To: krb5-bugs@MIT.EDU
Subject: Behavior change: gssapi context expiration
Date: Tue,  8 Jun 2010 11:45:14 -0400 (EDT)
From: hartmans@MIT.EDU (Sam Hartman)



discussion at the Kerberos upgrade event strongly suggests that
everyone would be happier if gss_wrap and gss_get_mic worked even
after conxet expriation.

--Sam

From: ghudson@mit.edu
Subject: SVN Commit


Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech.  Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires.  In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.


http://src.mit.edu/fisheye/changelog/krb5/?cs=24120
Commit By: ghudson
Revision: 24120
Changed Files:
U   trunk/src/lib/gssapi/krb5/k5unsealiov.c

From: ghudson@mit.edu
Subject: SVN Commit


Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech.  Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires.  In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.

(This is a continuation of r24120, which should have contained the
changes to all four files.)


http://src.mit.edu/fisheye/changelog/krb5/?cs=24121
Commit By: ghudson
Revision: 24121
Changed Files:
U   trunk/src/lib/gssapi/krb5/k5seal.c
U   trunk/src/lib/gssapi/krb5/k5sealiov.c
U   trunk/src/lib/gssapi/krb5/k5unseal.c

From: tlyu@mit.edu
Subject: SVN Commit


pull up r24120, r24121 from trunk

 ------------------------------------------------------------------------
 r24120 | ghudson | 2010-06-08 12:14:24 -0400 (Tue, 08 Jun 2010) | 12 lines

 ticket: 6739
 target_version: 1.8.2
 tags: pullup

 Stop checking the current time against the context expiration time in
 the message wrap/unwrap functions in the krb5 GSS mech.  Heimdal
 doesn't do it, and it generally results in poor app behavior when a
 ticket expires.  In exchange, it doesn't provide much security benefit
 since it's not enforced across the board--for example, ssh sessions
 can persist beyond ticket expiration time since they don't use GSS to
 wrap payload data.

http://src.mit.edu/fisheye/changelog/krb5/?cs=24130
Commit By: tlyu
Revision: 24130
Changed Files:
U   branches/krb5-1-8/src/lib/gssapi/krb5/k5seal.c
U   branches/krb5-1-8/src/lib/gssapi/krb5/k5sealiov.c
U   branches/krb5-1-8/src/lib/gssapi/krb5/k5unseal.c
U   branches/krb5-1-8/src/lib/gssapi/krb5/k5unsealiov.c