2002-12-05 Sam Hartman <hartmans@mit.edu>

	* util_token.c (g_verify_token_header g_make_token_header):
	Accept -1 to mean  that no token type is expected; the token type
	is purely an RFC 1964 artifact and is not used in other mechanisms
	such as SPNEGO.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15029 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/gssapi/generic/ChangeLog b/src/lib/gssapi/generic/ChangeLog
index f5f4c442ccb0e32ed2df1598c24539fab0c9cd34..bae1d257184cb37cf7bb8dd817c5740a984299e1 100644 (file)
--- a/src/lib/gssapi/generic/ChangeLog
+++ b/src/lib/gssapi/generic/ChangeLog
@@ -1,3 +1,10 @@
+2002-12-05  Sam Hartman  <hartmans@mit.edu>
+
+       * util_token.c (g_verify_token_header g_make_token_header):
+       Accept -1 to mean  that no token type is expected; the token type
+       is purely an RFC 1964 artifact and is not used in other mechanisms
+       such as SPNEGO.
+
 2002-11-15  Ezra Peisach  <epeisach@bu.edu>
 
        * gssapiP_generic.h, util_token.c: Change g_make_token_header and

diff --git a/src/lib/gssapi/generic/util_token.c b/src/lib/gssapi/generic/util_token.c
index 9cd1ce2f15ad990b31370cb854d6e4b77ded3706..088e6139e87e3089b8fba0fdfe2b70a63e2b8dc5 100644 (file)
--- a/src/lib/gssapi/generic/util_token.c
+++ b/src/lib/gssapi/generic/util_token.c
@@ -46,6 +46,11 @@
                                        bytes 0,1 are the token type
                                        bytes 2,n are the token data
 
+Note that the token type field is a feature of RFC 1964 mechanisms and
+is not used by other GSSAPI mechanisms.  As such, a token type of -1
+is interpreted to mean that no token type should be expected or
+generated. 
+
 For the purposes of this abstraction, the token "header" consists of
 the sequence tag and length octets, the mech OID DER encoding, and the
 first two inner bytes, which indicate the token type.  The token
@@ -145,12 +150,14 @@ void g_make_token_header(mech, body_size, buf, tok_type)
      int tok_type;
 {
    *(*buf)++ = 0x60;
-   der_write_length(buf, 4 + mech->length + body_size);
+   der_write_length(buf, (tok_type == -1) ?2:4 + mech->length + body_size);
    *(*buf)++ = 0x06;
    *(*buf)++ = (unsigned char) mech->length;
    TWRITE_STR(*buf, mech->elements, mech->length);
-   *(*buf)++ = (unsigned char) ((tok_type>>8)&0xff);
-   *(*buf)++ = (unsigned char) (tok_type&0xff);
+   if (tok_type != -1) {
+       *(*buf)++ = (unsigned char) ((tok_type>>8)&0xff);
+       *(*buf)++ = (unsigned char) (tok_type&0xff);
+   }
 }
 
 /*
@@ -171,7 +178,6 @@ gss_int32 g_verify_token_header(mech, body_size, buf_in, tok_type, toksize_in)
    unsigned char *buf = *buf_in;
    int seqsize;
    gss_OID_desc toid;
-   int ret = 0;
    int toksize = toksize_in;
 
    if ((toksize-=1) < 0)
@@ -200,25 +206,17 @@ gss_int32 g_verify_token_header(mech, body_size, buf_in, tok_type, toksize_in)
    buf+=toid.length;
 
    if (! g_OID_equal(&toid, mech)) 
-      ret = G_WRONG_MECH;
- 
-   /* G_WRONG_MECH is not returned immediately because it's more important
-      to return G_BAD_TOK_HEADER if the token header is in fact bad */
-
-   if ((toksize-=2) < 0)
-      return(G_BAD_TOK_HEADER);
-
-   if (ret)
-       return(ret);
-
-   if ((*buf++ != ((tok_type>>8)&0xff)) ||
-       (*buf++ != (tok_type&0xff))) 
-      return(G_WRONG_TOKID);
-
-   if (!ret) {
+       return  G_WRONG_MECH;
+   if (tok_type != -1) {
+       if ((toksize-=2) < 0)
+          return(G_BAD_TOK_HEADER);
+
+       if ((*buf++ != ((tok_type>>8)&0xff)) ||
+          (*buf++ != (tok_type&0xff))) 
+          return(G_WRONG_TOKID);
+   }
        *buf_in = buf;
        *body_size = toksize;
-   }
 
-   return(ret);
-}
+       return 0;
+       }