commit a602ced730c88d6b4c0459c9712302fce2a4990c
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Mon Mar 15 23:50:52 2010 +0000
ticket: 6676
version_fixed: 1.8.1
status: resolved
pull up r23766 from trunk
------------------------------------------------------------------------
r23766 | ghudson | 2010-03-05 12:45:46 -0500 (Fri, 05 Mar 2010) | 10 lines
ticket: 6676
subject: Ignore improperly encoded signedpath AD elements
target_version: 1.8.1
tags: pullup
We have some reason to believe Microsoft and Heimdal are both using
the authdata value 142 for different purposes, leading to failures in
verify_ad_signedpath(). For better interoperability, treat such
tickets as unsigned, rather than invalid.
git-svn-id:
svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23809
dc483132-0cff-0310-8789-dd5450dbe970
src/kdc/kdc_authdata.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
---
diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c
index 5097558..b5de64d 100644
--- a/src/kdc/kdc_authdata.c
+++ b/src/kdc/kdc_authdata.c
@@ -934,8 +934,12 @@ verify_ad_signedpath(krb5_context context,
enc_sp.length = sp_authdata[0]->length;
code = decode_krb5_ad_signedpath(&enc_sp, &sp);
- if (code != 0)
+ if (code != 0) {
+ /* Treat an invalid signedpath authdata element as a missing one, since
+ * we believe MS is using the same number for something else. */
+ code = 0;
goto cleanup;
+ }
code = verify_ad_signedpath_checksum(context,
krbtgt,