[krbdev.mit.edu #1445] git commit

[Greg Hudson via RT]

Fix gss_accept_sec_context error tokens

A GSS krb5 error response contains a KRB-ERROR message, which is
required to have a server principal name, although few recipients
actually use it.  Starting in 1.3, accept_sec_context would fail to
encode the error in the GSS_C_NO_NAME/GSS_C_NO_CREDENTIAL case
(introduced by #1370) because cred->princ (which became
cred->name->princ in 1.8) is unset.

This problem got worse in 1.10 because we stopped setting the server
field in all cases due to the changes for #6855.  In 1.11 the problem
got worse again when a misguided change to the mechglue started
discarding output tokens when the mechanism returns an error; the
mechglue should only do so when it itself causes the error.

Fix krb5 gss_accept_sec_context by unconditionally decoding the AP-REQ
and using krb5_rd_req_decoded, and then using the requested ticket
server in the KRB-ERROR message.  Fix the mechglue
gss_accept_sec_context by reverting that part of commit
56feee187579905c9101b0cdbdd8c6a850adcfc9.  Add a test program which
artificially induces a replay cache failure (the easiest failure we
can produce which has an associated RFC 4120 error code) and checks
that this can be communicated back to the initiator via an error
token.

https://github.com/krb5/krb5/commit/c547bc16f2ab6ee66c076ef944c3fbac8a66f5d4
Author: Greg Hudson <ghudson at mit.edu>
Commit: c547bc16f2ab6ee66c076ef944c3fbac8a66f5d4
Branch: master
 src/lib/gssapi/krb5/accept_sec_context.c       |   43 ++++-----
 src/lib/gssapi/mechglue/g_accept_sec_context.c |    6 +-
 src/lib/krb5_32.def                            |    1 +
 src/tests/gssapi/Makefile.in                   |   19 ++--
 src/tests/gssapi/t_err.c                       |  121 ++++++++++++++++++++++++
 src/tests/gssapi/t_gssapi.py                   |    4 +
 6 files changed, 157 insertions(+), 37 deletions(-)