diff options
| author | Sam Hartman <hartmans@mit.edu> | 2004-06-09 18:30:01 +0000 |
|---|---|---|
| committer | Sam Hartman <hartmans@mit.edu> | 2004-06-09 18:30:01 +0000 |
| commit | b41642b58f850e8a2138bed343a82c3669ff2a57 (patch) | |
| tree | 2e0882d29a9b9d93c1f0a15e1795c17b91e94109 /src/lib/gssapi/krb5/ChangeLog | |
| parent | faf3a79c6cdfe398225f5eba755eeea7b80a45ad (diff) | |
| download | krb5-b41642b58f850e8a2138bed343a82c3669ff2a57.tar.gz krb5-b41642b58f850e8a2138bed343a82c3669ff2a57.tar.xz krb5-b41642b58f850e8a2138bed343a82c3669ff2a57.zip | |
If channel bindings are supplied to server require them to be matched
Based on discussion on kerberos@mit.edu, the decision to allow null
channel bindings from a client to match even when server channel
bindings are supplied is flawed. This decision assumes that we cannot
get server implementations to change even though we are able to deploy
a new Kerberos implementation on the server. In practice the server
implementations in question have actually changed and so the only part
of revision 1.54 of accept_sec_context.c we actually need is the code
to ignore channel bindings if null channel bindings are passed into
the server. Thus the change to allow null channel bindings from the
client to match against any channel bindings on the server is backed
out.
Ticket: new
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@16427 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/gssapi/krb5/ChangeLog')
| -rw-r--r-- | src/lib/gssapi/krb5/ChangeLog | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/lib/gssapi/krb5/ChangeLog b/src/lib/gssapi/krb5/ChangeLog index e4b2f720d..6f5ff00e6 100644 --- a/src/lib/gssapi/krb5/ChangeLog +++ b/src/lib/gssapi/krb5/ChangeLog @@ -1,3 +1,10 @@ +2004-06-09 Sam Hartman <hartmans@mit.edu> + + * accept_sec_context.c (krb5_gss_accept_sec_context): If the + server provides channel bindings, these channel bindings must be + matched. Thus clients can only provide null channel bindings if + the server provides no channel bindings. + 2004-06-08 Sam Hartman <hartmans@mit.edu> * set_allowable_enctypes.c lucid_context.c: new file |