*** empty log message ***
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@4044 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Assar Westerlund
145
doc/draft-foo2.ms
Normal file
145
doc/draft-foo2.ms
Normal file
@@ -0,0 +1,145 @@
|
||||
.pl 10.0i
|
||||
.po 0
|
||||
.ll 7.2i
|
||||
.lt 7.2i
|
||||
.nr LL 7.2i
|
||||
.nr LT 7.2i
|
||||
.ds LF Westerlund, Danielsson
|
||||
.ds RF [Page %]
|
||||
.ds CF
|
||||
.ds LH Internet Draft
|
||||
.ds RH November, 1997
|
||||
.ds CH Kerberos over TCP
|
||||
.hy 0
|
||||
.ad l
|
||||
.in 0
|
||||
.ta \n(.luR
|
||||
Network Working Group Assar Westerlund
|
||||
<draft-ietf-cat-krb5-tcp.txt> SICS
|
||||
Internet-Draft Johan Danielsson
|
||||
October, 1997 PDC, KTH
|
||||
Expire in six months
|
||||
|
||||
.ce
|
||||
Kerberos over TCP
|
||||
|
||||
.ti 0
|
||||
Status of this Memo
|
||||
|
||||
.in 3
|
||||
This document is an Internet-Draft. Internet-Drafts are working
|
||||
documents of the Internet Engineering Task Force (IETF), its
|
||||
areas, and its working groups. Note that other groups may also
|
||||
distribute working documents as Internet-Drafts.
|
||||
|
||||
Internet-Drafts are draft documents valid for a maximum of six
|
||||
months and may be updated, replaced, or obsoleted by other
|
||||
documents at any time. It is inappropriate to use Internet-
|
||||
Drafts as reference material or to cite them other than as
|
||||
"work in progress."
|
||||
|
||||
To view the entire list of current Internet-Drafts, please check
|
||||
the "1id-abstracts.txt" listing contained in the Internet-Drafts
|
||||
Shadow Directories on ftp.is.co.za (Africa), ftp.nordu.net
|
||||
(Europe), munnari.oz.au (Pacific Rim), ds.internic.net (US East
|
||||
Coast), or ftp.isi.edu (US West Coast).
|
||||
|
||||
Distribution of this memo is unlimited. Please send comments to the
|
||||
<cat-ietf@mit.edu> mailing list.
|
||||
|
||||
.ti 0
|
||||
Abstract
|
||||
|
||||
.in 3
|
||||
This document specifies how the communication should be done between a
|
||||
client and a KDC using Kerberos [RFC1510] with TCP as the transport
|
||||
protocol.
|
||||
|
||||
.ti 0
|
||||
Specification
|
||||
|
||||
A Kerberos server MAY accepts requests on port 88 (decimal).
|
||||
|
||||
The data sent from the client to the KDC should consist of 4 bytes
|
||||
containting the length Kerberos request in network byte order and then
|
||||
the request (AS-REQ or TGS-REQ) itself. The reply from the KDC should
|
||||
consist of the length of the reply packet in network byte order
|
||||
followed by the packet itself (AS-REP, TGS-REP, or KRB-ERROR).
|
||||
|
||||
C->S: Open connection to port 88 at the server
|
||||
.br
|
||||
C->S: length of request [as 4 bytes in network byte order ]
|
||||
.br
|
||||
C->S: AS-REQ or TGS-REQ
|
||||
.br
|
||||
S->C: length of reply [as 4 bytes in network byte order ]
|
||||
.br
|
||||
S->C: AS-REP, TGS-REP, or KRB-ERROR
|
||||
.br
|
||||
: connection is closed
|
||||
|
||||
.ti 0
|
||||
Discussion
|
||||
|
||||
Even though the preferred way of sending kerberos packets is over UDP
|
||||
there are several occasions when it's more practical to use TCP.
|
||||
|
||||
Mainly, it's usually much less cumbersome to get TCP through firewalls
|
||||
than UDP.
