Subject: Re: [nfsv4] caching rpcsec_gss context handles

From: [email-masked]
Date: Wed, 4 Jan 2006 15:45:19 -0500 (EST)

> On Fri, Dec 09, 2005 at 12:55:13PM -0500, [email-masked] wrote:
> > > Wrong layer.  It's the GSS-API mechanism's job to tell you that a
> > > security context has expired, either because it has lived too long
> > > (e.g., past ticket expiration time), or because it has been used too
> > > much and using it more would ease cryptanalysis.
> > > 
> > > IOW, don't worry about this -- let the GSS-API do this for you.
> > > 
> > > The server should use memory pressure, LRU/LFU and such heuristics to
> > > decide if and when to delete security contexts.
> > 
> > Ok, I assume by the above that you mean I should use the "time_rec"
> > returned by gss_accept_sec_context()?
> 
> Nah, just wait until you get GSS_S_CONTEXT_EXPIRED from GSS_Wrap()/
> GSS_Unwrap()/GSS_GetMIC()/GSS_VerifyMIC().
> 
> The expiration time from gss_accept_sec_context() is time based, not
> usage based.

I finally got around to looking at the sources and here's what seems to
be done:
Heimdal-0.7 - Only returns GSS_S_CONTEXT_EXPIRED for gss_init_sec_context()
	and gss_context_time(). It uses the expiry time that would be
	returned in time_rec to determine expiry. You would be waiting
	a looonnnnggg time (aka forever) for GSS_S_CONTEXT_EXPIRED to
	be returned from gss_wrap/gss_unwrap/gss_getmic/gss_verifymic.

MIT krb5-1.3.6 - Does return GSS_S_CONTEXT_EXPIRED for gss_wrap/gss_unwrap/
	gss_getmic/gss_verifymic. It also compares the current time with
	the expiry time that is returned in time_rec to decide to do this.
	(I haven't looked at the krb5-1.4.n code.)

So, I'm expiring the context when time_rec is up, since that is consistent
with MIT's implementation and it doesn't seem right to let the context last
"forever" as you would get using Heimdal and waiting for GSS_S_CONTEXT_EXPIRED.

rick

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4