diff options
| author | Greg Hudson <ghudson@mit.edu> | 2013-10-14 17:02:31 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2013-10-17 14:13:02 -0400 |
| commit | cd59782cb32b79e4001a86b0fe47af8b6275ef0c (patch) | |
| tree | c51aa7324ed3c42052ffd4572970c8843310fe50 /src | |
| parent | c547bc16f2ab6ee66c076ef944c3fbac8a66f5d4 (diff) | |
| download | krb5-cd59782cb32b79e4001a86b0fe47af8b6275ef0c.tar.gz krb5-cd59782cb32b79e4001a86b0fe47af8b6275ef0c.tar.xz krb5-cd59782cb32b79e4001a86b0fe47af8b6275ef0c.zip | |
Use protocol error for PKINIT cert expiry
If we fail to create a cert chain in cms_signeddata_create(), return
KRB5KDC_ERR_PREAUTH_FAILED, which corresponds to a protocol code,
rather than KRB5_PREAUTH_FAILED, which doesn't. This is also more
consistent with other error clauses in the same function.
ticket: 7718 (new)
target_version: 1.12
tags: pullup
Diffstat (limited to 'src')
| -rw-r--r-- | src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c index af6aea878..b66132012 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -1109,7 +1109,7 @@ cms_signeddata_create(krb5_context context, pkiDebug("failed to create a certificate chain: %s\n", msg); if (!sk_X509_num(id_cryptoctx->trustedCAs)) pkiDebug("No trusted CAs found. Check your X509_anchors\n"); - retval = KRB5_PREAUTH_FAILED; + retval = KRB5KDC_ERR_PREAUTH_FAILED; krb5_set_error_message(context, retval, _("Cannot create cert chain: %s"), msg); goto cleanup; |