Skip Menu |
 

Subject: gss_import_name() does not allow interposition for importing exported names
If gss_import_name() sees that the token is an exported name token,
the helper function importExportName() parses out the mechanism OID
and looks up the mechanism with gssint_get_mechanism(), without
calling gssint_select_mech_type(). As a result, an interposer cannot
interpose this operation.

Complicating matters, after the exported name token is unwrapped and a
mech is selected, the entire name token is passed to the mech, which
then has to unwrap it again. At least the krb5 mech will fail if the
name token is not wrapped with the krb5 mech OID.

We could change all existing mechanisms so that they ignore the
wrapper OID when processing exported name tokens. Alternatively,
after unwrapping the exported token and calling
gssint_select_mech_type(), we could construct a synthetic name token
which is wrapped with the selected mech OID and pass that to the
mechanism.