aboutsummaryrefslogtreecommitdiff
path: root/src/lib
AgeCommit message (Collapse)AuthorFilesLines
2013-10-17Change KRB5KDC_ERR_NO_ACCEPTABLE_KDF to 100Greg Hudson1-2/+2
draft-ietf-krb-wg-pkinit-alg-agility-07 specifies KDC_ERR_NO_ACCEPTABLE_KDF as 82, but this value conflicts with KRB_AP_ERR_PRINCIPAL_UNKNOWN from RFC 6111. The former value has been reassigned to 100 to fix the conflict. Use the correct value. We believe that this error won't crop up in practice for a long time (when SHA-2 has been superceded by other hash algorithms and people are desupporting it), by which time implementations will mostly have been upgraded to use the new value. (cherry picked from commit 2938851a5ec77ab68bcd1f5cfd07991c7ccabea6) ticket: 7725 (new) version_fixed: 1.10.7 status: resolved
2013-05-30Fix transited handling for GSSAPI acceptorsTom Yu1-3/+5
The Acceptor Names project (#6855) extended krb5_rd_req so that it can accept a "matching principal" in the server parameter. If the matching principal has an empty realm, rd_req_decoded_opt attempted to do transited checking with an empty server realm. To fix this, always reset server to req->ticket->server for future processing steps if we decrypt the ticket using a keytab. decrypt_ticket replaces req->ticket->server with the principal name from the keytab entry, so we know this name is correct. Based on a bug report and patch from nalin@redhat.com. (cherry picked from commit 57acee11b5c6682a7f4f036e35d8b2fc9292875e) [tlyu@mit.edu: removed test due to k5test.py incompatibility] ticket: 7649 (new) version_fixed: 1.10.6 status: resolved
2013-04-12Fix condition with empty bodyDavid Benjamin1-2/+2
Found by clang's warnings. (cherry picked from commit 18796a2eb6c05706c6635453b3e425955aab93f4) ticket: 7606 (new) version_fixed: 1.10.5 status: resolved
2013-02-22Fix initial call to svcraw_createNickolai Zeldovich1-0/+1
gssrpc raw services could not work because svcraw_create did not set svcraw_private after allocating memory for it. [ghudson@mit.edu: commit message, patch splitting] (cherry picked from commit 5e3bf4ac6cb02601c5f10c5b2804fd5028c80119) ticket: 7582 (new) subject: Minor pointer management patches
2013-02-22Fix gss_str_to_oid for OIDs with zero-valued arcsLuke Howard1-6/+6
gss_str_to_oid wasn't outputting any bytes for a zero-valued arc. It should output one byte with value 0. [ghudson@mit.edu: commit message] (cherry picked from commit 54fa4433df7412267375240aba40959e97ac4fe2) ticket: 7579 (new) version_fixed: 1.10.4 status: resolved
2013-02-22Check for negative poll timeout in k5_sendto_kdcGreg Hudson1-0/+4
(cherry picked from commit 74bee54227deb64a41c2e79f57dd2a2c5ea010a3) ticket: 7578 (new) version_fixed: 1.10.4 status: resolved
2013-02-22Convert success in krb5_chpw_result_code_stringJonathan Reams1-0/+3
Result code 0 used to be converted properly by krb5_set_password, though not krb5_change_password; this changed in 1.10 when krb5int_setpw_result_code_string was folded into krb5_chpw_result_code_string. Restore the old behavior, and make it apply to krb5_change_password as well, by making krb5_chpw_result_code_string convert result code 0. [ghudson@mit.edu: commit message] (cherry picked from commit 316bf74b4696058e2b60c95c9d0fc90d6c2c2ffe) ticket: 7576 (new) version_fixed: 1.10.4 status: resolved
2013-02-22Make kprop/kpropd work with RC4 session keyGreg Hudson3-20/+19
In krb5_auth_con_initivector and mk_priv/rd_priv, stop assuming that the enctype's block size is the size of the cipher state. Instead, make and discard a cipher state to get the size. (cherry picked from commit 8d01455ec9ed88bd3ccae939961a6e123bb3d45f) ticket: 7575 (new) version_fixed: 1.10.4 status: resolved
2013-01-11Fix various integer issuesTom Yu1-3/+3
