diff options
| author | Simo Sorce <simo@redhat.com> | 2014-06-26 11:43:47 -0400 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-06-27 10:03:23 +0200 |
| commit | d9d5967f7e1a11d77dee4bba00f10763b8ac2ec5 (patch) | |
| tree | 39733e0c31483f1640841bf1e185d14f81b1b125 /daemons | |
| parent | 0d219379954d311f3cac0007386dc0e21c8ec432 (diff) | |
| download | freeipa-d9d5967f7e1a11d77dee4bba00f10763b8ac2ec5.tar.gz freeipa-d9d5967f7e1a11d77dee4bba00f10763b8ac2ec5.tar.xz freeipa-d9d5967f7e1a11d77dee4bba00f10763b8ac2ec5.zip | |
Fix getkeytab code to always use implicit tagging.
A mixture of implicit and explicit tagging was being used and this caused
a bug in retrieving the enctype number due to the way ber_scanf() loosely
treat sequences and explicit tagging.
The ASN.1 notation used to describe the getkeytab operation uses implicit
tagging, so by changing the code we simply follow to the specified encoding.
Resolves: https://fedorahosted.org/freeipa/ticket/4404
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Diffstat (limited to 'daemons')
| -rw-r--r-- | daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c index 90a92f1ef..ca021cac7 100644 --- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c +++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c @@ -1073,7 +1073,7 @@ static int encode_setkeytab_reply(struct ipapwd_keyset *kset, for (int i = 0; i < kset->num_keys; i++) { rc = ber_printf(ber, "{i}", (ber_int_t)kset->keys[i].key_data_type[0]); - if (rc == -1) { + if (rc == -1) { rc = LDAP_OPERATIONS_ERROR; LOG_FATAL("Failed to ber_printf the enctype"); goto done; @@ -1328,7 +1328,7 @@ static int decode_getkeytab_request(struct berval *extop, bool *wantold, } /* ber parse code */ - ttag = ber_scanf(ber, "{t[a]", &ctag, &svcname); + ttag = ber_scanf(ber, "{ta", &ctag, &svcname); if (ttag == LBER_ERROR || ctag != GKREQ_SVCNAME_TAG) { LOG_FATAL("ber_scanf failed to decode service name\n"); err_msg = "Invalid payload.\n"; @@ -1378,7 +1378,7 @@ static int decode_getkeytab_request(struct berval *extop, bool *wantold, /* ttag peek done as last step of the previous for loop */ if (ttag == GKREQ_PASSWORD_TAG) { /* optional password present */ - ttag = ber_scanf(ber, "[a]", &password); + ttag = ber_scanf(ber, "a", &password); if (ttag == LBER_ERROR) { LOG_FATAL("ber_scanf failed to decode password\n"); err_msg = "Invalid payload.\n"; @@ -1494,7 +1494,7 @@ static int encode_getkeytab_reply(krb5_context krbctx, } rc = ber_printf(ber, - "{t[{t[i]t[o]}]", + "{t{tito}", GKREP_KEY_TAG, GKREP_KEYTYPE_TAG, (ber_int_t)keys[i].key_data_type[0], @@ -1509,7 +1509,7 @@ static int encode_getkeytab_reply(krb5_context krbctx, /* if salt available, add it */ if (keys[i].key_data_length[1] != 0) { rc = ber_printf(ber, - "t[{t[i]t[o]}]", + "t{tito}", GKREP_SALT_TAG, GKREP_SALTTYPE_TAG, (ber_int_t)keys[i].key_data_type[1], |