*** empty log message ***

diff --git a/openssh/auth-gssapi.c b/openssh/auth-gssapi.c
index 6b03433298ddb6eaf7708134dbbc288056900c2d..dfa6a89ed6854d55ddac7fb7854e5f1e7e7e84ab 100644 (file)
--- a/openssh/auth-gssapi.c
+++ b/openssh/auth-gssapi.c
@@ -384,6 +384,15 @@ int auth_gssapi(const char *target_account,
 
     (void) gss_release_buffer(&min_stat, &recv_tok);
 
+/*modified by binhe*/
+    if (ret_flags & GSS_C_GLOBUS_LIMITED_PROXY_FLAG) {
+      packet_start(SSH_MSG_AUTH_GSSAPI_ABORT);
+      packet_send();
+
+      goto cleanup;
+    }
+/*end of modification*/
+
     if (maj_stat!=GSS_S_COMPLETE && maj_stat!=GSS_S_CONTINUE_NEEDED) {
       display_gssapi_status("accepting context", maj_stat, min_stat);
 

diff --git a/openssh/kexgss.c b/openssh/kexgss.c
index c967b9b584af1998de37bca279f038c49e438b9d..3fec5f74e6be01c0532074c35fabae3f5d1f7101 100644 (file)
--- a/openssh/kexgss.c
+++ b/openssh/kexgss.c
@@ -339,6 +339,12 @@ kexgss_server(Kex *kex)
                                                 &ret_flags);
 
                gss_release_buffer(&min_status,&recv_tok);
+
+/*modified by binhe*/
+                if (ret_flags & GSS_C_GLOBUS_LIMITED_PROXY_FLAG) {
+                        fatal("Limited proxy is not allowed.");
+                }
+/*end of modification*/
                
                if (maj_status & GSS_S_CONTINUE_NEEDED) {
                        debug("Sending GSSAPI_CONTINUE");