From: Ondřej Surý <ondrej@isc.org>
Date: Fri, 1 May 2026 06:51:33 +0000 (+0200)
Subject: chg: dev: Harden GSS-API context establishment in TKEY negotiation
X-Git-Tag: v9.21.22~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9212e1ac506abe0f521960f982ba3e3e6c843694;p=thirdparty%2Fbind9.git

chg: dev: Harden GSS-API context establishment in TKEY negotiation

Implement RFC 3645 Section 3.1.1 client-side check for REPLAY, MUTUAL, and INTEG flags after gss_init_sec_context() completes.  Add server-side INTEG flag check after gss_accept_sec_context().  Also fixes an uninitialized gss_name_t on the error path in dst_gssapi_initctx().

Merge branch 'ondrej/harden-gssapi-integration' into 'security-main'

See merge request isc-private/bind9!978
---

9212e1ac506abe0f521960f982ba3e3e6c843694