|
||||
|
||||
In theory, there's no reason for having explicit length fields, that
|
||||
information is already encoded in the ASN1 encoding of the Kerberos
|
||||
packets. But having explicit lengths makes it unnecessary to have to
|
||||
decode the ASN1 encoding just to know how much data has to be read.
|
||||
|
||||
Another way of signaling the end of the request of the reply would be
|
||||
to do a half-close after the request and a full-close after the
|
||||
reply. This does not work well with all kind of firewalls so the
|
||||
simpler and more robust solution of explicit length fields.
|
||||
|
||||
.ti 0
|
||||
Security considerations
|
||||
|
||||
.in 3
|
||||
This memo does not introduce any known security considerations in
|
||||
addition to those mentioned in [RFC1510].
|
||||
|
||||
.ti 0
|
||||
References
|
||||
|
||||
.in 3
|
||||
[RFC1510] Kohl, J. and Neuman, C., "The Kerberos Network
|
||||
Authentication Service (V5)", RFC 1510, September 1993.
|
||||
|
||||
.ti 0
|
||||
Authors' Addresses
|
||||
|
||||
Assar Westerlund
|
||||
.br
|
||||
Swedish Institute of Computer Science
|
||||
.br
|
||||
Box 1263
|
||||
.br
|
||||
S-164 29 KISTA
|
||||
.br
|
||||
Sweden
|
||||
|
||||
Phone: +46-8-7521526
|
||||
.br
|
||||
Fax: +46-8-7517230
|
||||
.br
|
||||
EMail: assar@sics.se
|
||||
|
||||
Johan Danielsson
|
||||
.br
|
||||
PDC, KTH
|
||||
.br
|
||||
S-100 44 STOCKHOLM
|
||||
.br
|
||||
Sweden
|
||||
|
||||
Phone: +46-8-7907885
|
||||
.br
|
||||
Fax: +46-8-247784
|
||||
.br
|
||||
EMail: joda@pdc.kth.se
|
||||
145
doc/standardisation/draft-foo2.ms
Normal file
145
doc/standardisation/draft-foo2.ms
Normal file
@@ -0,0 +1,145 @@
|
||||
.pl 10.0i
|
||||
.po 0
|
||||
.ll 7.2i
|
||||
.lt 7.2i
|
||||
.nr LL 7.2i
|
||||
.nr LT 7.2i
|
||||
.ds LF Westerlund, Danielsson
|
||||
.ds RF [Page %]
|
||||
.ds CF
|
||||
.ds LH Internet Draft
|
||||
.ds RH November, 1997
|
||||
.ds CH Kerberos over TCP
|
||||
.hy 0
|
||||
.ad l
|
||||
.in 0
|
||||
.ta \n(.luR
|
||||
Network Working Group Assar Westerlund
|
||||
<draft-ietf-cat-krb5-tcp.txt> SICS
|
||||
Internet-Draft Johan Danielsson
|
||||
October, 1997 PDC, KTH
|
||||
Expire in six months
|
||||
|
||||
.ce
|
||||
Kerberos over TCP
|
||||
|
||||
.ti 0
|
||||
Status of this Memo
|
||||
|
||||
.in 3
|
||||
This document is an Internet-Draft. Internet-Drafts are working
|
||||
documents of the Internet Engineering Task Force (IETF), its
|
||||
areas, and its working groups. Note that other groups may also
|
||||
distribute working documents as Internet-Drafts.
|
||||
|
||||
Internet-Drafts are draft documents valid for a maximum of six
|
||||
months and may be updated, replaced, or obsoleted by other
|
||||
documents at any time. It is inappropriate to use Internet-
|
||||
Drafts as reference material or to cite them other than as
|
||||
"work in progress."
|
||||
|
||||
To view the entire list of current Internet-Drafts, please check
|
||||
the "1id-abstracts.txt" listing contained in the Internet-Drafts
|
||||
Shadow Directories on ftp.is.co.za (Africa), ftp.nordu.net
|
||||
(Europe), munnari.oz.au (Pacific Rim), ds.internic.net (US East
|
||||
Coast), or ftp.isi.edu (US West Coast).
