- fix a logic bug in computing key expiration times (RT#6762, #627022)krb5-1.7.1-12.fc13

2 files changed, 34 insertions, 1 deletions

diff --git a/krb5-trunk-explife.patch b/krb5-trunk-explife.patch
new file mode 100644
index 0000000..ddcf143
--- /dev/null
+++ b/krb5-trunk-explife.patch
@@ -0,0 +1,28 @@
+Rob Crittenden noticed that, in populate_krb5_db_entry(), key
+expirations weren't being computed as expected.  It turns out
+that neither KDB_PRINC_EXPIRE_TIME_ATTR nor KDB_PWD_EXPIRE_TIME_ATTR
+is defined to 1, so the check for their bits could never succeed as
+written.  RT#6762.
+
+Index: src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+===================================================================
+--- src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c	(revision 24252)
++++ src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c	(working copy)
+@@ -2087,7 +2087,7 @@
+             goto cleanup;
+ 
+         if (attr_present == TRUE) {
+-            if ((mask & KDB_PRINC_EXPIRE_TIME_ATTR) == 1) {
++            if (mask & KDB_PRINC_EXPIRE_TIME_ATTR) {
+                 if (expiretime < entry->expiration)
+                     entry->expiration = expiretime;
+             } else {
+@@ -2127,7 +2127,7 @@
+             if ((st=krb5_dbe_lookup_last_pwd_change(context, entry, &last_pw_changed)) != 0)
+                 goto cleanup;
+ 
+-            if ((mask & KDB_PWD_EXPIRE_TIME_ATTR) == 1) {
++            if (mask & KDB_PWD_EXPIRE_TIME_ATTR) {
+                 if ((last_pw_changed + pw_max_life) < entry->pw_expiration)
+                     entry->pw_expiration = last_pw_changed + pw_max_life;
+             } else
diff --git a/krb5.spec b/krb5.spec
index b13c157..dc1794c 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -10,7 +10,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.7.1
-Release: 11%{?dist}
+Release: 12%{?dist}
 # Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/dist/krb5/1.7/krb5-1.7.1-signed.tar
 Source0: krb5-%{version}.tar.gz
@@ -90,6 +90,7 @@ Patch100: 2010-002-1.7-patch.txt
 Patch101: http://web.mit.edu/kerberos/advisories/2010-004-patch.txt
 Patch102: krb5-CVE-2010-1321-1.7.1.patch
 Patch103: krb5-1.7.1-24139.patch
+Patch104: krb5-trunk-explife.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -228,6 +229,9 @@ to obtain initial credentials from a KDC using a private key and a
 certificate.
 
 %changelog
+* Tue Aug 24 2010 Nalin Dahyabhai <nalin@redhat.com> 1.7.1-12
+- fix a logic bug in computing key expiration times (RT#6762, #627022)
+
 * Mon Jun 21 2010 Nalin Dahyabhai <nalin@redhat.com>
 - pull up fix for upstream #6745, in which the gssapi library would add the
   wrong error table but subsequently attempt to unload the right one
@@ -1646,6 +1650,7 @@ popd
 %patch101 -p1 -b .2010-004
 %patch102 -p1 -b .CVE-2010-1321
 %patch103 -p1 -b .24139
+%patch104 -p0 -b .explife
 gzip doc/*.ps
 
 sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex