]> git.ipfire.org Git - thirdparty/krb5.git/commit
Skip unnecessary mech calls in gss_inquire_cred()
authorGreg Hudson <ghudson@mit.edu>
Mon, 29 Feb 2016 21:51:22 +0000 (16:51 -0500)
committerTom Yu <tlyu@mit.edu>
Wed, 13 Apr 2016 20:32:47 +0000 (16:32 -0400)
commitdd51cee8414b37e7ff4ffb8b2d1b0659b106f87c
tree3a008423b4f959b0dd6fa4356bdf424f3e28cc1a
parent6b845fa4fa768a0b757645e3e2430c2aee383855
Skip unnecessary mech calls in gss_inquire_cred()

If the caller does not request a name, lifetime, or cred_usage when
calling gss_inquire_cred(), service the call by copying the mechanism
list (if requested) but do not call into the mech.

This change alleviates an issue (reported by Adam Bernstein) where
SPNEGO can fail in the presence of expired krb5 credentials rather
than proceeding with a different mechanism, or can resolve a krb5
credential without the benefit of the target name.

(cherry picked from commit ff5eb892910eeac335d989ae14020da4ffbcc8ec)

ticket: 8373
version_fixed: 1.13.5
status: resolved
tags: -pullup
src/lib/gssapi/mechglue/g_inq_cred.c