[krbdev.mit.edu #6603] SVN Commit

[Tom Yu via RT]

pull up r23742 from trunk

 ------------------------------------------------------------------------
 r23742 | ghudson | 2010-02-21 23:52:30 -0500 (Sun, 21 Feb 2010) | 24 lines

 ticket: 6603
 target_version: 1.8
 tags: pullup

 Fix two unrelated problems in SPNEGO which don't crop up with the krb5
 mechanism.

 1. The third call to spnego_init_accept_context uses faulty logic to
 determine if the exchange is complete, preventing a third mech token
 from being sent to the acceptor if no MIC exchange is required.
 Follow the logic used in the second call (in init_ctx_nego), which is
 correct.

 2. If the acceptor selects a mech other than the optimistic mech, it
 sets sc->mic_reqd to 1 whether or not the selected mech supports MICs
 (which isn't known until the mech completes).  Most code outside of
 handle_mic checks sc->mic_reqd along with (sc->ctx_flags &
 GSS_C_INTEG_FLAG), but the code in acc_ctx_call_acc neglected to do
 so, so it could improperly delegate responsibility for deciding when
 the negotiation was finished to handle_mic--which never gets called if
 (sc->ctx_flags & GSS_C_INTEG_FLAG) is false.  Fix acc_ctx_call_acc to
 check sc->ctx_flags so that mechs which don't support integrity
 protection can complete if they are selected non-optimistically.

http://src.mit.edu/fisheye/changelog/krb5/?cs=23748
Commit By: tlyu
Revision: 23748
Changed Files:
U   branches/krb5-1-8/src/lib/gssapi/spnego/spnego_mech.c