28712569049
75%

Ran 04 Jul 2026 04:35PM UTC

Jobs 1

Files 217

Run time 1min

Badge

Embed ▾

Committed 04 Jul 2026 04:32PM UTC coverage: 75.404% (+0.01%) from 75.394%

Build # 28712569049

Build Type

push

github

Committed by

bluca

Commit Message

Fix GSSAPI ZAP auth: honour negative ZAP responses

When a ZAP handler returned 300/400/500, gssapi_server_t ignored the
denial and transitioned to send_ready anyway, allowing the connection
to proceed unauthenticated.

Root cause: unlike PLAIN/CURVE (which use zap_client_common_handshake_t
and override handle_zap_status_code to update the state machine),
gssapi_server_t inherits directly from zap_client_t whose
handle_zap_status_code only fires a monitor event without touching
the GSSAPI state machine.

Fix both paths where ZAP is consulted:

1. Synchronous reply (process_handshake_command): check status_code
   after receive_and_process_zap_reply() succeeds; go to send_ready
   only on "2xx", otherwise go to the new `closing` state.

2. Asynchronous reply (zap_msg_available): same status_code check
   instead of always setting send_ready.

Add a `closing` state to the state machine and make status() return
mechanism_t::error for it so the session tears down the connection.

Coverage Stats

15151 of 20093 relevant lines covered (75.4%)

30955.76 hits per line

Coverage Regressions

Lines	Coverage	∆	File
27	0.0	0.0%	libzmq/src/gssapi_server.cpp

Jobs

ID	Job ID	Ran	Files	Coverage
1	28712569049.1	04 Jul 2026 04:35PM UTC	217	75.4	GitHub Action Run

zeromq / libzmq / 28712569049
75%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 28712569049

zeromq / libzmq / 28712569049 75%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 28712569049

zeromq / libzmq / 28712569049
75%

README BADGES
x