rpms/krb5
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport OID mech fix

Browse Source 
Resolves: #1317609
This commit is contained in:
Robbie Harwood 2016-03-17 17:17:27 +00:00
parent f1cb770b53
commit 7b4e88e425
2 changed files with 46 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
krb5-1.14.2-Revisit-inquire_attrs_for_mech-on-old-mechs.patch Normal file
View File

@ -0,0 +1,39 @@
From 89683d1f135765e91041f3a239af865b11aaf86b Mon Sep 17 00:00:00 2001
From: Greg Hudson <ghudson@mit.edu>
Date: Tue, 15 Mar 2016 17:45:26 -0400
Subject: [PATCH] Revisit inquire_attrs_for_mech on old mechs
In gss_inquire_attrs_for_mech(), if the mech does not implement RFC
5587, return success with empty mech_attrs and known_mech_attrs sets
to indicate a lack of knowledge for all attributes. The previous
behavior of returning an error caused gss_indicate_mechs_by_attr() to
fail out in the presence of an old mechanism, in turn causing
gss_acquire_cred() and SPNEGO to break.
ticket: 8358
---
src/lib/gssapi/mechglue/g_mechattr.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/lib/gssapi/mechglue/g_mechattr.c b/src/lib/gssapi/mechglue/g_mechattr.c
index 08a6008..e49651e 100644
--- a/src/lib/gssapi/mechglue/g_mechattr.c
+++ b/src/lib/gssapi/mechglue/g_mechattr.c
@@ -181,8 +181,12 @@ gss_inquire_attrs_for_mech(
mech = gssint_get_mechanism(selected_mech);
if (mech == NULL)
return GSS_S_BAD_MECH;
- else if (mech->gss_inquire_attrs_for_mech == NULL)
- return GSS_S_UNAVAILABLE;
+
+ /* If the mech does not implement RFC 5587, return success with an empty
+ * mech_attrs and known_mech_attrs. */
+ if (mech->gss_inquire_attrs_for_mech == NULL)
+ return GSS_S_COMPLETE;
+
public_mech = gssint_get_public_oid(selected_mech);
status = mech->gss_inquire_attrs_for_mech(minor, public_mech, mech_attrs,
known_mech_attrs);
--
2.7.0

8
krb5.spec
View File

@ -13,7 +13,7 @@
Summary: The Kerberos network authentication system
Name: krb5
Version: 1.14.1
Release: 1%{?dist}
Release: 2%{?dist}
# - Maybe we should explode from the now-available-to-everybody tarball instead?
# http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13.2-signed.tar
# - The sources below are stored in a lookaside cache. Upload with
@ -64,6 +64,7 @@ Patch158: krb5-1.14.1-interpose-enable-inquire_attrs_for_mech.patch
Patch159: krb5-1.14.1-interpose-fix-inquire_attrs_for_mech.patch
Patch160: krb5-1.14.1-interpose-inquire_saslname_for_mech.patch
Patch161: krb5-1.14.1-interpose-public_oid_fixups.patch
Patch162: krb5-1.14.2-Revisit-inquire_attrs_for_mech-on-old-mechs.patch
License: MIT
URL: http://web.mit.edu/kerberos/www/
@ -244,6 +245,7 @@ ln NOTICE LICENSE
%patch159 -p1 -b .interpose-fix-inquire_attrs_for_mech
%patch160 -p1 -b .interpose-inquire_saslname_for_mech
%patch161 -p1 -b .interpose-public_oid_fixups
%patch162 -p1 -b .inquire_attrs_for_mech-on-old-mechs
# Take the execute bit off of documentation.
chmod -x doc/krb5-protocol/*.txt doc/ccapi/*.html
@ -766,6 +768,10 @@ exit 0
%changelog
* Thu Mar 17 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-2
- Backport OID mech fix
- Resolves: #1317609
* Mon Feb 29 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-1
- New rawhide, new upstream version
- Drop CVE patches