Re: Note about auth refcounting state / ntlm in trunk

From: Henrik Nordström <henrik_at_henriknordstrom.net>
Date: Mon, 16 Aug 2010 02:51:33 +0200

sön 2010-08-15 klockan 23:26 +0000 skrev Amos Jeffries:

> > - Fails if external acls is used (any, not just with grace=.. as in 3.1)
>
> any ideas why?

No, haven't really dug into the code yet. Was just observing to verify
that the claims in 2936 could be reproduced and found a much worse
situation than expected.

> > - Fails with refcount error on second NTLM handshake.
>
> If I've been following the snippets in IRC right, this is due to the
> absorb() function which attempts to combine duplicate credentials and
> maintain a single state. Which requires that the absorbed credentials be
> discarded immediately after. The assert is there to make it obvious when
> this requirement is broken.

Design error?

Was too long since I was in NTLM/Negotiate land (haven't seriously
touched it since throwing out the challenge reuse layer years ago) and
no longer remembers the details about this temp credentials and
absorbing.. but I do have a memory of it being a bit strange.

Regards
Henrik
Received on Mon Aug 16 2010 - 00:51:37 MDT

This archive was generated by hypermail 2.2.0 : Mon Aug 16 2010 - 12:00:04 MDT