rpms/krb5
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- proposed patch to fix receipt of delegated creds in mod_auth_kerb

Browse Source
This commit is contained in:
Nalin Dahyabhai 2007-10-01 19:40:47 +00:00
parent 14a08486e8
commit 1dd0ff3e30
2 changed files with 54 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
krb5-trunk-server_delegation.patch Normal file
View File

@ -0,0 +1,45 @@
If the application calling gss_accept_sec_context() doesn't pass a value
for ret_flags, we'd never be able to check if credentials had been delegated.
The passed-in ret_flags value is a pointer to a bitfield, so the comparision
as-written was not likely to work as expected.
Index: src/lib/gssapi/mechglue/g_accept_sec_context.c
===================================================================
--- src/lib/gssapi/mechglue/g_accept_sec_context.c (revision 20038)
+++ src/lib/gssapi/mechglue/g_accept_sec_context.c (working copy)
@@ -112,6 +112,7 @@
{
OM_uint32 status, temp_status, temp_minor_status;
+ OM_uint32 temp_ret_flags = 0;
gss_union_ctx_id_t union_ctx_id;
gss_union_cred_t union_cred;
gss_cred_id_t input_cred_handle = GSS_C_NO_CREDENTIAL;
@@ -202,7 +203,7 @@
&internal_name,
mech_type,
output_token,
- ret_flags,
+ &temp_ret_flags,
time_rec,
d_cred ? &tmp_d_cred : NULL);
@@ -248,7 +249,7 @@
}
/* Ensure we're returning correct creds format */
- if ((ret_flags && GSS_C_DELEG_FLAG) &&
+ if ((temp_ret_flags & GSS_C_DELEG_FLAG) &&
tmp_d_cred != GSS_C_NO_CREDENTIAL) {
gss_union_cred_t d_u_cred = NULL;
@@ -335,6 +336,8 @@
if (src_name == NULL && tmp_src_name != NULL)
(void) gss_release_name(&temp_minor_status,
&tmp_src_name);
+ if (ret_flags != NULL)
+ *ret_flags = temp_ret_flags;
return (status);
} else {

12
krb5.spec
View File

@ -14,7 +14,7 @@
Summary: The Kerberos network authentication system.
Name: krb5
Version: 1.6.2
Release: 8%{?dist}
Release: 9%{?dist}
# Maybe we should explode from the now-available-to-everybody tarball instead?
# http://web.mit.edu/kerberos/dist/krb5/1.6/krb5-1.6.2-signed.tar
Source0: krb5-%{version}.tar.gz
@ -92,6 +92,7 @@ Patch61: krb5-trunk-manpaths.patch
Patch62: krb5-any-fixup-patch.txt
Patch63: krb5-1.6.1-selinux-label.patch
Patch64: krb5-ok-as-delegate.patch
Patch67: krb5-trunk-server_delegation.patch
License: MIT, freely distributable.
URL: http://web.mit.edu/kerberos/www/
@ -208,6 +209,10 @@ installed on systems which are meant provide these services.
%endif
%changelog
* Mon Oct 1 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-9
- apply the fix for CVE-2007-4000 instead of the experimental patch for
setting ok-as-delegate flags
* Tue Sep 11 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-8
- move the db2 kdb plugin from -server to -libs, because a multilib libkdb
might need it
@ -1226,14 +1231,15 @@ popd
%patch51 -p0 -b .ldap_init
%patch52 -p0 -b .ldap_man
%patch53 -p1 -b .nodeplibs
%patch64 -p0 -b .2007-3999-2
%patch65 -p0 -b .2007-4000
%patch65 -p0 -b .2007-3999-2
%patch66 -p0 -b .2007-4000
#%patch55 -p1 -b .empty
#%patch56 -p1 -b .doublelog
#%patch57 -p1 -b .login_chdir
#%patch58 -p1 -b .key_exp
#%patch59 -p0 -b .kpasswd_tcp
#%patch64 -p0 -b .ok-as-delegate
#%patch67 -p0 -b .server-delegation
cp src/krb524/README README.krb524
gzip doc/*.ps