diff options
| author | Greg Hudson <ghudson@mit.edu> | 2010-01-28 21:39:31 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2010-01-28 21:39:31 +0000 |
| commit | f0e084261aec6be2d508b33f960d38d19f0d0345 (patch) | |
| tree | 6317db1b8cab2e9e99ce4d3f0a8f8d3cb259b239 /src/lib/kadm5/srv | |
| parent | 0b929b1f34ea96096f1fbb3736bc33ff3375afa1 (diff) | |
| download | krb5-f0e084261aec6be2d508b33f960d38d19f0d0345.zip krb5-f0e084261aec6be2d508b33f960d38d19f0d0345.tar.gz krb5-f0e084261aec6be2d508b33f960d38d19f0d0345.tar.bz2 | |
Handle migration from pre-1.7 databases with master key kvno != 1
krb5_dbe_lookup_mkvno assumes an mkvno of 1 for entries with no
explicit tl_data. We've seen at least one pre-1.7 KDB with a master
kvno of 0, violating this assumption. Fix this as follows:
* krb5_dbe_lookup_mkvno outputs 0 instead of 1 if no tl_data exists.
* A new function krb5_dbe_get_mkvno translates this 0 value to the
minimum version number in the mkey_list. (krb5_dbe_lookup_mkvno
cannot do this as it doesn't take the mkey_list as a parameter.)
* Call sites to krb5_dbe_lookup_mkvno are converted to
krb5_dbe_get_mkvno, except for an LDAP case where it is acceptable
to store 0 if the mkvno is unknown.
ticket: 6650
target_version: 1.7.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23676 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/kadm5/srv')
| -rw-r--r-- | src/lib/kadm5/srv/svr_principal.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index 2f2faaa..a01f072 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -874,7 +874,8 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (kdb.key_data[i].key_data_kvno > entry->kvno) entry->kvno = kdb.key_data[i].key_data_kvno; - ret = krb5_dbe_lookup_mkvno(handle->context, &kdb, &entry->mkvno); + ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, + &entry->mkvno); if (ret) goto done; |