[26470] in CVS-changelog-for-Kerberos-V5
svn rev #25801: trunk/src/lib/kadm5/srv/
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Wed Apr 4 17:39:13 2012
Date: Wed, 4 Apr 2012 17:38:58 -0400
From: ghudson@mit.edu
Message-Id: <201204042138.q34LcwrA020043@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
http://src.mit.edu/fisheye/changelog/krb5/?cs=25801
Commit By: ghudson
Log Message:
ticket: 7110
subject: Fix password reuse check with cpw -keepold
When we check for password reuse, only compare keys with the most
recent kvno against history entries, or else we will always fail with
-keepold.
This bug primarily affects rollover of cross-realm TGT principals,
which typically use password-derived keys and may have an associated
password policy such as "default".
Bug report and candidate fix (taken with a slight modification) by
Nicolas Williams.
Changed Files:
U trunk/src/lib/kadm5/srv/svr_principal.c
Modified: trunk/src/lib/kadm5/srv/svr_principal.c
===================================================================
--- trunk/src/lib/kadm5/srv/svr_principal.c 2012-04-02 18:38:45 UTC (rev 25800)
+++ trunk/src/lib/kadm5/srv/svr_principal.c 2012-04-04 21:38:57 UTC (rev 25801)
@@ -972,6 +972,9 @@
assert (n_new_key_data >= 0);
for (x = 0; x < (unsigned) n_new_key_data; x++) {
+ /* Check only entries with the most recent kvno. */
+ if (new_key_data[x].key_data_kvno != new_key_data[0].key_data_kvno)
+ break;
ret = krb5_dbe_decrypt_key_data(context, NULL, &(new_key_data[x]),
&newkey, NULL);
if (ret)
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
