[29240] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.14]: Fix interposed gss_accept_sec_context()
daemon@ATHENA.MIT.EDU (Tom Yu)
Thu Jan 7 16:28:17 2016
Date: Thu, 7 Jan 2016 16:28:13 -0500
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201601072128.u07LSDW4005441@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/d0daf73db55d8d67220e327e8c0a021e71041024
commit d0daf73db55d8d67220e327e8c0a021e71041024
Author: Robbie Harwood <rharwood@redhat.com>
Date: Wed Dec 16 19:31:22 2015 -0500
Fix interposed gss_accept_sec_context()
If gss_accept_sec_context() is interposed, selected_mech will be an
interposer OID. In this situation, pass the corresponding public OID
to gss_inquire_attrs_for_mech() to determine whether the mech is
allowed by default.
[ghudson@mit.edu: pared down from larger commit; rewrote commit message]
(cherry picked from commit 0b43d10333f4c4b29896cebc9447d8866b661217)
ticket: 8338
version_fixed: 1.14.1
src/lib/gssapi/mechglue/g_accept_sec_context.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c
index 6c72d1f..ddaf874 100644
--- a/src/lib/gssapi/mechglue/g_accept_sec_context.c
+++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c
@@ -94,6 +94,12 @@ allow_mech_by_default(gss_OID mech)
gss_OID_set attrs;
int reject = 0, p;
+ /* Whether we accept an interposer mech depends on whether we accept the
+ * mech it interposes. */
+ mech = gssint_get_public_oid(mech);
+ if (mech == GSS_C_NO_OID)
+ return 0;
+
status = gss_inquire_attrs_for_mech(&minor, mech, &attrs, NULL);
if (status)
return 0;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
