On 06/26/2015 01:44 PM, Tomas Hozza via RT wrote:
> On 19.06.2015 20:25, BIND9 Bugs via RT wrote:
> > Greetings,
> >
> > This message was automatically generated to acknowledge receipt of
> > your recent email
> >  "nsupdate GSSAPI cross-realm detection does not work",
> > and to let you know that we have opened a ticket for your request
> > (a summary of which appears below.)
> >
> > We do not need a further response from you, but if you do respond,
> > please include in the Subject of your reply the ID
> >    '[ISC-Bugs #39840]'
> > so that we can match up your reply with our trouble ticket.
> >
> > What Happens Next
> > =================
> >
> > Bug reports submitted to us in this manner are handled based on
> > perceived severity in relation to other bugs.  We handle reports as
> > time permits so there is no guaranteed response time for these
> > reports.
> >
> > If you feel the issue you are reporting is a security issue, please
> > see http://www.isc.org/security/reporting-issues for details on how
> > to report it, including the PGP key you may use.
> >
> > If it is of a non-security yet still urgent matter, you may reply
> > to this message to add further information.
> >
> >
> > Other Support Options
> > =====================
> >
> > If your organization requires more immediate attention, ISC offers
> > paid support options.  Please see http://www.isc.org/services/support
> > for more information.
> >
> > If paid support is not an option, please consider making a donation
> > to ISC.  We don't require a donation -- we will work on your report
> > just as quickly whether or not you can donate -- but we always need
> > and welcome community support.  See http://www.isc.org/supportisc
> >
> >
> > Run a Supported Version
> > =======================
> >
> > If you are not running a supported version of BIND, please upgrade.
> > Bug reports against unsupported versions of BIND are discouraged,
> > as your issue may have already been addressed.
> >
> > You can find the latest version of BIND here:
> >
> >     https://www.isc.org/software/bind
> >
> >
> > For configuration help...
> > =========================
> >
> > Questions regarding configuration or setup of BIND are addressed on
> > the bind-users list - to subscribe, visit:
> >
> >      https://lists.isc.org/mailman/listinfo/bind-users
> >
> >
> > Thank you,
> >   bind9-bugs@isc.org
> >
> > ---------------------------------------------------------------------
> >
> > Hello.
> >
> > We discovered that when using nsupdate with GSSAPI, the realm detection
> > does not produce meaningful results in cross-realm setup. nsupdate uses
> > get_ticket_realm() to figure out the realm, but the function fails to
> > detect the correct realm in cross-realm setups. One has to specify the
> > realm explicitly, which is not desired.
> >
> > We have a bug [1] in RH Bugszilla with more information and with some
> > investigation.
> >
> > Based on RFC4752 section 3.1 [2], the client side should use
> > GSS_C_NT_HOSTBASED_SERVICE when calling gss_import_name() and use
> > "service@host" as service name.
> >
> > This means that the realm detection should be left to the GSSAPI, which
> > can detect the realm correctly based on the krb5.conf configuration.
> > This also makes the "realm" option useless.
> >
> > I'm attaching a proposed patch that changes the way the service name is
> > constructed and the way gss_import_name() is called, to conform with
> > RFC4752. The patch also removes the "realm" option, since it would not
> > be used anywhere.
> >
> > I tested the fix in cross realm setup and the detection worked correctly.
> >
> > [1] https://bugzilla.redhat.com/show_bug.cgi?id=1214827
> > [2] https://www.ietf.org/rfc/rfc4752.txt
> >
> >
> > Thank you!
> >
> > Regards,
> >
>
> Hi.
>
> I reworked the patch for better backward compatibility. I left the
> 'realm' option. If realm is not specified explicitly, then the realm
> detection is left up to the GSSAPI. If the 'realm' is specified, the
> "old" code is used and the explicit realm is used. I also changed the
> nsupdate documentation to reflect the changes.
>
> Looking forward to your comments.
>
> Thank you!
>
> Regards,
>

Hi.

Any news on this ticket?

Thank you.

Regards,
-- 
Tomas Hozza
Senior Software Engineer - EMEA ENG Developer Experience

PGP: 1D9F3C2D
UTC+1 (CET)
Red Hat Inc.                 http://cz.redhat.com