[18912] in Kerberos_V5_Development
Re: [PATCH] Fix SPNEGO interoperability with servers implementing
daemon@ATHENA.MIT.EDU (Greg Hudson)
Fri Jul 25 20:02:11 2014
Message-ID: <53D2EFF4.6050605@mit.edu>
Date: Fri, 25 Jul 2014 20:01:56 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: David Woodhouse <dwmw2@infradead.org>
In-Reply-To: <1406330814.9484.19.camel@infradead.org>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 07/25/2014 07:26 PM, David Woodhouse wrote:
> Looking at handle_mic(), I think our implementation will return
> GSS_S_DEFECTIVE_TOKEN if it sees a final mechanism token without the MIC
> attached. It doesn't return GSS_S_CONTINUE_NEEDED and hope for the MIC
> to come in later on its own. I don't think that's even possible.
The server appears to do so if it sends the final mech token. It has
to; the client can't necessarily produce a MIC until the context is
established.
(My reasoning, with line numbers from current master: handle_mic decides
to reject at line 528 if no token is to be sent, but continues on if a
token is to be sent. At line 559, it decides to respond with
ACCEPT_INCOMPLETE if a MIC is required.)
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
