diff options
author | Greg Hudson <ghudson@mit.edu> | 2010-01-28 21:39:31 +0000 |
---|---|---|
committer | Greg Hudson <ghudson@mit.edu> | 2010-01-28 21:39:31 +0000 |
commit | f0e084261aec6be2d508b33f960d38d19f0d0345 (patch) | |
tree | 6317db1b8cab2e9e99ce4d3f0a8f8d3cb259b239 /src/lib/kdb/kdb5.c | |
parent | 0b929b1f34ea96096f1fbb3736bc33ff3375afa1 (diff) | |
download | krb5-f0e084261aec6be2d508b33f960d38d19f0d0345.tar.gz krb5-f0e084261aec6be2d508b33f960d38d19f0d0345.tar.xz krb5-f0e084261aec6be2d508b33f960d38d19f0d0345.zip |
Handle migration from pre-1.7 databases with master key kvno != 1
krb5_dbe_lookup_mkvno assumes an mkvno of 1 for entries with no
explicit tl_data. We've seen at least one pre-1.7 KDB with a master
kvno of 0, violating this assumption. Fix this as follows:
* krb5_dbe_lookup_mkvno outputs 0 instead of 1 if no tl_data exists.
* A new function krb5_dbe_get_mkvno translates this 0 value to the
minimum version number in the mkey_list. (krb5_dbe_lookup_mkvno
cannot do this as it doesn't take the mkey_list as a parameter.)
* Call sites to krb5_dbe_lookup_mkvno are converted to
krb5_dbe_get_mkvno, except for an LDAP case where it is acceptable
to store 0 if the mkvno is unknown.
ticket: 6650
target_version: 1.7.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23676 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/kdb/kdb5.c')
-rw-r--r-- | src/lib/kdb/kdb5.c | 36 |
1 files changed, 34 insertions, 2 deletions
diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c index cd9f716974..83dde5137d 100644 --- a/src/lib/kdb/kdb5.c +++ b/src/lib/kdb/kdb5.c @@ -1591,7 +1591,7 @@ krb5_dbe_find_mkey(krb5_context context, krb5_error_code retval; krb5_keylist_node *cur_keyblock = mkey_list; - retval = krb5_dbe_lookup_mkvno(context, entry, &mkvno); + retval = krb5_dbe_get_mkvno(context, entry, mkey_list, &mkvno); if (retval) return (retval); @@ -1852,7 +1852,7 @@ krb5_dbe_lookup_mkvno(krb5_context context, return (code); if (tl_data.tl_data_length == 0) { - *mkvno = 1; /* default for princs that lack the KRB5_TL_MKVNO data */ + *mkvno = 0; /* Indicates KRB5_TL_MKVNO data not present */ return (0); } else if (tl_data.tl_data_length != 2) { return (KRB5_KDB_TRUNCATED_RECORD); @@ -1864,6 +1864,38 @@ krb5_dbe_lookup_mkvno(krb5_context context, } krb5_error_code +krb5_dbe_get_mkvno(krb5_context context, + krb5_db_entry * entry, + krb5_keylist_node * mkey_list, + krb5_kvno * mkvno) +{ + krb5_error_code code; + krb5_kvno kvno; + + if (mkey_list == NULL) + return EINVAL; + + /* Output the value from entry tl_data if present. */ + code = krb5_dbe_lookup_mkvno(context, entry, &kvno); + if (code != 0) + return code; + if (kvno != 0) { + *mkvno = kvno; + return 0; + } + + /* Determine the minimum kvno in mkey_list and output that. */ + kvno = (krb5_kvno) -1; + while (mkey_list != NULL) { + if (mkey_list->kvno < kvno) + kvno = mkey_list->kvno; + mkey_list = mkey_list->next; + } + *mkvno = kvno; + return 0; +} + +krb5_error_code krb5_dbe_update_mkvno(krb5_context context, krb5_db_entry * entry, krb5_kvno mkvno) |