MIME-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <37A25F01-F4F9-4F23-B666-120E7B45F5A0@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@MIT.EDU>
Subject: gsstest doesn't like krb5-1.6 GSSAPI library
Date: Wed, 21 Feb 2007 22:51:35 -0500
To: krb5-bugs@MIT.EDU
Precedence: list
Sender: krb5-bugs-incoming-bounces@PCH.mit.edu
Errors-To: krb5-bugs-incoming-bounces@PCH.mit.edu
Content-Length: 1927

I'm playing with gsstest-1.26 (the latest on the SAP FTP site, though  
I've seen mentions on the net of a 1.27 which I haven't tracked down)  
and the 1.6 branch.

First problem: gss_canonicalize_name returns a name that will be  
rejected by gss_release_name in the mechglue code because the  
"loopback" field is not set properly.  With that problem quickly  
hacked around, it's still reporting three problem cases:

TEST: acquiring *default* accepting credentials (simple)
Status:  gss_inquire_cred Acc() == (GSS_S_DEFECTIVE_CREDENTIAL)
          gss_display_status(0x000a0000,GSS_S_GSS_CODE) =
            "Invalid credential was supplied"
RESULT  NOT ok (rc=1)

It looks like acquiring the default acceptor credentials doesn't  
produce an error, but calling gss_inquire_cred on the result to get a  
name out does, because internally it tries to import an empty name.   
(Acquiring the acceptor credentials by name was a previous test, and  
worked fine.)

TEST: acquiring *default* accepting credentials (query)
Status:  gss_inquire_cred Acc() == (GSS_S_DEFECTIVE_CREDENTIAL)
          gss_display_status(0x000a0000,GSS_S_GSS_CODE) =
            "Invalid credential was supplied"
RESULT  NOT ok (rc=1)

The "query" version of this test looks at the name in the acquired  
credentials, plays some games with exporting and importing and  
canonicalizing the name, then tries to acquire credentials using the  
resulting name.

TEST: Trying gss_import_name() with ""
Status:  gss_import_name() == (GSS_S_CALL_INACCESSIBLE_READ| 
GSS_S_BAD_NAME)
          gss_display_status(0x01020000,GSS_S_GSS_CODE) =
            "A required input parameter could not be read"
            "An invalid name was supplied"
ERROR: gss_import_name() didn't return GSS_S_BAD_NAME or GSS_S_FAILURE!
RESULT  NOT ok (rc=1)

The test program uses an empty string, not a null or invalid pointer,  
so INACCESSIBLE_READ is probably incorrect.

Ken