In kdc_util.c and spnego_mech.c, error returns from ASN.1 length functions could be ignored because they were assigned to unsigned values. In spnego_mech.c, two buffer size checks could be rewritten to reduce the likelihood of pointer overflow. In dump.c and kdc_preauth.c, calloc() could be used to simplify the code and avoid multiplication overflow. In pkinit_clnt.c, the wrong value was checked for a null result from malloc(), and the code could be simplified. Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>. (cherry picked from commit d3c5450ddf0b20855e86dab41735d56c6860156b) [tlyu@mit.edu: omitted pkinit and kdb5_util fixes because they're not conservative] ticket: 7545 (new) version_fixed: 1.10.4 status: resolved
2013-01-11Suppress some gcc uninitialized variable warningsGreg Hudson1-1/+1
gcc 4.6.2 reportedly finds some spurious maybe-uninitialized warnings. Suppress them. Patch from Eray Aslan with some adjustment. (cherry picked from commit cc2f16af06800bf9882c1589d3d6e9b8f19b6d6f) ticket: 7543 (new) version_fixed: 1.10.4 status: resolved
2013-01-11Avoid side effects in assert expressionsGreg Hudson2-2/+6
asserts may be compiled out with -DNDEBUG, so it's wrong to use an assert expression with an important side effect. (We also have scores of side-effecting asserts in test programs, but those are less important and can be dealt with separately.) (cherry picked from commit 221cd4a23691601a14500bc00146c265b50bdc94) ticket: 7542 (new) version_fixed: 1.10.4 status: resolved
2013-01-11Suppress maybe-uninitialized warning in x-deltat.yGreg Hudson2-23/+25
Recent versions of gcc can generate a maybe-uninitialized warning from bison output instead of a regular uninitialized warning. Suppress both. Fix from nalin@redhat.com. (cherry picked from commit d4f98cdd40559620531622c9c6d988f6aa850bd0) ticket: 7541 (new) version_fixed: 1.10.4 status: resolved
2013-01-09Make verify_init_creds work with existing ccacheGreg Hudson1-7/+0
As the file ccache implementation currently stands, we don't want to turn off TC_OPENCLOSE on a file cache we're writing to, or it will be opened read-only and stores to it will fail. Reported by Russ Allbery. (cherry picked from commit 0ae663d35b7dcbf2c469ad0688a67f4d1c0e425e) ticket: 7538 (new) version_fixed: 1.10.4 status: resolved
2013-01-09Ensure null termination of AFS saltsGreg Hudson1-1/+1
Use krb5int_copy_data_contents_add0 when copying a pa-pw-salt or pa-afs3-salt value in pa_salt(). If it's an afs3-salt, we're going to throw away the length and use strcspn in krb5int_des_string_to_key, which isn't safe if the value is unterminated. (cherry picked from commit f566fee75f2455d6e5e7ee4fcdf5a0d327808639) ticket: 7537 (new) version_fixed: 1.10.4 status: resolved
2013-01-02Fix spurious clock skew caused by gak_fct delayGreg Hudson1-5/+4
In get_in_tkt.c, a time offset is computed between the KDC's auth_time and the current system time after the reply is decrypted. Time may have elapsed between these events because of a gak_fct invocation which blocks on user input. The resulting spurious time offset can cause subsequent TGS-REQs to fail and can also cause the end time of the next AS request to be in the past (issue #889) in cases where the old ccache is opened to find the default principal. Use the system time, without offset, for the request time of an AS request, for more predictable kinit behavior. Use this request time, rather than the current time, when computing the clock skew after the reply is decrypted. (cherry picked from commit 37b0e55e21926c7875b7176e24e13005920915a6) ticket: 7528 (new) version_fixed: 1.10.4 status: resolved
2012-09-12Unregister error message key on library unloadBen Kaduk1-0/+1
Revision fcdd2de1 added the K5_KEY_GSS_KRB5_ERROR_MESSAGE key, and registered it in the gssapi library initialization routine, but did not unregister it in the libary finalization routine. When the library is unloaded and reloaded in the same process, this leads to an assertion failure, since we check that destructors_set[keynum] is zero (no destructor set) when registering a key in util/support/threads.c. Unregister the key on library cleanup to resolve the error. (cherry picked from commit 4ab584c830024757cc628b1783dde6220a9fec6d) ticket: 7353 version_fixed: 1.10.4 status: resolved
