From 7b4e88e425b05ac9c7ab88447f6797117916f62a Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mar 17 2016 17:17:30 +0000
Subject: Backport OID mech fix


Resolves: #1317609

---

diff --git a/krb5-1.14.2-Revisit-inquire_attrs_for_mech-on-old-mechs.patch b/krb5-1.14.2-Revisit-inquire_attrs_for_mech-on-old-mechs.patch
new file mode 100644
index 0000000..66dd166
--- /dev/null
+++ b/krb5-1.14.2-Revisit-inquire_attrs_for_mech-on-old-mechs.patch
@@ -0,0 +1,39 @@
+From 89683d1f135765e91041f3a239af865b11aaf86b Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 15 Mar 2016 17:45:26 -0400
+Subject: [PATCH] Revisit inquire_attrs_for_mech on old mechs
+
+In gss_inquire_attrs_for_mech(), if the mech does not implement RFC
+5587, return success with empty mech_attrs and known_mech_attrs sets
+to indicate a lack of knowledge for all attributes.  The previous
+behavior of returning an error caused gss_indicate_mechs_by_attr() to
+fail out in the presence of an old mechanism, in turn causing
+gss_acquire_cred() and SPNEGO to break.
+
+ticket: 8358
+---
+ src/lib/gssapi/mechglue/g_mechattr.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/gssapi/mechglue/g_mechattr.c b/src/lib/gssapi/mechglue/g_mechattr.c
+index 08a6008..e49651e 100644
+--- a/src/lib/gssapi/mechglue/g_mechattr.c
++++ b/src/lib/gssapi/mechglue/g_mechattr.c
+@@ -181,8 +181,12 @@ gss_inquire_attrs_for_mech(
+     mech = gssint_get_mechanism(selected_mech);
+     if (mech == NULL)
+         return GSS_S_BAD_MECH;
+-    else if (mech->gss_inquire_attrs_for_mech == NULL)
+-        return GSS_S_UNAVAILABLE;
++
++    /* If the mech does not implement RFC 5587, return success with an empty
++     * mech_attrs and known_mech_attrs. */
++    if (mech->gss_inquire_attrs_for_mech == NULL)
++        return GSS_S_COMPLETE;
++
+     public_mech = gssint_get_public_oid(selected_mech);
+     status = mech->gss_inquire_attrs_for_mech(minor, public_mech, mech_attrs,
+                                               known_mech_attrs);
+-- 
+2.7.0
+
diff --git a/krb5.spec b/krb5.spec
index 15ca779..f5215fe 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -13,7 +13,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.14.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 # - Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13.2-signed.tar
 # - The sources below are stored in a lookaside cache. Upload with
@@ -64,6 +64,7 @@ Patch158: krb5-1.14.1-interpose-enable-inquire_attrs_for_mech.patch
 Patch159: krb5-1.14.1-interpose-fix-inquire_attrs_for_mech.patch
 Patch160: krb5-1.14.1-interpose-inquire_saslname_for_mech.patch
 Patch161: krb5-1.14.1-interpose-public_oid_fixups.patch
+Patch162: krb5-1.14.2-Revisit-inquire_attrs_for_mech-on-old-mechs.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -244,6 +245,7 @@ ln NOTICE LICENSE
 %patch159 -p1 -b .interpose-fix-inquire_attrs_for_mech
 %patch160 -p1 -b .interpose-inquire_saslname_for_mech
 %patch161 -p1 -b .interpose-public_oid_fixups
+%patch162 -p1 -b .inquire_attrs_for_mech-on-old-mechs
 
 # Take the execute bit off of documentation.
 chmod -x doc/krb5-protocol/*.txt doc/ccapi/*.html
@@ -766,6 +768,10 @@ exit 0
 
 
 %changelog
+* Thu Mar 17 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-2
+- Backport OID mech fix
+- Resolves: #1317609
+
 * Mon Feb 29 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-1
 - New rawhide, new upstream version
 - Drop CVE patches