Re: problem with Kerberose and TDS 7.2

Il giorno ven, 06/05/2011 alle 18.41 -0400, [email protected] ha
scritto:
> Using bsqlodbc and TDS 7.2 with Kerberos, I get a protocol error.  Dropping to
> 7.1 works, as does using a non-kerberos login:
> 
> $ TDSVER=7.2 TDSDUMP=dump  bsqlodbc -S $S -v <<< "select cast('1 mar 2011' as date) as march" || less -S dump
> bsqlodbc:273: Verbose operation enabled
> bsqlodbc: error -1: SQLConnect: SQL_ERROR: failed
> bsqlodbc: error 20020: 08S01: [unixODBC][FreeTDS][SQL Server]Bad token from the server: Datastream processing out of sync
> "[unixODBC][FreeTDS][SQL Server]Unable to connect to data source"
> 
> Start of dump:
> 
> log.c:196:Starting log file for FreeTDS 0.83.dev.20110103
>         on 2011-05-06 18:34:25 with debug flags 0x4fff.
> iconv.c:330:tds_iconv_open(0x1914a440, UTF-8)
> iconv.c:187:local name for ISO-8859-1 is ISO-8859-1
> iconv.c:187:local name for UTF-8 is UTF-8
> iconv.c:187:local name for UCS-2LE is UCS-2LE
> iconv.c:187:local name for UCS-2BE is UCS-2BE
> iconv.c:349:setting up conversions for client charset "UTF-8"
> iconv.c:351:preparing iconv for "UTF-8" <-> "UCS-2LE" conversion
> iconv.c:391:preparing iconv for "ISO-8859-1" <-> "UCS-2LE" conversion
> iconv.c:394:tds_iconv_open: done
> net.c:205:Connecting to xx.xx.xx.xx port xxx (TDS version 7.2)
> net.c:270:tds_open_socket: connect(2) returned "Operation now in progress"
> net.c:310:tds_open_socket() succeeded
> util.c:156:Changed query state from DEAD to IDLE
> net.c:741:Sending packet
> 0000 12 01 00 3a 00 00 00 00-00 00 1a 00 06 01 00 20 |...:.... ....... |
> 0010 00 01 02 00 21 00 0c 03-00 2d 00 04 04 00 31 00 |....!... .-....1.|
> 0020 01 ff 09 00 00 00 00 00-02 4d 53 53 51 4c 53 65 |........ .MSSQLSe|
> 0030 72 76 65 72 00 d8 06 00-00 00                   |rver.... ..|
> 
> net.c:555:Received header
> 0000 04 01 00 2b 00 00 01 00-                        |...+....|
> 
> net.c:609:Received packet
> 0000 04 01 00 2b 00 00 01 00-00 00 1a 00 06 01 00 20 |...+.... ....... |
> 0010 00 01 02 00 21 00 01 03-00 22 00 00 04 00 22 00 |....!... ."....".|
> 0020 01 ff 0a 32 06 40 00 00-02 00 00                |...2.@.. ...|
> 
> login.c:1051:detected flag 2
> gssapi.c:172:kerberos name MSSQLSvc/[deleted...]
> login.c:776:quietly sending TDS 7+ login packet
> token.c:328:tds_process_login_tokens()
> net.c:555:Received header
> 0000 04 01 00 91 00 00 01 00-                        |........|
> 
> net.c:609:Received packet
> 0000 04 01 00 91 00 00 01 00-ed 86 00 60 81 83 06 09 |........ ...`....|
> 0010 2a 86 48 86 f7 12 01 02-02 02 00 6f 74 30 72 a0 |*.H..... ...ot0r.|
> 0020 03 02 01 05 a1 03 02 01-0f a2 66 30 64 a0 03 02 |........ ..f0d...|
> 0030 01 17 a2 5d 04 5b 4f 9d-cc 42 98 44 53 4f e4 b9 |...].[O. .B.DSO..|
> 0040 1f 72 6f 69 16 58 88 1e-bc 2a 54 ca a5 0d eb d3 |.roi.X.. .*T.....|
> 0050 1c 47 70 cb de 79 3c 54-84 6e 6f 37 d2 5e fc dc |.Gp..y<T .no7.^..|
> 0060 b3 d5 5f 82 dc 06 13 2a-73 1e 22 6c 70 78 26 11 |.._....* s."lpx&.|
> 0070 81 7b 31 9a cd 49 35 39-dd 25 84 0c 81 4a 41 9e |.{1..I59 .%...JA.|
> 0080 b2 a4 28 ce 20 c3 3f d4-23 87 7d de 22 87 cd 24 |..(. .?. #.}."..$|
> 0090 31                     -                        |1|
> 
> token.c:337:looking for login token, got  ed(AUTH)
> token.c:456:TDS_AUTH_TOKEN PDU size 134
> token.c:337:looking for login token, got  60()
> token.c:122:tds_process_default_tokens() marker is 60()
> util.c:156:Changed query state from IDLE to DEAD
> util.c:331:tdserror(0x19149060, 0x1914a440, 20020, 0)
> odbc.c:2271:msgno 20020 20003
> util.c:361:tdserror: client library returned TDS_INT_CANCEL(2)
> util.c:384:tdserror: returning TDS_INT_CANCEL(2)
> token.c:256:Unknown marker: 96(60)!!
> login.c:460:login packet accepted
> == end ==
> 
> Well, not exactly *accepted*.  
> 

I see two problems. In gssapi.c tds_gss_handle_next is not expected to
receive authentication so it returns fail. In token.c,
tds_process_login_tokens fail for tds_process_auth is ignored leading to
protocol mismatch. To solve second just remove TDS_AUTH_TOKEN case in
tds_process_login_tokens. The first... I don't know, I note in gssapi.c
that there are some lines commented out

/*
        if (maj_stat == GSS_S_CONTINUE_NEEDED) {
                if (recv_token(s, &token_flags, &recv_tok) < 0) {
                        (void) gss_release_name(&min_stat,
&target_name);
                        return -1;
                }
                token_ptr = &recv_tok;
        }
*/

Probably recv_token would read our authentication token !!

freddy77