Message-ID: <48883D87.8030008@plauener.de>
Date: Thu, 24 Jul 2008 10:29:59 +0200
From: Christian Krause <chkr@plauener.de>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.14) Gecko/20080501 Fedora/2.0.0.14-1.fc8 Thunderbird/2.0.0.14 Mnenhy/0.7.5.666
MIME-Version: 1.0
To: krb5-bugs@mit.edu
Subject: krb5_gss_accept_sec_context always returns minor_status = 0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: list
Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Content-Length: 1793

Hi,

I've started to use krb5's (krb-1.6.3) gss API and it happened quite 
often in the first time, that this function failed for various reasons 
(which is not a problem so far).

The function returned GSS_S_FAILURE and according to the documentation a 
more specific error code should be in minor_status. But in my case 
minor_status was always 0.

I've digged a little bit in the implementation in 
krb5/src/lib/gssapi/krb5/accept_sec_context.c and it looks like in line 
928 the minor_status is correctly set to code, which is the return value 
of most krb5 functions:

    *minor_status = code;

So far this would work perfectly.

Unfortunately, at the end of this function it will be overwritten:

   if (!verifier_cred_handle && cred_handle) {
            krb5_gss_release_cred(minor_status, &cred_handle);
    }

At least in my case, the condition was always true (because I've called 
accept_sec_contect with verifier_cred_handle=GSS_C_NO_CREDENTIAL) and so 
the real error was always hidden.

Because this is not very convenient (and usually the return code of 
krb5_gss_release_cred is much less helpful than the real error code of a 
previous failed function), I'd suggest to change the code like this:

--- src/lib/gssapi/krb5/accept_sec_context.c
+++ src/lib/gssapi/krb5/accept_sec_context.c
@@ -991,7 +991,8 @@
         *output_token = token;
     }
     if (!verifier_cred_handle && cred_handle) {
-          krb5_gss_release_cred(minor_status, &cred_handle);
+          int release_minor_status;
+          krb5_gss_release_cred(&release_minor_status, &cred_handle);
     }
     krb5_free_context(context);
     return (major_status);


It would be great if you could review this patch and consider to apply 
the it.

Thank you very much in advance!


Best regards,
Christian