2012-09-11Do not retrieve zero-length credsBen Kaduk1-2/+4
In the MSLSA cache, if we get back a zero-length ticket, don't accept it as success; continue on to try and get an acceptable ticket. (cherry picked from commit cd58adf4b0f52d0293ec8bf9d7d3e87bd1e6ce3f) ticket: 7349 version_fixed: 1.10.4 status: resolved
2012-08-29Improve error translation for CCAPIv3 routinesBen Kaduk1-8/+9
We can't mix the KRB5 and CC error constants; standardize on the CC ones and translate appropriately. (cherry picked from commit c326061409d6e48e68808e6f37b243e4f7356935) ticket: 7339 version_fixed: 1.10.4 status: resolved
2012-08-27Set fCachesTicket=TRUE when no credentialsKevin Wasserman1-1/+2
It is not really clear this is correct, but neither was the previous behavior. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit c654e9c7436cdd57cb61c0bd29b26c79e3675a01) ticket: 7255 status: resolved
2012-08-27Do not be over-restrictive in the presence of UACKevin Wasserman1-39/+4
We used to explicitly check if a process was UAC-limited and deny all access to the TGT in that case; however, this makes the MSLSA cache effectively useless. Do not try to outsmart UAC, and let it do its own checking -- this allows UAC-limited access to the MSLSA ccache, which should mean read-write access to service tickets, and write-only access to the TGT. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> [kaduk@mit.edu: delete instead of comment out, move comment.] (cherry picked from commit 8020c64554dd25a4f09df8a28dca924c6ecb5608) ticket: 7254 status: resolved
2012-08-27Remove unused struct and switch_to stubsKevin Wasserman1-11/+1
Only one mslsa ccache is supported, so switch_to is not needed. Likewise, struct krb5int_lcc_iterator is unneccesary. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit c19826ccddd0d712ca581d67cdcf317c36dfaa85) ticket: 7236 version_fixed: 1.10.4 status: resolved
2012-08-24Remove preauth_sam2 from windows buildKevin Wasserman1-1/+0
The source file preauth_sam2.c is not present on the krb5-1.10 branch, so don't try building it. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> [tlyu@mit.edu: clarify commit message] ticket: 7277 (new) version_fixed: 1.10.4 status: resolved
2012-08-13Use gssalloc in krb5_gss_export_nameGreg Hudson1-1/+1
krb5_gss_export_name uses malloc to construct a gss_buffer_desc value, and should use gssalloc_malloc instead. (cherry picked from commit e54c8d7e6c6185ff4d0e1b472f98897c2e3fc5b3) ticket: 7233 version_fixed: 1.10.4 status: resolved
2012-08-13Use gssalloc in more parts of GSSAPIGreg Hudson5-11/+13
Fix some GSSAPI buffer allocations which were missed in 800358b1790ef82710af0b6021c6ff2dca2b0de7: gss_export_sec_context, gss_display_name, and IAKERB and SPNEGO token construction. (cherry picked from commit 45e4eaa298e0dcebef46d07a6acb54cd9affb2ca) ticket: 7233
2012-08-13Avoid mapping GSSAPI minor code on successGreg Hudson1-1/+2
In gssint_import_internal_name, don't map the minor code from mech->gss_duplicate_name if it returned successfully. Fixes an "unexpected non-zero minor status" error reported by SAP's gsstest when it invokes gss_canonicalize_name(). (cherry picked from commit a02fcceeaeab1441d815255d569aaa6c193c2725) ticket: 7194 version_fixed: 1.10.4 status: resolved
2012-08-03Fix oid set construction in gss_inquire_cred()Kevin Wasserman1-22/+10
Use gssapi calls to construct the oid sets. It is not safe on windows to use malloc to hand-construct the set and then call gss_release_oid_set() to clean it up. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 4cfdf8da69f52c778af4faaea663981a67634bb6) ticket: 7227 version_fixed: 1.10.3 status: resolved
2012-08-01Fix KDC uninit ptrs [CVE-2012-1014 CVE-2012-1015]Tom Yu1-0/+3
