[25814] in CVS-changelog-for-Kerberos-V5
svn rev #25304: trunk/src/plugins/preauth/pkinit/
daemon@ATHENA.MIT.EDU (hartmans@mit.edu)
Wed Oct 5 17:30:17 2011
Date: Wed, 5 Oct 2011 17:30:16 -0400
From: hartmans@mit.edu
Message-Id: <201110052130.p95LUG99016145@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
http://src.mit.edu/fisheye/changelog/krb5/?cs=25304
Commit By: hartmans
Log Message:
Make pkinit fall back to octetstring2key() if there are not matching KDFs.
From: Margaret Wasserman <mrw@painless-security.com>
Changed Files:
U trunk/src/plugins/preauth/pkinit/pkinit_srv.c
Modified: trunk/src/plugins/preauth/pkinit/pkinit_srv.c
===================================================================
--- trunk/src/plugins/preauth/pkinit/pkinit_srv.c 2011-10-05 21:30:12 UTC (rev 25303)
+++ trunk/src/plugins/preauth/pkinit/pkinit_srv.c 2011-10-05 21:30:16 UTC (rev 25304)
@@ -662,6 +662,7 @@
krb5_octet_data *tmp_oid = NULL;
int i, j = 0;
+ /* if we don't find a match, return NULL value */
*alg_oid = NULL;
/* for each of the OIDs that the server supports... */
@@ -677,14 +678,13 @@
if (retval)
goto cleanup;
tmp_oid->length = supp_oid->length;
- memcpy(tmp_oid->data, supp_oid->data, supp_oid->length);
+ memcpy(tmp_oid->data, supp_oid->data, tmp_oid->length);
*alg_oid = tmp_oid;
/* don't free the OID in clean-up if we are returning it */
tmp_oid = NULL;
goto cleanup;
}
}
- retval = KRB5KDC_ERR_NO_ACCEPTABLE_KDF;
}
cleanup:
if (tmp_oid)
@@ -1052,10 +1052,8 @@
rep9->choice == choice_pa_pk_as_rep_draft9_dhSignedData) ||
(rep != NULL && rep->choice == choice_pa_pk_as_rep_dhInfo)) {
- /* If supported KDFs are specified, use the alg agility KDF */
- if ((reqctx->rcv_auth_pack != NULL &&
- reqctx->rcv_auth_pack->supportedKDFs != NULL)) {
-
+ /* If mutually supported KDFs were found, use the alg agility KDF */
+ if (rep->u.dh_Info.kdfID) {
secret.data = server_key;
secret.length = server_key_len;
@@ -1072,7 +1070,7 @@
goto cleanup;
}
- /* Otherwise, use the older octetstring2key() function */
+ /* Otherwise, use the older octetstring2key() function */
} else {
retval = pkinit_octetstring2key(context, enctype, server_key,
server_key_len, encrypting_key);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
