[30024] in CVS-changelog-for-Kerberos-V5
krb5 commit: Don't set ctime in KDC error replies
daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue Aug 29 13:45:52 2017
Date: Tue, 29 Aug 2017 13:45:46 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201708291745.v7THjkte013887@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/aff489766e8541bee59d0aa7b9cc7e62f5ca8232
commit aff489766e8541bee59d0aa7b9cc7e62f5ca8232
Author: Greg Hudson <ghudson@mit.edu>
Date: Tue Aug 29 11:19:36 2017 -0400
Don't set ctime in KDC error replies
Setting the error ctime field to the client nonce assumes that the
client used its system time as the nonce, which is not recommended by
RFC 1510 and is prohibited by RFC 4120. Omit the field instead, by
setting the structure field to 0.
ticket: 8610 (new)
src/kdc/do_as_req.c | 2 +-
src/kdc/do_tgs_req.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index 8cfb4ef..7c8da63 100644
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -840,7 +840,7 @@ prepare_error_as(struct kdc_request_state *rstate, krb5_kdc_req *request,
e_data[count] = cookie;
}
- errpkt.ctime = request->nonce;
+ errpkt.ctime = 0;
errpkt.cusec = 0;
retval = krb5_us_timeofday(kdc_context, &errpkt.stime, &errpkt.susec);
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index b9b1073..cc5a692 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -896,7 +896,7 @@ prepare_error_tgs (struct kdc_request_state *state,
kdc_realm_t *kdc_active_realm = state->realm_data;
errpkt.magic = KV5M_ERROR;
- errpkt.ctime = request->nonce;
+ errpkt.ctime = 0;
errpkt.cusec = 0;
if ((retval = krb5_us_timeofday(kdc_context, &errpkt.stime,
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5