Skip to Content.
Sympa Menu

freetds - [freetds] gss_init_sec_context

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: jklowden AT schemamania.org
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: [freetds] gss_init_sec_context
  • Date: Thu, 23 Jun 2011 16:16:13 -0400

http://www.gnu.org/software/gss/manual/html_node/Context_002dLevel-Routines.html

In src/tds/gssapi.c::tds_gss_continue(), I think we may be calling
gss_init_sec_context() incorrectly.

The test maj_stat != GSS_S_CONTINUE_NEEDED looks wrong to me, because
GSS_S_CONTINUE_NEEDED is defined as a bit in gssapi.h:

#define GSS_S_CONTINUE_NEEDED \
(1 << (GSS_C_SUPPLEMENTARY_OFFSET + 0))

The manual says the call should be in a loop, and the error test should be:

if (GSS_ERROR(maj_stat))
/* error out */

I'm looking into this because I have servers that (afaik) accept Kerberos
logins -- I can connect from Windows using Microsoft's ISQL.EXE -- but not
from FreeTDS on Linux. The log indicates a type 2 (unencrypted, default)
connection, but does not explain why the login packet was rejected:

net.c:602:Received packet
0000 04 01 00 25 00 00 01 00-00 00 15 00 06 01 00 1b |...%.... ........|
0010 00 01 02 00 1c 00 01 03-00 1d 00 00 ff 09 00 0f |........ ........|
0020 c3 00 00 02 00 - |.....|

login.c:1090:detected flag 2
login.c:766:using tds_gss_get_auth authentication for [no name] account
gssapi.c:206:tds_gss_get_auth: kerberos name
MSSQLSvc/mpquantbbrt.ac.lp.acml.com:1433
gssapi.c:218:tds_gss_get_auth: maj_stat==0, tds_gss_continue returned 0
login.c:464:login packet rejected

Could it be we're giving up too soon?

--jkl




Archive powered by MHonArc 2.6.24.

Top of Page