diff options
| author | Greg Hudson <ghudson@mit.edu> | 2012-02-22 04:00:10 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2012-02-22 04:00:10 +0000 |
| commit | 85c8d9595b2767d16043efc42891db2c79a0eb3c (patch) | |
| tree | 751666fc7049efc44c5d1b5020cc6058a932d84b /src/lib | |
| parent | 014a42d0a35adc8503e3b2a7dcefba82abd54152 (diff) | |
| download | krb5-85c8d9595b2767d16043efc42891db2c79a0eb3c.tar.gz krb5-85c8d9595b2767d16043efc42891db2c79a0eb3c.tar.xz krb5-85c8d9595b2767d16043efc42891db2c79a0eb3c.zip | |
Correct fix for #7092
ticket: 7092
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25706 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/krb5/asn.1/asn1_k_encode.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c index 5ed17528b..35667ffa5 100644 --- a/src/lib/krb5/asn.1/asn1_k_encode.c +++ b/src/lib/krb5/asn.1/asn1_k_encode.c @@ -173,8 +173,20 @@ DEFNULLTERMSEQOFTYPE(seqof_host_addresses, address_ptr); DEFPTRTYPE(ptr_seqof_host_addresses, seqof_host_addresses); DEFOPTIONALEMPTYTYPE(opt_ptr_seqof_host_addresses, ptr_seqof_host_addresses); +/* + * krb5_kvno is defined as unsigned int, but historically (MIT krb5 through 1.6 + * in the encoder, and through 1.10 in the decoder) we treat it as signed, in + * violation of RFC 4120. kvno values large enough to be problematic are only + * likely to be seen with Windows read-only domain controllers, which overload + * the high 16-bits of kvno values for krbtgt principals. Since Windows + * encodes kvnos as signed 32-bit values, for interoperability it's best if we + * do the same. + */ +DEFINTTYPE(kvno, krb5_kvno); +DEFOPTIONALZEROTYPE(opt_kvno, kvno); + DEFFIELD(enc_data_0, krb5_enc_data, enctype, 0, int32); -DEFFIELD(enc_data_1, krb5_enc_data, kvno, 1, opt_uint); +DEFFIELD(enc_data_1, krb5_enc_data, kvno, 1, opt_kvno); DEFFIELD(enc_data_2, krb5_enc_data, ciphertext, 2, ostring_data); static const struct atype_info *encrypted_data_fields[] = { &k5_atype_enc_data_0, &k5_atype_enc_data_1, &k5_atype_enc_data_2 |