Skip Menu |
 

Subject: gss_accept_sec_context doesn't produce error tokens
Date: Mon, 5 Apr 2010 19:15:11 -0400
From: "Arlene Berry" <aberry@likewise.com>
To: <krb5-bugs@mit.edu>

The mechglue for gss_accept_sec_context suppresses error tokens which means that an initiator who is waiting for a response after receiving GSS_S_CONTINUE­_NEEDED is never notified that there’s a problem.  It appears the code has been this way ever since the mechglue was introduced.  This fixes it for me:

 

Index: g_accept_sec_context.c

===================================================================

--- g_accept_sec_context.c         (revision 42878)

+++ g_accept_sec_context.c      (working copy)

@@ -385,9 +385,6 @@

                free(union_ctx_id);

     }

 

-    if (output_token->length)

-              (void) gss_release_buffer(&temp_minor_status, output_token);

-

     if (src_name)

                *src_name = GSS_C_NO_NAME;

 

From: tlyu@mit.edu
Subject: SVN Commit

Apply patch from Arlene Berry to cease freeing error tokens output by
accept_sec_context, allowing them to actually be sent to the
initiator.

https://github.com/krb5/krb5/commit/29cde7afd9e12eaf9a1aee2efe780a26bbe87f8f
Commit By: tlyu
Revision: 23925
Changed Files:
U trunk/src/lib/gssapi/mechglue/g_accept_sec_context.c
From: tlyu@mit.edu
Subject: SVN Commit

pull up r23925 from trunk

------------------------------------------------------------------------
r23925 | tlyu | 2010-04-22 16:04:01 -0400 (Thu, 22 Apr 2010) | 8 lines

ticket: 6696
target_version: 1.8.2
tags: pullup

Apply patch from Arlene Berry to cease freeing error tokens output by
accept_sec_context, allowing them to actually be sent to the
initiator.

https://github.com/krb5/krb5/commit/3401907d2433bb23762edfc453b6da965fcef18a
Commit By: tlyu
Revision: 24057
Changed Files:
U branches/krb5-1-8/src/lib/gssapi/mechglue/g_accept_sec_context.c