diff options
Diffstat (limited to 'src/lib/krb5/krb/gen_seqnum.c')
| -rw-r--r-- | src/lib/krb5/krb/gen_seqnum.c | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/src/lib/krb5/krb/gen_seqnum.c b/src/lib/krb5/krb/gen_seqnum.c index 196a437..3737640 100644 --- a/src/lib/krb5/krb/gen_seqnum.c +++ b/src/lib/krb5/krb/gen_seqnum.c @@ -36,7 +36,7 @@ #endif krb5_error_code -krb5_generate_seq_number(krb5_context context, const krb5_keyblock *key, krb5_int32 *seqno) +krb5_generate_seq_number(krb5_context context, const krb5_keyblock *key, krb5_ui_4 *seqno) { krb5_data seed; krb5_error_code retval; @@ -48,5 +48,20 @@ krb5_generate_seq_number(krb5_context context, const krb5_keyblock *key, krb5_in seed.length = sizeof(*seqno); seed.data = (char *) seqno; - return(krb5_c_random_make_octets(context, &seed)); + retval = krb5_c_random_make_octets(context, &seed); + if (retval) + return retval; + /* + * Work around implementation incompatibilities by not generating + * initial sequence numbers greater than 2^30. Previous MIT + * implementations use signed sequence numbers, so initial + * sequence numbers 2^31 to 2^32-1 inclusive will be rejected. + * Letting the maximum initial sequence number be 2^30-1 allows + * for about 2^30 messages to be sent before wrapping into + * "negative" numbers. + */ + *seqno &= 0x3fffffff; + if (*seqno == 0) + *seqno = 1; + return 0; } |