Skip to content

Commit

Permalink
Revisit inquire_attrs_for_mech on old mechs
Browse files Browse the repository at this point in the history
In gss_inquire_attrs_for_mech(), if the mech does not implement RFC
5587, return success with empty mech_attrs and known_mech_attrs sets
to indicate a lack of knowledge for all attributes.  The previous
behavior of returning an error caused gss_indicate_mechs_by_attr() to
fail out in the presence of an old mechanism, in turn causing
gss_acquire_cred() and SPNEGO to break.

ticket: 8358
  • Loading branch information
greghudson committed Mar 17, 2016
1 parent 1825258 commit 89683d1
Showing 1 changed file with 6 additions and 2 deletions.
8 changes: 6 additions & 2 deletions src/lib/gssapi/mechglue/g_mechattr.c
Original file line number Diff line number Diff line change
Expand Up @@ -181,8 +181,12 @@ gss_inquire_attrs_for_mech(
mech = gssint_get_mechanism(selected_mech);
if (mech == NULL)
return GSS_S_BAD_MECH;
else if (mech->gss_inquire_attrs_for_mech == NULL)
return GSS_S_UNAVAILABLE;

/* If the mech does not implement RFC 5587, return success with an empty
* mech_attrs and known_mech_attrs. */
if (mech->gss_inquire_attrs_for_mech == NULL)
return GSS_S_COMPLETE;

public_mech = gssint_get_public_oid(selected_mech);
status = mech->gss_inquire_attrs_for_mech(minor, public_mech, mech_attrs,
known_mech_attrs);
Expand Down

0 comments on commit 89683d1

Please sign in to comment.