pull up r22185 from trunk

 ------------------------------------------------------------------------
 r22185 | ghudson | 2009-04-08 12:39:33 -0400 (Wed, 08 Apr 2009) | 8 lines
 Changed paths:
    M /trunk/src/lib/gssapi/generic/gssapi.hin
    M /trunk/src/lib/gssapi/krb5/init_sec_context.c

 ticket: 6203
 tags: pullup
 target_version: 1.7

 Using a patch from Apple, add support for GSS_C_DELEG_POLICY_FLAG,
 which requests delegation only if the ok-as-delegate ticket flag is
 set.

ticket: 6203
version_fixed: 1.7

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-7@22255 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/gssapi/generic/gssapi.hin b/src/lib/gssapi/generic/gssapi.hin
index d33a0b505beab7a4733d0585ee64ca63cbe11e8b..422b4dbef8c83b4ea18a5dac693094ad2294f2df 100644 (file)
--- a/src/lib/gssapi/generic/gssapi.hin
+++ b/src/lib/gssapi/generic/gssapi.hin
@@ -141,6 +141,7 @@ typedef int             gss_cred_usage_t;
 #define GSS_C_ANON_FLAG         64
 #define GSS_C_PROT_READY_FLAG   128
 #define GSS_C_TRANS_FLAG        256
+#define GSS_C_DELEG_POLICY_FLAG 32768
 
 /*
  * Credential usage options

diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c
index e7742216eb1d817c0a298230589019410098e354..0f12948342d3b76448bcd0c052042c343579d2b5 100644 (file)
--- a/src/lib/gssapi/krb5/init_sec_context.c
+++ b/src/lib/gssapi/krb5/init_sec_context.c
@@ -208,7 +208,8 @@ make_gss_checksum (krb5_context context, krb5_auth_context auth_context,
         if (code) {
             /* don't fail here; just don't accept/do the delegation
                request */
-            data->ctx->gss_flags &= ~GSS_C_DELEG_FLAG;
+            data->ctx->gss_flags &= ~(GSS_C_DELEG_FLAG |
+                                      GSS_C_DELEG_POLICY_FLAG);
 
             data->checksum_data.length = 24;
         } else {
@@ -494,6 +495,14 @@ new_connection(
 
     ctx->krb_times = k_cred->times;
 
+    /*
+     * GSS_C_DELEG_POLICY_FLAG means to delegate only if the
+     * ok-as-delegate ticket flag is set.
+     */
+    if ((req_flags & GSS_C_DELEG_POLICY_FLAG)
+        && (k_cred->ticket_flags & TKT_FLG_OK_AS_DELEGATE))
+        ctx->gss_flags |= GSS_C_DELEG_FLAG | GSS_C_DELEG_POLICY_FLAG;
+
     if (default_mech) {
         mech_type = (gss_OID) gss_mech_krb5;
     }