|
||||
|
||||
Distribution of this memo is unlimited. Please send comments to the
|
||||
<cat-ietf@mit.edu> mailing list.
|
||||
|
||||
.ti 0
|
||||
Abstract
|
||||
|
||||
.in 3
|
||||
This document specifies how the communication should be done between a
|
||||
client and a KDC using Kerberos [RFC1510] with TCP as the transport
|
||||
protocol.
|
||||
|
||||
.ti 0
|
||||
Specification
|
||||
|
||||
A Kerberos server MAY accepts requests on port 88 (decimal).
|
||||
|
||||
The data sent from the client to the KDC should consist of 4 bytes
|
||||
containting the length Kerberos request in network byte order and then
|
||||
the request (AS-REQ or TGS-REQ) itself. The reply from the KDC should
|
||||
consist of the length of the reply packet in network byte order
|
||||
followed by the packet itself (AS-REP, TGS-REP, or KRB-ERROR).
|
||||
|
||||
C->S: Open connection to port 88 at the server
|
||||
.br
|
||||
C->S: length of request [as 4 bytes in network byte order ]
|
||||
.br
|
||||
C->S: AS-REQ or TGS-REQ
|
||||
.br
|
||||
S->C: length of reply [as 4 bytes in network byte order ]
|
||||
.br
|
||||
S->C: AS-REP, TGS-REP, or KRB-ERROR
|
||||
.br
|
||||
: connection is closed
|
||||
|
||||
.ti 0
|
||||
Discussion
|
||||
|
||||
Even though the preferred way of sending kerberos packets is over UDP
|
||||
there are several occasions when it's more practical to use TCP.
|
||||
|
||||
Mainly, it's usually much less cumbersome to get TCP through firewalls
|
||||
than UDP.
|
||||
|
||||
In theory, there's no reason for having explicit length fields, that
|
||||
information is already encoded in the ASN1 encoding of the Kerberos
|
||||
packets. But having explicit lengths makes it unnecessary to have to
|
||||
decode the ASN1 encoding just to know how much data has to be read.
|
||||
|
||||
Another way of signaling the end of the request of the reply would be
|
||||
to do a half-close after the request and a full-close after the
|
||||
reply. This does not work well with all kind of firewalls so the
|
||||
simpler and more robust solution of explicit length fields.
|
||||
|
||||
.ti 0
|
||||
Security considerations
|
||||
|
||||
.in 3
|
||||
This memo does not introduce any known security considerations in
|
||||
addition to those mentioned in [RFC1510].
|
||||
|
||||
.ti 0
|
||||
References
|
||||
|
||||
.in 3
|
||||
[RFC1510] Kohl, J. and Neuman, C., "The Kerberos Network
|
||||
Authentication Service (V5)", RFC 1510, September 1993.
|
||||
|
||||
.ti 0
|
||||
Authors' Addresses
|
||||
|
||||
Assar Westerlund
|
||||
.br
|
||||
Swedish Institute of Computer Science
|
||||
.br
|
||||
Box 1263
|
||||
.br
|
||||
S-164 29 KISTA
|
||||
.br
|
||||
Sweden
|
||||
|
||||
Phone: +46-8-7521526
|
||||
.br
|
||||
Fax: +46-8-7517230
|
||||
.br
|
||||
EMail: assar@sics.se
|
||||
|
||||
Johan Danielsson
|
||||
.br
|
||||
PDC, KTH
|
||||
.br
|
||||
S-100 44 STOCKHOLM
|
||||
.br
|
||||
Sweden
|
||||
|
||||
Phone: +46-8-7907885
|
||||
.br
|
||||
Fax: +46-8-247784
|
||||
.br
|
||||
EMail: joda@pdc.kth.se
|
||||
Reference in New Issue
Block a user