28712569049

Committed 04 Jul 2026 04:32PM UTC coverage: 75.404% (+0.01%) from 75.394%

Build # 28712569049

Build Type

push

github

Committed by

bluca

Commit Message

Fix GSSAPI ZAP auth: honour negative ZAP responses

When a ZAP handler returned 300/400/500, gssapi_server_t ignored the
denial and transitioned to send_ready anyway, allowing the connection
to proceed unauthenticated.

Root cause: unlike PLAIN/CURVE (which use zap_client_common_handshake_t
and override handle_zap_status_code to update the state machine),
gssapi_server_t inherits directly from zap_client_t whose
handle_zap_status_code only fires a monitor event without touching
the GSSAPI state machine.

Fix both paths where ZAP is consulted:

1. Synchronous reply (process_handshake_command): check status_code
   after receive_and_process_zap_reply() succeeds; go to send_ready
   only on "2xx", otherwise go to the new `closing` state.

2. Asynchronous reply (zap_msg_available): same status_code check
   instead of always setting send_ready.

Add a `closing` state to the state machine and make status() return
mechanism_t::error for it so the session tears down the connection.

Coverage Stats

15151 of 20093 relevant lines covered (75.4%)

30955.76 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/libzmq/src/gssapi_server.cpp

Source Not Available

The file "libzmq/src/gssapi_server.cpp" isn't available on github. Either it's been removed, or the repo root directory needs to be updated.

zeromq / libzmq / 28712569049

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available

Source File
Press 'n' to go to next uncovered line, 'b' for previous