Ticket History #6739: Behavior change: gssapi context expiration

discussion at the Kerberos upgrade event strongly suggests that
everyone would be happier if gss_wrap and gss_get_mic worked even
after conxet expriation.

--Sam

Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech. Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires. In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.

(This is a continuation of r24120, which should have contained the
changes to all four files.)


https://github.com/krb5/krb5/commit/c38c2428d55cc3fa5440907e42d15e9a2e882084
Commit By: ghudson
Revision: 24121
Changed Files:
U trunk/src/lib/gssapi/krb5/k5seal.c
U trunk/src/lib/gssapi/krb5/k5sealiov.c
U trunk/src/lib/gssapi/krb5/k5unseal.c

pull up r24120, r24121 from trunk

------------------------------------------------------------------------
r24120 | ghudson | 2010-06-08 12:14:24 -0400 (Tue, 08 Jun 2010) | 12 lines

ticket: 6739
target_version: 1.8.2
tags: pullup

Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech. Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires. In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.

https://github.com/krb5/krb5/commit/ceff515f891f63558afe4d2b0f5869d37f30cd69
Commit By: tlyu
Revision: 24130
Changed Files:
U branches/krb5-1-8/src/lib/gssapi/krb5/k5seal.c
U branches/krb5-1-8/src/lib/gssapi/krb5/k5sealiov.c
U branches/krb5-1-8/src/lib/gssapi/krb5/k5unseal.c
U branches/krb5-1-8/src/lib/gssapi/krb5/k5unsealiov.c