Skip Menu |
 

History Show all quoted text — Show full headers
# Wed Feb 19 13:53:05 2003 <mm@mail.DeuBa.COM> - Ticket created
From: Markus Moeller <mm@mail.DeuBa.COM>
To: krb5-bugs@mit.edu
Subject: Bug in accept_sec_context.c ?
Date: Wed, 19 Feb 2003 18:52:48 +0000
Download (untitled) / with headers
text/plain 979B

Mustn't the below call to krb5_gss_validate_cred use cred_handle and not
verifier_cred_handle ??

Markus


/* handle default cred handle */
if (verifier_cred_handle == GSS_C_NO_CREDENTIAL) {
major_status = krb5_gss_acquire_cred(&code, GSS_C_NO_NAME,
GSS_C_INDEFINITE,
GSS_C_NO_OID_SET,
GSS_C_ACCEPT, &cred_handle,
NULL, NULL);
if (major_status != GSS_S_COMPLETE)
goto fail;
} else {
cred_handle = verifier_cred_handle;
}

Show quoted text
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
/* Bug ? major_status = krb5_gss_validate_cred(&code, verifier_cred_handle);
*/
major_status = krb5_gss_validate_cred(&code, cred_handle);
Show quoted text
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
if (GSS_ERROR(major_status))
goto fail;

cred = (krb5_gss_cred_id_t) cred_handle;
# Tue Feb 25 19:13:45 2003 tlyu (Taylor Yu) - Status changed from 'new' to 'open'
# Tue Feb 25 19:13:45 2003 tlyu (Taylor Yu) - Given to tlyu (Taylor Yu)
# Tue Feb 25 19:13:46 2003 tlyu (Taylor Yu) - Component krb5-libs added
# Tue Feb 25 19:13:46 2003 tlyu (Taylor Yu) - Correspondence added
Download (untitled) / with headers
text/plain 196B
Hm. acquire_cred() seems like it always gives you a valid cred handle
if it succeeds. Probably the thing to do is to validate
verifier_cred_handle in the case where it isn't GSS_C_NO_CREDENTIAL.
# Sat Mar 01 17:15:27 2003 tlyu (Taylor Yu) - Status changed from 'open' to 'resolved'
# Sat Mar 01 17:15:27 2003 tlyu (Taylor Yu) - Correspondence added
From: tlyu@mit.edu
Subject: CVS Commit
Download (untitled) / with headers
text/plain 498B
There isn't really a point to validating cred_handle if it was just
acquired by acquire_cred(), so instead of the suggested patch,
validate verifier_cred_handle only if we didn't acquire_cred().

* accept_sec_context.c (krb5_gss_accept_sec_context): Don't
validate verifier_cred_handle if GSS_C_NO_CREDENTIAL is passed in.


To generate a diff of this commit:



cvs diff -r1.213 -r1.214 krb5/src/lib/gssapi/krb5/ChangeLog
cvs diff -r1.74 -r1.75
krb5/src/lib/gssapi/krb5/accept_sec_context.c
# Wed Mar 12 20:54:02 2003 tlyu (Taylor Yu) - Version_Fixed 1.3 added