[krbdev.mit.edu #9122] git commit

Mon May 06 18:25:29 2024: Request 9122 was acted upon.
 Transaction: Ticket created by [email protected]
       Queue: krb5
     Subject: git commit
       Owner: [email protected]
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9122 >



Add GSS flag to include KERB_AP_OPTIONS_CBT

The Microsoft KERB_AP_OPTIONS_CBT extension (defined in [MS-KILE]
3.2.5.8) allows the client to request strict enforcement of GSS
channel bindings.  Client support for this extension was added in
commit 225e6ef7f021cd1a8ef2a054af0ca58b7288fd81 (ticket 8900) but it
requires a configuration variable to be set.  The choice to include
the extension should be made by the client application code, as it is
a promise to include channel bindings when operating within TLS.

In libkrb5, add an option AP_OPTS_CBT_FLAG to make
krb5_mk_req[_extended]() include KERB_AP_OPTIONS_CBT.  In the GSS
initiator code, set this flag when the GSS_C_CHANNEL_BOUND flag is
included in the request options.  GSS_C_CHANNEL_BOUND was introduced
in commit 429a31146083fac21958631c2af572b08ec91022 (ticket 8899) as an
acceptor output flag.

[[email protected]: rewrote commit message; adjusted some names;
simplified GSS initiator bookkeeping; added documentation]

https://github.com/krb5/krb5/commit/6b74b6c18feab1f3d72d00ae412a93c6bfa4a00a
Author: Stefan Metzmacher <[email protected]>
Committer: Greg Hudson <[email protected]>
Commit: 6b74b6c18feab1f3d72d00ae412a93c6bfa4a00a
Branch: master
 doc/appdev/gssapi.rst                  | 36 ++++++++++++++++++++++++++++++++++
 doc/appdev/refs/macros/index.rst       |  1 +
 src/include/krb5/krb5.hin              |  2 +-
 src/lib/gssapi/krb5/init_sec_context.c | 11 ++++++++---
 src/lib/krb5/krb/mk_req_ext.c          | 21 ++++++++++++--------
 src/tests/gssapi/t_bindings.c          | 31 ++++++++++++++++++++---------
 src/tests/gssapi/t_bindings.py         | 18 +++++++++++++++++
 7 files changed, 99 insertions(+), 21 deletions(-)