RFC Errata


Errata Search

 
Source of RFC  
Summary Table Full Records

RFC 2743, "Generic Security Service Application Program Interface Version 2, Update 1", January 2000

Note: This RFC has been updated by RFC 5554, RFC 5896

Source of RFC: cat (sec)
See Also: RFC 2743 w/ inline errata

Errata ID: 4151
Status: Verified
Type: Technical
Publication Format(s) : TEXT

Reported By: Nicolas Williams
Date Reported: 2014-11-03
Verifier Name: Stephen Farrell
Date Verified: 2015-05-01

Section 2.2.4 says:

   o  GSS_S_FAILURE indicates that the context is recognized, but that
   the GSS_Process_context_token() operation could not be performed for
   reasons unspecified at the GSS-API level.

It should say:

   o  GSS_S_FAILURE indicates that the context is recognized, but
   either the GSS_Process_context_token() operation could not be
   performed for reasons unspecified at the GSS-API level, or the peer
   had an error consuming the last context token sent to it.  The latter
   occurs when the local side became fully established and produced one
   last token which was sent to the peer, but the peer encountered an
   error while processing that last context token.  In either case the
   minor status code provides additional information.

   In the case of successful processing of error tokens, the minor
   status code provides information from the input token.  The display
   string outputs of GSS_Display_status() as applied to such minor
   status codes should indicate that the error originated on the remote
   peer, along with the nature of the error.  Note that there is no
   way to distinguish failures of GSS_Process_context_token() from
   error token information other than to read the human-readable status
   display strings.

Notes:

The other major status codes that GSS_Process_context_token() can return are: GSS_S_COMPLETE (input token successfully processed), GSS_S_DEFECTIVE_TOKEN (e.g., integrity protection for the input token failed), GSS_S_NO_CONTEXT (invalid input security context).

This leaves a) no way to report error token information, b) no purpose for GSS_S_FAILURE, since the other major status codes cover all plausible error conditions.

But clearly the intention was that "asynchronous error tokens" should be passed to GSS_Process_context_token(), and for such tokens to be useful as far as conveying information about the error goes.

There are at least two easy ways to fix this: either have GSS_Process_context_token() report the error information in the minor status with a major status of GSS_S_COMPLETE, or decide that the GSS_S_FAILURE description was incorrect, that it should have been used to convey error token information. The latter is the more natural fix.

The KITTEN WG will have to review this erratum and decide whether to reject it, accept one fix, or the other. That review happened resulting in the corrected
text above.

Report New Errata



Advanced Search