From owner-freebsd-bugs@FreeBSD.ORG Tue Nov 6 15:10:02 2007 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EB32D16A41A for ; Tue, 6 Nov 2007 15:10:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id C41CC13C4AC for ; Tue, 6 Nov 2007 15:10:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.1/8.14.1) with ESMTP id lA6FA1l4040948 for ; Tue, 6 Nov 2007 15:10:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.1/8.14.1/Submit) id lA6FA1XN040947; Tue, 6 Nov 2007 15:10:01 GMT (envelope-from gnats) Resent-Date: Tue, 6 Nov 2007 15:10:01 GMT Resent-Message-Id: <200711061510.lA6FA1XN040947@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nathan Whitehorn Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 71AD616A419 for ; Tue, 6 Nov 2007 15:02:09 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 4BD3213C4D5 for ; Tue, 6 Nov 2007 15:02:09 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.1/8.14.1) with ESMTP id lA6F1tUj013891 for ; Tue, 6 Nov 2007 15:01:55 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.1/8.14.1/Submit) id lA6F1tDi013890; Tue, 6 Nov 2007 15:01:55 GMT (envelope-from nobody) Message-Id: <200711061501.lA6F1tDi013890@www.freebsd.org> Date: Tue, 6 Nov 2007 15:01:55 GMT From: Nathan Whitehorn To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: misc/117867: [heimdal] kinit generates bad tickets on multihomed IPv6 hosts X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Nov 2007 15:10:02 -0000 >Number: 117867 >Category: misc >Synopsis: [heimdal] kinit generates bad tickets on multihomed IPv6 hosts >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Nov 06 15:10:01 UTC 2007 >Closed-Date: >Last-Modified: >Originator: Nathan Whitehorn >Release: 7.0-CURRENT >Organization: University of Wisconsin >Environment: FreeBSD banshee.munuc.org 7.0-CURRENT FreeBSD 7.0-CURRENT #0: Mon Oct 8 14:34:11 CDT 2007 root@munuc.org:/usr/obj/usr/src/sys/X2100 amd64 >Description: On systems with multiple IPv6 interfaces, kerberos tickets with addresses in them are not accepted by other hosts, with the following error: [nwhitehorn@banshee ~]$ telnet tiburon Trying 2001:4830:151a:d610:20f:b5ff:fefb:4219... Connected to tiburon.munuc.org. Escape character is '^]'. [ Trying mutual KERBEROS5 (host/tiburon.munuc.org@MUNUC.ORG)... ] [ Kerberos V5 refuses authentication because Read req failed: ASN.1 badly-formatted encoding ] [ Trying KERBEROS5 (host/tiburon.munuc.org@MUNUC.ORG)... ] [ Kerberos V5 refuses authentication because Read req failed: ASN.1 badly-formatted encoding ] (This also happens if I connect over IPv4) My tickets look like this: [nwhitehorn@banshee ~]$ klist -v Credentials cache: FILE:/tmp/krb5cc_1001 Principal: nwhitehorn@MUNUC.ORG Cache version: 4 Server: krbtgt/MUNUC.ORG@MUNUC.ORG Ticket etype: des3-cbc-sha1, kvno 1 Auth time: Nov 6 08:54:32 2007 End time: Nov 6 18:54:32 2007 Renew till: Nov 13 08:54:32 2007 Ticket flags: renewable, initial Addresses: IPv4:10.0.10.1, IPv6:2001:4830:151a:d610::1, IPv4:128.135.214.27, IPv4:128.135.214.16, IPv6:2001:4830:151a:d600::d610 I have also experienced this problem on a machine running FreeBSD/arm 7.0-CURRENT, one running FreeBSD/i386 5.5-STABLE, and one running 8.0-CURRENT on i386. >How-To-Repeat: Try to use kerberos tickets obtained on a multihomed IPv6 host. >Fix: Acquire the tickets with kinit --no-addresses. >Release-Note: >Audit-Trail: >Unformatted: