[27576] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.11]: Allow multi-hop SAM-2 exchanges
daemon@ATHENA.MIT.EDU (Tom Yu)
Tue Feb 19 16:31:58 2013
Date: Tue, 19 Feb 2013 16:31:55 -0500
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201302192131.r1JLVtI0002888@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/370572d682c569c21a7d6a94080237e131b38664
commit 370572d682c569c21a7d6a94080237e131b38664
Author: Greg Hudson <ghudson@mit.edu>
Date: Sun Feb 17 12:23:30 2013 -0500
Allow multi-hop SAM-2 exchanges
Prior to 1.11, it was possible to do SAM-2 preauth exchanges with
multiple hops by sending repeated preauth-required errors with
different challenges (which is not the way multi-hop exchanges are
described in RFC 6113, but it can still work). This stopped working
when SAM-2 was converted to a built-in module because of the use_count
field. Disable the use count for SAM-2 specifically.
ticket: 7571
version_fixed: 1.11.1
status: resolved
src/lib/krb5/krb/preauth2.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
index 23f00f3..4e235bd 100644
--- a/src/lib/krb5/krb/preauth2.c
+++ b/src/lib/krb5/krb/preauth2.c
@@ -590,7 +590,8 @@ run_preauth_plugins(krb5_context kcontext,
TRACE_PREAUTH_SKIP(kcontext, module->name, module->pa_type);
continue;
}
- module->use_count++;
+ if (module->pa_type != KRB5_PADATA_SAM_CHALLENGE_2)
+ module->use_count++;
}
/* run the module's callback function */
out_pa_data = NULL;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
