auth: GSSAPI RFC compliancy fixes. Patch by Ben Morrow:
auth: GSSAPI RFC compliancy fixes.
Patch by Ben Morrow:

The first problem is that, because of the way the client invokes
libsasl, it sends a GSSAPI request which does not ask for mutual
authentication. This means that on the server gss_accept_sec_context
returns GSS_S_COMPLETE with a zero-length output token. Dovecot
currently sends this to the client as a zero-length continuation
response, but this is incorrect according to RFC 4752: what it ought to
do instead is proceed straight to the security layer negotiations, and
send a gss_wrap packet.

The second is that Cyrus sends an empty authz identity; that is, the
security layer negotiation packet, when gss_unwrapped, is exactly 4
bytes long. Dovecot objects to this, but in RFC 4422 this is explicitly
allowed, and means the authz identity is identical to the authn
identity.

Distrotech/dovecot,Distrotech/dovecot,Distrotech/dovecot,Distrotech/dovecot,Distrotech/dovecot