[19376] in Kerberos_V5_Development
Re: [PATCH] Fix failure of mech plugins lacking
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Mar 14 17:13:54 2016
To: David Woodhouse <dwmw2@infradead.org>, krbdev list <krbdev@mit.edu>
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <56E72988.70908@mit.edu>
Date: Mon, 14 Mar 2016 17:13:44 -0400
MIME-Version: 1.0
In-Reply-To: <1457986357.78634.37.camel@infradead.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 03/14/2016 04:12 PM, David Woodhouse wrote:
> Since commit 030a4a03a ("Report inquire_attrs_For_mech mech failures")
> the GSS-NTLMSSP plugin fails to work, because it doesn't provide a
> gss_inquire_attrs_for_mech() method.
I may have erred in accepting the new behavior, as RFC 5587 section
3.4.3 does not specify GSS_S_UNAVAILABLE as a return code.
However, I didn't like the old behavior either; it seems like a lie to
say "this mech has no attributes but knows about all of the attributes
from RFC 5587." The right answer might be to return GSS_S_COMPLETE but
supply an empty known_mech_attrs.
Either way, it's definitely a bug that gss_indicate_mechs_by_attr()
fails out in the presence of mechs which don't implement RFC 5587. It
ought to succeed, and it ought to include mechs which don't implement
RFC 5587 when called with empty desired and critical sets.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
