[krbdev.mit.edu #5629] gss_init_sec_context does not release output token buffer when used with spnego mech

Mon Aug 6 19:43:15 EDT 2007

>From krb5-bugs-incoming-bounces at PCH.MIT.EDU  Mon Aug  6 19:42:58 2007
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP
	id l76NgwHW021368; Mon, 6 Aug 2007 19:42:58 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
	by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l76NgrTi005811;
	Mon, 6 Aug 2007 19:42:53 -0400
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
	[18.7.21.83])
	by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l76NdZ07005272
	for <krb5-bugs-incoming at PCH.mit.edu>; Mon, 6 Aug 2007 19:39:35 -0400
Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112])
	by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id
	l76NdXZ9015072
	for <krb5-bugs at mit.edu>; Mon, 6 Aug 2007 19:39:33 -0400 (EDT)
Received: from ptb-relay03.plus.net (ptb-relay03.plus.net [212.159.14.214])
	(using TLSv1 with cipher AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mit.edu (Spam Firewall) with ESMTP id 4C5D16DCD72
	for <krb5-bugs at mit.edu>; Mon,  6 Aug 2007 19:39:32 -0400 (EDT)
Received: from [81.174.172.105] (helo=opensuse.suse.home)
	by ptb-relay03.plus.net with esmtp (Exim) id 1IICAa-00067M-JK
	for krb5-bugs at mit.edu; Tue, 07 Aug 2007 00:39:28 +0100
Received: by opensuse.suse.home (Postfix, from userid 1000)
	id D6ED1B840A; Tue,  7 Aug 2007 00:39:07 +0100 (BST)
To: krb5-bugs at mit.edu
From: huaraz at moeller.plus.com
X-send-pr-version: 3.99
Message-Id: <20070806233907.D6ED1B840A at opensuse.suse.home>
Date: Tue,  7 Aug 2007 00:39:07 +0100 (BST)
X-Spam-Score: 2.002
X-Spam-Level: ** (2.002)
X-Spam-Flag: NO
X-Scanned-By: MIMEDefang 2.42
X-Mailman-Approved-At: Mon, 06 Aug 2007 19:42:51 -0400
X-BeenThere: krb5-bugs-incoming at mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: huaraz at moeller.plus.com
Sender: krb5-bugs-incoming-bounces at PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces at PCH.MIT.EDU


>Submitter-Id:	net
>Originator:	Markus Moeller
>Organization:  privat
>Confidential:	no
>Synopsis:	gss_init_sec_context does not release output token buffer when used with spnego mech
>Severity:	non-critical 
>Priority:	medium
>Category:	krb5-libs
>Class:		sw-bug
>Release:	1.6.1
>Environment:   i686 GNU/Linux
System: Linux OpenSuse 2.6.18.8-0.3-default #1 SMP Tue Apr 17 08:42:35 UTC 2007 i686 i686 i386 GNU/Linux
Architecture: i686

>Description:  When creating gss context for spnego mechanism the output token is not released
>How-To-Repeat: Use following code 

static gss_OID_desc _gss_mech_spnego  = {6, (void 
*)"\x2b\x06\x01\x05\x05\x02"};
gss_OID gss_mech_spnego = &_gss_mech_spnego;

const char *create_token(int spnego, const char *server) {
 OM_uint32 major_status, minor_status;
 gss_ctx_id_t          gss_context = GSS_C_NO_CONTEXT;
 gss_name_t            server_name = GSS_C_NO_NAME;
 gss_buffer_desc       service = GSS_C_EMPTY_BUFFER;
 gss_buffer_desc       input_token = GSS_C_EMPTY_BUFFER;
 gss_buffer_desc       output_token = GSS_C_EMPTY_BUFFER;
 const char   *token = NULL;

  setbuf(stdout,NULL);
  setbuf(stdin,NULL);

  if (!server) {
     fprintf(stderr, "%s| %s: Error: No server name\n", LogTime(), PROGRAM);
     return NULL;
  }

  service.value = malloc(strlen("HTTP")+strlen(server)+2);
  snprintf(service.value,strlen("HTTP")+strlen(server)+2,"%s@%s","HTTP",server);
  service.length = strlen((char *)service.value);

  major_status = gss_import_name(&minor_status, &service,
                                 gss_nt_service_name, &server_name);

  if (check_gss_err(major_status,minor_status,"gss_import_name()") )
      goto cleanup;
  if (spnego) {
  major_status = gss_init_sec_context(&minor_status,
                                      GSS_C_NO_CREDENTIAL,
                                      &gss_context,
                                      server_name,
                                      gss_mech_spnego,
                                      0,
                                      0,
                                      GSS_C_NO_CHANNEL_BINDINGS,
                                      &input_token,
                                      NULL,
                                      &output_token,
                                     NULL,
                                      NULL);
  } else {
  major_status = gss_init_sec_context(&minor_status,
                                      GSS_C_NO_CREDENTIAL,
                                      &gss_context,
                                      server_name,
                                      GSS_C_NO_OID,
                                      0,
                                      0,
                                      GSS_C_NO_CHANNEL_BINDINGS,
                                      &input_token,
                                      NULL,
                                      &output_token,
                                      NULL,
                                      NULL);
  }
  if (check_gss_err(major_status,minor_status,"gss_init_sec_context()") )
      goto cleanup;

  if (output_token.length) {

      token = "OK";
  }


cleanup:
  gss_delete_sec_context(&minor_status, &gss_context, NULL);
  gss_release_buffer(&minor_status, &service);
  gss_release_buffer(&minor_status, &input_token);
  gss_release_buffer(&minor_status, &output_token);
  gss_release_name(&minor_status, &server_name);

  return token;
}
int main(int argc, char *argv[]) {

   const char *Token;
   int opt,i=10;
   int spnego=0;

   while (-1 != (opt = getopt(argc, argv, "s"))) {
    switch (opt) {
    case 's':
      spnego = 1;
      break;
    default:
      fprintf(stderr, "%s| %s: unknown option: -%c.\n", LogTime(), PROGRAM, opt);
    }
  }

   fprintf(stdout,"Spnego : %d\n",spnego);
   while (i--) {
   Token = (const char *)create_token(spnego,"w2k3.windows2003.home");
   fprintf(stdout,"Token: %s\n",Token);
   }
   return(0);
}


>Fix: None