Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Completely omit CBs AV pairs when no CB provided #26

Merged
merged 1 commit into from
Jun 9, 2020

Conversation

simo5
Copy link
Collaborator

@simo5 simo5 commented Jun 8, 2020

Although the MS-NLMP Spec says zero CBs should be equivalent to no CBs,
Windows apparently fails validation when CBs are optional and an all
zero CB is presented.

So avoid sending any CBs if we have none.
Also make sure to deal with missing CBs on the accpetor by ignoreing
missing CBs and setting the new GSS_C_CHANNEL_BOUND_FLAG in gss flags if
the CBs are present and matching.

Fixes #25

Although the MS-NLMP Spec says zero CBs should be equivalent to no CBs,
Windows apparently fails validation when CBs are optional and an all
zero CB is presented.

So avoid sending any CBs if we have none.
Also make sure to deal with missing CBs on the accpetor by ignoreing
missing CBs and setting the new GSS_C_CHANNEL_BOUND_FLAG in gss flags if
the CBs are present and matching.

Signed-off-by: Simo Sorce <[email protected]>
Copy link

@jborean93 jborean93 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested this change against an IIS site and WinRM listener and the changes fix issue #25

@simo5 simo5 merged commit 46c642f into gssapi:master Jun 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Default channel bindings cause auth failure
2 participants