FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

2011/5/7 Frediano Ziglio <freddy77 AT gmail.com>:
> Il giorno ven, 06/05/2011 alle 18.41 -0400, jklowden AT schemamania.org ha
> scritto:
>> Using bsqlodbc and TDS 7.2 with Kerberos, I get a protocol error.  
>> Dropping to
>> 7.1 works, as does using a non-kerberos login:
>>
>> $ TDSVER=7.2 TDSDUMP=dump  bsqlodbc -S $S -v <<< "select cast('1 mar 2011' 
>> as date) as march" || less -S dump
>> bsqlodbc:273: Verbose operation enabled
>> bsqlodbc: error -1: SQLConnect: SQL_ERROR: failed
>> bsqlodbc: error 20020: 08S01: [unixODBC][FreeTDS][SQL Server]Bad token 
>> from the server: Datastream processing out of sync
>> "[unixODBC][FreeTDS][SQL Server]Unable to connect to data source"
>>
>> Start of dump:
>>
>> log.c:196:Starting log file for FreeTDS 0.83.dev.20110103
>>         on 2011-05-06 18:34:25 with debug flags 0x4fff.
>> iconv.c:330:tds_iconv_open(0x1914a440, UTF-8)
>> iconv.c:187:local name for ISO-8859-1 is ISO-8859-1
>> iconv.c:187:local name for UTF-8 is UTF-8
>> iconv.c:187:local name for UCS-2LE is UCS-2LE
>> iconv.c:187:local name for UCS-2BE is UCS-2BE
>> iconv.c:349:setting up conversions for client charset "UTF-8"
>> iconv.c:351:preparing iconv for "UTF-8" <-> "UCS-2LE" conversion
>> iconv.c:391:preparing iconv for "ISO-8859-1" <-> "UCS-2LE" conversion
>> iconv.c:394:tds_iconv_open: done
>> net.c:205:Connecting to xx.xx.xx.xx port xxx (TDS version 7.2)
>> net.c:270:tds_open_socket: connect(2) returned "Operation now in progress"
>> net.c:310:tds_open_socket() succeeded
>> util.c:156:Changed query state from DEAD to IDLE
>> net.c:741:Sending packet
>> 0000 12 01 00 3a 00 00 00 00-00 00 1a 00 06 01 00 20 |...:.... ....... |
>> 0010 00 01 02 00 21 00 0c 03-00 2d 00 04 04 00 31 00 |....!... .-....1.|
>> 0020 01 ff 09 00 00 00 00 00-02 4d 53 53 51 4c 53 65 |........ .MSSQLSe|
>> 0030 72 76 65 72 00 d8 06 00-00 00                   |rver.... ..|
>>
>> net.c:555:Received header
>> 0000 04 01 00 2b 00 00 01 00-                        |...+....|
>>
>> net.c:609:Received packet
>> 0000 04 01 00 2b 00 00 01 00-00 00 1a 00 06 01 00 20 |...+.... ....... |
>> 0010 00 01 02 00 21 00 01 03-00 22 00 00 04 00 22 00 |....!... ."....".|
>> 0020 01 ff 0a 32 06 40 00 00-02 00 00                |...2.@.. ...|
>>
>> login.c:1051:detected flag 2
>> gssapi.c:172:kerberos name MSSQLSvc/[deleted...]
>> login.c:776:quietly sending TDS 7+ login packet
>> token.c:328:tds_process_login_tokens()
>> net.c:555:Received header
>> 0000 04 01 00 91 00 00 01 00-                        |........|
>>
>> net.c:609:Received packet
>> 0000 04 01 00 91 00 00 01 00-ed 86 00 60 81 83 06 09 |........ ...`....|
>> 0010 2a 86 48 86 f7 12 01 02-02 02 00 6f 74 30 72 a0 |*.H..... ...ot0r.|
>> 0020 03 02 01 05 a1 03 02 01-0f a2 66 30 64 a0 03 02 |........ ..f0d...|
>> 0030 01 17 a2 5d 04 5b 4f 9d-cc 42 98 44 53 4f e4 b9 |...].[O. .B.DSO..|
>> 0040 1f 72 6f 69 16 58 88 1e-bc 2a 54 ca a5 0d eb d3 |.roi.X.. .*T.....|
>> 0050 1c 47 70 cb de 79 3c 54-84 6e 6f 37 d2 5e fc dc |.Gp..y<T .no7.^..|
>> 0060 b3 d5 5f 82 dc 06 13 2a-73 1e 22 6c 70 78 26 11 |.._....* s."lpx&.|
>> 0070 81 7b 31 9a cd 49 35 39-dd 25 84 0c 81 4a 41 9e |.{1..I59 .%...JA.|
>> 0080 b2 a4 28 ce 20 c3 3f d4-23 87 7d de 22 87 cd 24 |..(. .?. #.}."..$|
>> 0090 31                     -                        |1|
>>
>> token.c:337:looking for login token, got  ed(AUTH)
>> token.c:456:TDS_AUTH_TOKEN PDU size 134
>> token.c:337:looking for login token, got  60()
>> token.c:122:tds_process_default_tokens() marker is 60()
>> util.c:156:Changed query state from IDLE to DEAD
>> util.c:331:tdserror(0x19149060, 0x1914a440, 20020, 0)
>> odbc.c:2271:msgno 20020 20003
>> util.c:361:tdserror: client library returned TDS_INT_CANCEL(2)
>> util.c:384:tdserror: returning TDS_INT_CANCEL(2)
>> token.c:256:Unknown marker: 96(60)!!
>> login.c:460:login packet accepted
>> == end ==
>>
>> Well, not exactly *accepted*.
>>
>
> I see two problems. In gssapi.c tds_gss_handle_next is not expected to
> receive authentication so it returns fail. In token.c,
> tds_process_login_tokens fail for tds_process_auth is ignored leading to
> protocol mismatch. To solve second just remove TDS_AUTH_TOKEN case in
> tds_process_login_tokens. The first... I don't know, I note in gssapi.c
> that there are some lines commented out
>
> /*
>        if (maj_stat == GSS_S_CONTINUE_NEEDED) {
>                if (recv_token(s, &token_flags, &recv_tok) < 0) {
>                        (void) gss_release_name(&min_stat,
> &target_name);
>                        return -1;
>                }
>                token_ptr = &recv_tok;
>        }
> */
>
> Probably recv_token would read our authentication token !!
>
> freddy77
>

Mumble... but is Kerberose the romantic version of Kerberos ?? :)

Try this patch ;-)

bye
  freddy77

Attachment: kerberos.diff
Description: Binary data