Add GSS flag to include KERB_AP_OPTIONS_CBT

The Microsoft KERB_AP_OPTIONS_CBT extension (defined in [MS-KILE]
3.2.5.8) allows the client to request strict enforcement of GSS
channel bindings.  Client support for this extension was added in
commit 225e6ef7f021cd1a8ef2a054af0ca58b7288fd81 (ticket 8900) but it
requires a configuration variable to be set.  The choice to include
the extension should be made by the client application code, as it is
a promise to include channel bindings when operating within TLS.

In libkrb5, add an option AP_OPTS_CBT_FLAG to make
krb5_mk_req[_extended]() include KERB_AP_OPTIONS_CBT.  In the GSS
initiator code, set this flag when the GSS_C_CHANNEL_BOUND flag is
included in the request options.  GSS_C_CHANNEL_BOUND was introduced
in commit 429a31146083fac21958631c2af572b08ec91022 (ticket 8899) as an
acceptor output flag.

[ghudson@mit.edu: rewrote commit message; adjusted some names;
simplified GSS initiator bookkeeping; added documentation]

ticket: 9122 (new)

0 files changed, 0 insertions, 0 deletions