This patch is derived from a patch originally submitted to RT

by: Nik Conwell <nik@bu.edu>

krb5_set_real_time() accepts as input the time of the KDC
or an application server as a combination of seconds and 
microseconds.  Often it is the case that the time source 
does not provide the real time with less than one second
granularity.  Up until this patch such a caller would fill
in the microseconds parameter as zero.   krb5_set_real_time() 
would treat the zero microseconds as the actual reported 
time and compute a microsecond based offset.  

During a one second window subsequent calls to 
krb5_set_real_time() would have an ever increasing offset 
size until the number of seconds is incremented.  This
in turn produces a side effect in which the microseconds
value of the local clock is effectively erased.

If there are multiple processes or threads on the same
machine each requesting service tickets using the same
client principal for the same service principal where
the number of seconds reported by the KDC are equivalent,
then they will now all create authenticators with 
exactly the same timestamp.  As a result, the authenticating
service will detect a replay attack even though the 
authenticators are actually unique.  The replay cache
only maintains a tuple of client, server and timestamp.

This patch modifies the interpretation of the microseconds
parameter.  If -1 is specified, the microseconds offset is
ignored.

ticket: 5924
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20413 dc483132-0cff-0310-8789-dd5450dbe970

0 files changed, 0 insertions, 0 deletions