From f0e084261aec6be2d508b33f960d38d19f0d0345 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 28 Jan 2010 21:39:31 +0000 Subject: Handle migration from pre-1.7 databases with master key kvno != 1 krb5_dbe_lookup_mkvno assumes an mkvno of 1 for entries with no explicit tl_data. We've seen at least one pre-1.7 KDB with a master kvno of 0, violating this assumption. Fix this as follows: * krb5_dbe_lookup_mkvno outputs 0 instead of 1 if no tl_data exists. * A new function krb5_dbe_get_mkvno translates this 0 value to the minimum version number in the mkey_list. (krb5_dbe_lookup_mkvno cannot do this as it doesn't take the mkey_list as a parameter.) * Call sites to krb5_dbe_lookup_mkvno are converted to krb5_dbe_get_mkvno, except for an LDAP case where it is acceptable to store 0 if the mkvno is unknown. ticket: 6650 target_version: 1.7.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23676 dc483132-0cff-0310-8789-dd5450dbe970 --- src/include/kdb.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/include') diff --git a/src/include/kdb.h b/src/include/kdb.h index 1a33235ec..1b1141bd2 100644 --- a/src/include/kdb.h +++ b/src/include/kdb.h @@ -556,11 +556,19 @@ krb5_dbe_find_mkey( krb5_context context, krb5_db_entry * entry, krb5_keyblock ** mkey); +/* Set *mkvno to mkvno in entry tl_data, or 0 if not present. */ krb5_error_code krb5_dbe_lookup_mkvno( krb5_context context, krb5_db_entry * entry, krb5_kvno * mkvno); +/* Set *mkvno to mkvno in entry tl_data, or minimum value from mkey_list. */ +krb5_error_code +krb5_dbe_get_mkvno( krb5_context context, + krb5_db_entry * entry, + krb5_keylist_node * mkey_list, + krb5_kvno * mkvno); + krb5_error_code krb5_dbe_lookup_mod_princ_data( krb5_context context, krb5_db_entry * entry, -- cgit