Andrew Stitcher created PROTON-2970:
---------------------------------------
Summary: SASL frames are handled without checking the state of the
protocol exchange
Key: PROTON-2970
URL: https://issues.apache.org/jira/browse/PROTON-2970
Project: Qpid Proton
Issue Type: Bug
Components: proton-c
Reporter: Andrew Stitcher
Assignee: Andrew Stitcher
Fix For: proton-c-0.41.0
Each SASL body handler checks that the frame is one its role can receive - a
server does not expect a mechanisms frame, a client does not expect an init etc.
But it does not check that the frame is one it is expecting at this point in
the protocol exchange.
The handlers should check the state of the exchange as well. A server should
take an init only once it has posted its mechanisms, and a response only once
it has posted a challenge. A client should take a mechanisms frame only before
it has posted anything, and a challenge or an outcome only once it has posted
an init or a response.
Anything else should be PN_ERR, as a frame arriving at the wrong role already
is.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
