|
 |
bc66de |
From 676ec5fe0b6c7c5126dbf84ef59ec4a5d5f87ede Mon Sep 17 00:00:00 2001
|
|
|
bc66de |
From: rpm-build <rpm-build>
|
|
|
bc66de |
Date: Tue, 26 Apr 2022 10:23:53 +0200
|
|
|
bc66de |
Subject: [PATCH] Fix gss_localname with SPNEGO wrapping
|
|
|
bc66de |
|
|
|
bc66de |
Fix implemented upstream by Simo
|
|
|
bc66de |
---
|
|
|
bc66de |
src/mod_auth_gssapi.c | 14 ++++++++++++++
|
|
|
bc66de |
1 file changed, 14 insertions(+)
|
|
|
bc66de |
|
|
|
bc66de |
diff --git a/src/mod_auth_gssapi.c b/src/mod_auth_gssapi.c
|
|
|
bc66de |
index b0999737daedf88fa84a9d8b1543bbedc79194ab..c91aa60707ba9b237a84f95670d483f1a7eab86b 100644
|
|
|
bc66de |
--- a/src/mod_auth_gssapi.c
|
|
|
bc66de |
+++ b/src/mod_auth_gssapi.c
|
|
|
bc66de |
@@ -1264,7 +1264,21 @@ static int mag_complete(struct mag_req_cfg *req_cfg, struct mag_conn *mc,
|
|
|
bc66de |
#endif
|
|
|
bc66de |
|
|
|
bc66de |
if (cfg->map_to_local) {
|
|
|
bc66de |
+ /* We have to play heuristics here as gss_localname does not work
|
|
|
bc66de |
+ * as expected with SPNEGO-wrapped names.
|
|
|
bc66de |
+ * http://krbdev.mit.edu/rt/Ticket/Display.html?id=8782
|
|
|
bc66de |
+ */
|
|
|
bc66de |
maj = gss_localname(&min, client, mech_type, &lname);
|
|
|
bc66de |
+ if (maj != GSS_S_COMPLETE) {
|
|
|
bc66de |
+ uint32_t sub_maj, sub_min;
|
|
|
bc66de |
+ /* try fallback with no oid */
|
|
|
bc66de |
+ sub_maj = gss_localname(&sub_min, client, GSS_C_NO_OID, &lname);
|
|
|
bc66de |
+ if (sub_maj != GSS_S_UNAVAILABLE) {
|
|
|
bc66de |
+ /* use second call errors only if they are meaningful */
|
|
|
bc66de |
+ maj = sub_maj;
|
|
|
bc66de |
+ min = sub_min;
|
|
|
bc66de |
+ }
|
|
|
bc66de |
+ }
|
|
|
bc66de |
if (maj != GSS_S_COMPLETE) {
|
|
|
bc66de |
mag_post_error(req, cfg, MAG_GSS_ERR, maj, min,
|
|
|
bc66de |
"gss_localname() failed");
|
|
|
bc66de |
--
|
|
|
bc66de |
2.35.1
|
|
|
bc66de |
|