2007, at 9:26 AM, Andy Polyakov wrote:

> Ooops! This time with attachement:-) A.
>
>> - w2k can parse only PA_ENCTYPE_INFO structure, while heimdal  
>> fails to provide this structure, because it fails to identify w2k  
>> as "old" client;
>> First issue is still present in 1.0.1, because it fails to  
>> identify legacy Microsoft cryptotypes as "old" ones. Attached  
>> patch does the trick for us [by adding just mentioned cryptotypes  
>> to older_enctype()] and [so far] was tested with w2k, wxp, vista,  
>> mit krb5 and admitmac.
> --- ./kdc/kerberos5.c.orig	2007-08-09 09:47:22.000000000 +0200
> +++ ./kdc/kerberos5.c	2007-10-16 10:02:06.000000000 +0200
> @@ -362,6 +362,9 @@
>      case ETYPE_DES3_CBC_SHA1:
>      case ETYPE_ARCFOUR_HMAC_MD5:
>      case ETYPE_ARCFOUR_HMAC_MD5_56:
> +    case ETYPE_ARCFOUR_MD4:		/* windows specific */
> +    case ETYPE_ARCFOUR_HMAC_OLD:
> +    case ETYPE_ARCFOUR_HMAC_OLD_EXP:
>  	return 1;
>      default:
>  	return 0;
> --- ./lib/asn1/k5.asn1.orig	2007-08-09 09:47:10.000000000 +0200
> +++ ./lib/asn1/k5.asn1	2007-10-15 23:39:29.000000000 +0200
> @@ -137,6 +137,10 @@
>  	ETYPE_ARCFOUR_HMAC_MD5(23),
>  	ETYPE_ARCFOUR_HMAC_MD5_56(24),
>  	ETYPE_ENCTYPE_PK_CROSS(48),
> +-- some "old" windows types
> +	ETYPE_ARCFOUR_MD4(-128),
> +	ETYPE_ARCFOUR_HMAC_OLD(-133),
> +	ETYPE_ARCFOUR_HMAC_OLD_EXP(-135),
>  -- these are for Heimdal internal use
>  	ETYPE_DES_CBC_NONE(-0x1000),
>  	ETYPE_DES3_CBC_NONE(-0x1001),

------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu