Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1084068 - ipv6 address handling in krb5.conf
ipv6 address handling in krb5.conf
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: krb5 (Show other bugs)
7.0
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Nalin Dahyabhai
Patrik Kis
:
Depends On:
Blocks: 1113520 1083244
  Show dependency treegraph
 
Reported: 2014-04-03 10:29 EDT by Guenther Deschner
Modified: 2015-03-05 05:00 EST (History)
8 users (show)

See Also:
Fixed In Version: krb5-1.12.2-7.el7
Doc Type: Bug Fix
Doc Text:
Cause: When attempting to look up the addresses of servers configured in /etc/krb5.conf, the Kerberos client library did not recognize some of the result codes which could be returned by the resolver libraries. Consequence: Instead of treating the inability to parse an IPv6 address as an IPv4 address as a non-fatal error, the client library would treat it as a fatal error, and fail to contact the server. Fix: Patches were added to help ensure that these specific result codes could be interpreted properly. Result: These errors no longer occur.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-03-05 05:00:44 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Bugzilla 1109102 None None None Never
Red Hat Product Errata RHSA-2015:0439 normal SHIPPED_LIVE Moderate: krb5 security, bug fix and enhancement update 2015-03-05 09:38:14 EST

  None (edit)
Description Guenther Deschner 2014-04-03 10:29:03 EDT
Description of problem:

libkrb5 seems to have problems dealing with setups where a KDC has a ipv4 and a ipv6 addresses and when both addresses are put into a krb5.conf file.

When the KDC cannot be connected using the ipv6 address, kinit will only retry with the ipv4 address when the ipv6 address has the portnummer attached to it.

With this kinit will fail with "kinit: Invalid argument while getting initial credentials"

[realms]
        AD.TEST.COM = {
                kdc = [1234:52:0:2223::1:1]
                kdc = 12.34.56.78
        }

while the ipv4 address is tried with this configuration (and kinit succeeds).

[realms]
        AD.TEST.COM = {
                kdc = [1234:52:0:2223::1:1]:88
                kdc = 12.34.56.78
        }


Version-Release number of selected component (if applicable):
krb5-libs-1.11.3-49.el7
Comment 11 errata-xmlrpc 2015-03-05 05:00:44 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0439.html

Note You need to log in before you can comment on or make changes to this bug.