Re: problem with Kerberose and TDS 7.2

2011/5/7 Frediano Ziglio <[email protected]>:
> 2011/5/7 Frediano Ziglio <[email protected]>:
>> Il giorno ven, 06/05/2011 alle 18.41 -0400, [email protected] ha
>> scritto:
>>> Using bsqlodbc and TDS 7.2 with Kerberos, I get a protocol error.  Dropping to
>>> 7.1 works, as does using a non-kerberos login:
>>>
>>> $ TDSVER=7.2 TDSDUMP=dump  bsqlodbc -S $S -v <<< "select cast('1 mar 2011' as date) as march" || less -S dump
>>> bsqlodbc:273: Verbose operation enabled
>>> bsqlodbc: error -1: SQLConnect: SQL_ERROR: failed
>>> bsqlodbc: error 20020: 08S01: [unixODBC][FreeTDS][SQL Server]Bad token from the server: Datastream processing out of sync
>>> "[unixODBC][FreeTDS][SQL Server]Unable to connect to data source"
>>>
>>> Start of dump:
>>>
>>> log.c:196:Starting log file for FreeTDS 0.83.dev.20110103
>>>         on 2011-05-06 18:34:25 with debug flags 0x4fff.
>>> iconv.c:330:tds_iconv_open(0x1914a440, UTF-8)
>>> iconv.c:187:local name for ISO-8859-1 is ISO-8859-1
>>> iconv.c:187:local name for UTF-8 is UTF-8
>>> iconv.c:187:local name for UCS-2LE is UCS-2LE
>>> iconv.c:187:local name for UCS-2BE is UCS-2BE
>>> iconv.c:349:setting up conversions for client charset "UTF-8"
>>> iconv.c:351:preparing iconv for "UTF-8" <-> "UCS-2LE" conversion
>>> iconv.c:391:preparing iconv for "ISO-8859-1" <-> "UCS-2LE" conversion
>>> iconv.c:394:tds_iconv_open: done
>>> net.c:205:Connecting to xx.xx.xx.xx port xxx (TDS version 7.2)
>>> net.c:270:tds_open_socket: connect(2) returned "Operation now in progress"
>>> net.c:310:tds_open_socket() succeeded
>>> util.c:156:Changed query state from DEAD to IDLE
>>> net.c:741:Sending packet
>>> 0000 12 01 00 3a 00 00 00 00-00 00 1a 00 06 01 00 20 |...:.... ....... |
>>> 0010 00 01 02 00 21 00 0c 03-00 2d 00 04 04 00 31 00 |....!... .-....1.|
>>> 0020 01 ff 09 00 00 00 00 00-02 4d 53 53 51 4c 53 65 |........ .MSSQLSe|
>>> 0030 72 76 65 72 00 d8 06 00-00 00                   |rver.... ..|
>>>
>>> net.c:555:Received header
>>> 0000 04 01 00 2b 00 00 01 00-                        |...+....|
>>>
>>> net.c:609:Received packet
>>> 0000 04 01 00 2b 00 00 01 00-00 00 1a 00 06 01 00 20 |...+.... ....... |
>>> 0010 00 01 02 00 21 00 01 03-00 22 00 00 04 00 22 00 |....!... ."....".|
>>> 0020 01 ff 0a 32 06 40 00 00-02 00 00                |...2.@.. ...|
>>>
>>> login.c:1051:detected flag 2
>>> gssapi.c:172:kerberos name MSSQLSvc/[deleted...]
>>> login.c:776:quietly sending TDS 7+ login packet
>>> token.c:328:tds_process_login_tokens()
>>> net.c:555:Received header
>>> 0000 04 01 00 91 00 00 01 00-                        |........|
>>>
>>> net.c:609:Received packet
>>> 0000 04 01 00 91 00 00 01 00-ed 86 00 60 81 83 06 09 |........ ...`....|
>>> 0010 2a 86 48 86 f7 12 01 02-02 02 00 6f 74 30 72 a0 |*.H..... ...ot0r.|
>>> 0020 03 02 01 05 a1 03 02 01-0f a2 66 30 64 a0 03 02 |........ ..f0d...|
>>> 0030 01 17 a2 5d 04 5b 4f 9d-cc 42 98 44 53 4f e4 b9 |...].[O. .B.DSO..|
>>> 0040 1f 72 6f 69 16 58 88 1e-bc 2a 54 ca a5 0d eb d3 |.roi.X.. .*T.....|
>>> 0050 1c 47 70 cb de 79 3c 54-84 6e 6f 37 d2 5e fc dc |.Gp..y<T .no7.^..|
>>> 0060 b3 d5 5f 82 dc 06 13 2a-73 1e 22 6c 70 78 26 11 |.._....* s."lpx&.|
>>> 0070 81 7b 31 9a cd 49 35 39-dd 25 84 0c 81 4a 41 9e |.{1..I59 .%...JA.|
>>> 0080 b2 a4 28 ce 20 c3 3f d4-23 87 7d de 22 87 cd 24 |..(. .?. #.}."..$|
>>> 0090 31                     -                        |1|
>>>
>>> token.c:337:looking for login token, got  ed(AUTH)
>>> token.c:456:TDS_AUTH_TOKEN PDU size 134
>>> token.c:337:looking for login token, got  60()
>>> token.c:122:tds_process_default_tokens() marker is 60()
>>> util.c:156:Changed query state from IDLE to DEAD
>>> util.c:331:tdserror(0x19149060, 0x1914a440, 20020, 0)
>>> odbc.c:2271:msgno 20020 20003
>>> util.c:361:tdserror: client library returned TDS_INT_CANCEL(2)
>>> util.c:384:tdserror: returning TDS_INT_CANCEL(2)
>>> token.c:256:Unknown marker: 96(60)!!
>>> login.c:460:login packet accepted
>>> == end ==
>>>
>>> Well, not exactly *accepted*.
>>>
>>
>> I see two problems. In gssapi.c tds_gss_handle_next is not expected to
>> receive authentication so it returns fail. In token.c,
>> tds_process_login_tokens fail for tds_process_auth is ignored leading to
>> protocol mismatch. To solve second just remove TDS_AUTH_TOKEN case in
>> tds_process_login_tokens. The first... I don't know, I note in gssapi.c
>> that there are some lines commented out
>>
>> /*
>>        if (maj_stat == GSS_S_CONTINUE_NEEDED) {
>>                if (recv_token(s, &token_flags, &recv_tok) < 0) {
>>                        (void) gss_release_name(&min_stat,
>> &target_name);
>>                        return -1;
>>                }
>>                token_ptr = &recv_tok;
>>        }
>> */
>>
>> Probably recv_token would read our authentication token !!
>>
>> freddy77
>>
>
> Mumble... but is Kerberose the romantic version of Kerberos ?? :)
>
> Try this patch ;-)
>

Tested and committed, works correctly

Frediano
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds