]> git.ipfire.org Git - thirdparty/krb5.git/commit
Skip unnecessary mech calls in gss_inquire_cred() 418/head
authorGreg Hudson <ghudson@mit.edu>
Mon, 29 Feb 2016 21:51:22 +0000 (16:51 -0500)
committerGreg Hudson <ghudson@mit.edu>
Thu, 7 Apr 2016 20:52:21 +0000 (16:52 -0400)
commitff5eb892910eeac335d989ae14020da4ffbcc8ec
tree80aa9e0361a5418f75b62c209f9e7b26b8625e48
parent048049230d7e60c90ad40e6c3b7a8a43c4c5af5b
Skip unnecessary mech calls in gss_inquire_cred()

If the caller does not request a name, lifetime, or cred_usage when
calling gss_inquire_cred(), service the call by copying the mechanism
list (if requested) but do not call into the mech.

This change alleviates an issue (reported by Adam Bernstein) where
SPNEGO can fail in the presence of expired krb5 credentials rather
than proceeding with a different mechanism, or can resolve a krb5
credential without the benefit of the target name.

ticket: 8373
target_version: 1.14-next
target_version: 1.13-next
tags: pullup
src/lib/gssapi/mechglue/g_inq_cred.c