[4180] in Kerberos-V5-bugs
Re: [krbdev.mit.edu #1445] GSSAPI can fail to generate error in
daemon@ATHENA.MIT.EDU (Sam Hartman via RT)
Thu May 1 19:42:34 2003
Date: Thu, 1 May 2003 19:42:26 -0400 (EDT)
Mail-Followup-To: rt@krbdev.mit.edu
Message-Id: <rt-1445-5920.13.8054211482354@krbdev.mit.edu>
In-Reply-To: <rt-1445@krbdev.mit.edu>
From: "Sam Hartman via RT" <rt-comment@krbdev.mit.edu>
Mail-Copies-To: never
cc: krb5-prs@mit.edu
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
>>>>> "Nicolas" == Nicolas Williams via RT <rt-comment@krbdev.mit.edu> writes:
Nicolas> Which brings us back to a discussion we had at Cthon03:
Nicolas> why not always decode the ap-req and use
Nicolas> krb5_rd_req_dec() instead of krb5_rd_req().
Not really. Or at least I fail to see how your comment is actually
related to the bug or the code.
Note that the code in question already has access to the server
principal from the ap_req because it is in the path that is decoding
it.
Correct solutions include:
* Removivg that code path and not sending back an error token if the ap_req cannot be read.
* Grabbing the server principal out of the ap-req not out of the credential.
What I'll probably do when I get around to it is grab the the server
princ out of the ap-req if cred->princ is null.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
