Limit use of deprecated krb5 mech OIDs

Filter out mechs with the GSS_C_MA_DEPRECATED attribute from the set
of mechanisms obtained by SPNEGO, and from the set used when
gss_acquire_cred() is called with no desired_mechs attribute.

SPNEGO acceptors will still accept the old and wrong krb5 OIDs, but
SPNEGO initiators will not offer them.  According to [MS-SPNG], only
Windows 2000 does not recognize the standard krb5 OID, and it is
client-only.

In gss-client.c, use the standard krb5 OID for the -krb5 option, as
acceptors who call gss_acquire_cred() with no desired_mechs to create
an acceptor cred will no longer accept the old or wrong krb5 OIDs.

ticket: 8217 (new)

diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c
index 6070d428c81c7264b3c71e62783bb7ea5f5fc1b1..c96da88aa27ac0c9100fc8d1decc568f927cadc6 100644 (file)
--- a/src/appl/gss-sample/gss-client.c
+++ b/src/appl/gss-sample/gss-client.c
@@ -816,7 +816,7 @@ main(argc, argv)
         } else if (strcmp(*argv, "-spnego") == 0) {
             spnego = 1;
         } else if (strcmp(*argv, "-krb5") == 0) {
-            mechanism = "{ 1 3 5 1 5 2 }";
+            mechanism = "{ 1 2 840 113554 1 2 2 }";
 #ifdef _WIN32
         } else if (strcmp(*argv, "-threads") == 0) {
             argc--;

diff --git a/src/lib/gssapi/mechglue/g_acquire_cred.c b/src/lib/gssapi/mechglue/g_acquire_cred.c
index b9a3142a9dc41ce6f8c59a2f9c250d5092d83f2f..22be5b4717c2f5c6323d3fa508932a55da1f49d8 100644 (file)
--- a/src/lib/gssapi/mechglue/g_acquire_cred.c
+++ b/src/lib/gssapi/mechglue/g_acquire_cred.c
@@ -135,6 +135,8 @@ OM_uint32 *                 time_rec;
     OM_uint32 first_major = GSS_S_COMPLETE, first_minor = 0;
     OM_uint32 initTimeOut, acceptTimeOut, outTime = GSS_C_INDEFINITE;
     gss_OID_set mechs = GSS_C_NO_OID_SET;
+    gss_OID_set_desc except_attrs;
+    gss_OID_desc attr_oids[1];
     unsigned int i;
     gss_union_cred_t creds = NULL;
 
@@ -152,10 +154,15 @@ OM_uint32 *                       time_rec;
 
     /*
      * if desired_mechs equals GSS_C_NULL_OID_SET, then try to
-     * acquire credentials for all mechanisms.
+     * acquire credentials for all non-deprecated mechanisms.
      */
     if (desired_mechs == GSS_C_NULL_OID_SET) {
-       major = gss_indicate_mechs(minor_status, &mechs);
+       attr_oids[0] = *GSS_C_MA_DEPRECATED;
+       except_attrs.count = 1;
+       except_attrs.elements = attr_oids;
+       major = gss_indicate_mechs_by_attrs(minor_status, GSS_C_NO_OID_SET,
+                                           &except_attrs, GSS_C_NO_OID_SET,
+                                           &mechs);
        if (major != GSS_S_COMPLETE)
            goto cleanup;
     } else

diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index bf44bc0b535d8b6bbdd562b7cd05a747bb16bd95..9a794abdc5069e026d24f744c03d3c05a0d0a60b 100644 (file)
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -2995,7 +2995,7 @@ release_spnego_ctx(spnego_gss_ctx_id_t *ctx)
  * SPNEGO because it will also return the SPNEGO mech and we do not
  * want to consider SPNEGO as an available security mech for
  * negotiation. For this reason, get_available_mechs will return
- * all available mechs except SPNEGO.
+ * all available, non-deprecated mechs except SPNEGO.
  *
  * If a ptr to a creds list is given, this function will attempt
  * to acquire creds for the creds given and trim the list of
@@ -3012,8 +3012,16 @@ get_available_mechs(OM_uint32 *minor_status,
        int             found = 0;
        OM_uint32 major_status = GSS_S_COMPLETE, tmpmin;
        gss_OID_set mechs, goodmechs;
-
-       major_status = gss_indicate_mechs(minor_status, &mechs);
+       gss_OID_set_desc except_attrs;
+       gss_OID_desc attr_oids[1];
+
+       attr_oids[0] = *GSS_C_MA_DEPRECATED;
+       except_attrs.count = 1;
+       except_attrs.elements = attr_oids;
+       major_status = gss_indicate_mechs_by_attrs(minor_status,
+                                                  GSS_C_NO_OID_SET,
+                                                  &except_attrs,
+                                                  GSS_C_NO_OID_SET, &mechs);
 
        if (major_status != GSS_S_COMPLETE) {
                return (major_status);