[
https://issues.apache.org/jira/browse/PROTON-2970?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrew Stitcher resolved PROTON-2970.
-------------------------------------
Resolution: Fixed
> SASL frames are handled without checking the state of the protocol exchange
> ---------------------------------------------------------------------------
>
> Key: PROTON-2970
> URL: https://issues.apache.org/jira/browse/PROTON-2970
> Project: Qpid Proton
> Issue Type: Bug
> Components: proton-c
> Reporter: Andrew Stitcher
> Assignee: Andrew Stitcher
> Priority: Major
> Fix For: proton-c-0.41.0
>
>
> Each SASL body handler checks that the frame is one its role can receive - a
> server does not expect a mechanisms frame, a client does not expect an init
> etc.
> But it does not check that the frame is one it is expecting at this point in
> the protocol exchange.
> The handlers should check the state of the exchange as well. A server should
> take an init only once it has posted its mechanisms, and a response only once
> it has posted a challenge. A client should take a mechanisms frame only
> before it has posted anything, and a challenge or an outcome only once it has
> posted an init or a response.
> Anything else should be PN_ERR, as a frame arriving at the wrong role already
> is.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
