From 95b03a6fef4b86d1f8fac0a6ef92e86d836e261f Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Sat, 31 Aug 2013 11:46:58 -0400 Subject: Fix FAST critical option bit checking The FAST option bits 0-15 are intended to be critical--if they are present and a KDC does not support them, the KDC is supposed to fail the request. Because of an incorrect constant, we were erroneously recognizing bits 24-31 as critical. Fix the constant. ticket: 7701 (new) --- src/include/k5-int.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/include/k5-int.h b/src/include/k5-int.h index d6f9325eb..5119e66da 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -776,8 +776,8 @@ typedef struct _krb5_fast_req { krb5_kdc_req *req_body; } krb5_fast_req; -/* Bits 0-15 are critical in fast options.*/ -#define UNSUPPORTED_CRITICAL_FAST_OPTIONS 0x00ff +/* Bits 0-15 are critical in FAST options (RFC 6113 section 7.3). */ +#define UNSUPPORTED_CRITICAL_FAST_OPTIONS 0xbfff0000 #define KRB5_FAST_OPTION_HIDE_CLIENT_NAMES 0x40000000 typedef struct _krb5_fast_finished { -- cgit