592692 - Negotiate auth may fail with GSSAPI

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Mike Hommey [:glandium]]

Attachment: Calculate token length after removing padding

In function nsHttpNegotiateAuth::GenerateCredentials, the token length that is given to nsIAuthModule::GetNextToken is calculated before any '=' padding is removed from the original challenge.

This can lead to passing extra bytes to gss_init_sec_context and causes negotiate auth to fail. I don't know if this has impact on other platforms than Linux.

Somehow, this was fixed in a supposedly unrelated patchset:
http://hg.mozilla.org/mozilla-central/rev/275225278550

But it still remains an issue on 3.5/1.9.1.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 471135 [details] [diff] [review]
Calculate token length after removing padding

OK.

Comment 2

[Daniel Veditz [:dveditz]]

Comment on attachment 471135 [details] [diff] [review]
Calculate token length after removing padding

Approved for 1.9.2.11, a=dveditz for release-drivers

Comment 3

[Daniel Veditz [:dveditz]]

Comment on attachment 471135 [details] [diff] [review]
Calculate token length after removing padding

missed 1.9.2.11 so we'll see if it lands for 1.9.2.12

Comment 4

[Reed Loden [:reed]]

glandium, are you going to land this, or should it be in the checkin-needed queue?

Comment 5

[Mike Hommey [:glandium]]

When is 1.9.1 open for 1.9.1.15 stuff ?

Comment 6

[Reed Loden [:reed]]

(In reply to comment #5)
> When is 1.9.1 open for 1.9.1.15 stuff ?

Now. See http://tinderbox.mozilla.org/Firefox3.5/ for tree rules.

Comment 7

[Mike Hommey [:glandium]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/a78a9ff14f26