From f0e084261aec6be2d508b33f960d38d19f0d0345 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 28 Jan 2010 21:39:31 +0000 Subject: Handle migration from pre-1.7 databases with master key kvno != 1 krb5_dbe_lookup_mkvno assumes an mkvno of 1 for entries with no explicit tl_data. We've seen at least one pre-1.7 KDB with a master kvno of 0, violating this assumption. Fix this as follows: * krb5_dbe_lookup_mkvno outputs 0 instead of 1 if no tl_data exists. * A new function krb5_dbe_get_mkvno translates this 0 value to the minimum version number in the mkey_list. (krb5_dbe_lookup_mkvno cannot do this as it doesn't take the mkey_list as a parameter.) * Call sites to krb5_dbe_lookup_mkvno are converted to krb5_dbe_get_mkvno, except for an LDAP case where it is acceptable to store 0 if the mkvno is unknown. ticket: 6650 target_version: 1.7.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23676 dc483132-0cff-0310-8789-dd5450dbe970 --- src/kadmin/dbutil/kdb5_mkey.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'src/kadmin') diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c index 9ea7e5e0f1..b2ac379dfe 100644 --- a/src/kadmin/dbutil/kdb5_mkey.c +++ b/src/kadmin/dbutil/kdb5_mkey.c @@ -866,7 +866,7 @@ update_princ_encryption_1(void *cb, krb5_db_entry *ent) goto skip; } p->re_match_count++; - retval = krb5_dbe_lookup_mkvno(util_context, ent, &old_mkvno); + retval = krb5_dbe_get_mkvno(util_context, ent, master_keylist, &old_mkvno); if (retval) { com_err(progname, retval, "determining master key used for principal '%s'", @@ -1137,7 +1137,7 @@ find_mkvnos_in_use(krb5_pointer ptr, args = (struct purge_args *) ptr; - retval = krb5_dbe_lookup_mkvno(args->kcontext, entry, &mkvno); + retval = krb5_dbe_get_mkvno(args->kcontext, entry, master_keylist, &mkvno); if (retval) return (retval); @@ -1193,6 +1193,12 @@ kdb5_purge_mkeys(int argc, char *argv[]) } } + if (master_keylist == NULL) { + com_err(progname, retval, "master keylist not initialized"); + exit_status++; + return; + } + /* assemble & parse the master key name */ if ((retval = krb5_db_setup_mkey_name(util_context, global_params.mkey_name, -- cgit