[krbdev.mit.edu #8358] [Comment] Report inquire_attrs_for_mech mech failures

[Greg Hudson via RT]

http://kerborg-prod-app-1.mit.edu/rt/Ticket/Display.html?id=8358
This is a comment.  It is not sent to the Requestor(s):

This may need revisiting again.

In the current state (after these commits), an old mech returns GSS_S_COMPLETE
with *mech_attrs and *known_mech_attrs set to GSS_C_NO_OID_SET.  RFC 5587
explicitly allows this for mech_attrs: "the output mech_attrs parameter MAY be
the empty set (GSS_C_NO_OID_SET)".  It does not explicitly allow this for
known_mech_attrs; this is possibly an accidental omission in the RFC.

gss_indicate_mechs_by_attrs() uses generic_gss_test_oid_set_member() on the
values returned by gss_inquire_attrs_for_mech
().  generic_gss_test_oid_set_member() considers set==GSS_C_NO_OID_SET to be a
calling error and
returns GSS_S_CALL_INACCESSIBLE_READ.  gss_indicate_mechs_by_attrs()
interprets any error as equivalent to success with present=0, but the
occurrence of a calling error suggests that either gss_inquire_attrs_for_mech
() is wrong to output GSS_C_NO_OID_SET or that gss_test_oid_set_member() is
wrong to consider set==GSS_C_NO_OID_SET to be an error.

RFC 2743 and 2744 do not say whether gss_test_oid_set_member() should error on
set==GSS_C_NO_OID_SET.  They do not lend any general support to the idea of
using GSS_C_NO_OID_SET as a synonym for the empty set, and gss_acquire_cred()
uses desired_mechs==GSS_C_NO_OID_SET to indicate a default mechanism set, not
the empty set.  So there is a reasonable argument that RFC 5587 should not
have included text permitting GSS_C_NO_OID_SET outputs.

Heimdal's gss_test_oid_set_member() crashes on set==GSS_C_NO_OID_SET, and its
gss_inquire_attrs_for_mech() does not appear to use GSS_C_NO_OID_SET outputs.