Fix KDC heap corruption and crash vulnerabilities [MITKRB5-SA-2012-001 CVE-2012-1014 CVE-2012-1015]. CVE-2012-1015: The cleanup code in kdc_handle_protected_negotiation() in kdc_util.c could free an uninitialized pointer in some error conditions involving "similar" enctypes and a failure in krb5_c_make_checksum(). Initialize the pointer correctly. Additionally, adjust the handling of "similar" enctypes to avoid advertising enctypes that could lead to inadvertent triggering of CVE-2012-1015 (possibly in unpatched KDCs). CVE-2012-1014: process_as_req() could encounter an error condition (typically a malformed AS-REQ message) that could cause its cleanup code to dereference an uninitialized pointer, causing a crash. Initialize the pointer correctly. ticket: 7226 (new) version_fixed: 1.10.3 status: resolved
2012-07-23__func__ -> __FUNCTION__ in disp_status.cKevin Wasserman1-4/+4
For MSVC compatibility Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 0552f29887201227788d1ca3df9d2b2c4f2447d2) ticket: 7208 version_fixed: 1.10.3 status: resolved
2012-07-23Don't use syslog / LOG_DEBUG when they don't existKevin Wasserman1-1/+1
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 5ae666d1591f5ab8bc1182d053cdda7ce9a855d2) ticket: 7207 version_fixed: 1.10.3 status: resolved
2012-07-23Fix -DDEBUG compilation errorsHenry B. Hotz3-3/+4
(cherry picked from commit 7c3ecf5c77e33f6d04d6226b041071c6ce23b062) ticket: 7150 version_fixed: 1.10.3 status: resolved
2012-07-23krb5_stdccv3_get_principal error handling fixupKevin Wasserman1-1/+3
Don't treat an error returned by krb5_parse_name as a cc-internal error. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit fbe77b2c7d4340097690cbed7b48fd9888feacd4) ticket: 7214 version_fixed: 1.10.3 status: resolved
2012-07-23Implement cccol iterators for mslsaKevin Wasserman1-8/+65
Also implement switch_to stub Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 218193bb93d8cf9fd82087533c45602b6a8c5151) Fix macro redefinition warnings in cc_mslsa.c Include ntstatus.h and define WIN32_NO_STATUS before including winnt.h Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit ee6fbe222b34b28c617d4e6df994700af471b1b6) fix leak in cc_mslsa.c cc_name needs to be freed in krb5_lcc_close(). Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit dcd9202f058830eacbbdfd0dd26bd82d8101e8fd) ticket: 7213 version_fixed: 1.10.3 status: resolved
2012-07-23MSLSA Don't use lstrcpy on ANSI stringsKevin Wasserman1-11/+3
Also change parameter types to eliminate casts. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 7acb524f5aa00274771dbbfac19d2dd779aad409) ticket: 7212 version_fixed: 1.10.3 status: resolved
2012-07-23Define USE_CCAPI_V3 in krb5/ccache on windowsKevin Wasserman2-1/+2
USE_CCAPI_V3 provides cccol iteration support for ccapi. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 227a1b093cb22eb7c6d7fee0759f28816572db70) Build lib/krb5/ccache/ccapi on Windows only Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 8c3d2bfab7017a587d0c9a7de262cdcf18ce21c8) ticket: 7209 version_fixed: 1.10.3 status: resolved
2012-07-23kfw add preauth_sam2 to OBJS for windows buildKevin Wasserman1-0/+1
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit d319617ba9dd1256784fe325ae5a3858cf4603e7) ticket: 7203 version_fixed: 1.10.3 status: resolved
2012-07-23Add krb5int_cc_user_set_default_nameTom Yu2-4/+57
Set the default credential cache name for all processes for the current user. Currently implemented, for windows only, by setting HKEY_CURRENT_USER\Software\MIT\Kerberos5:ccname to the specified ccache name. This will not override the environment variable 'KRB5CCNAME'. It will override HKEY_LOCAL_MACHINE and 'indirect' registry values. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 80097093062822dde3f1140d250023576e52f59c) ticket: 7199 version_fixed: 1.10.3 status: resolved
2012-07-23Implement switch_to for ccapiv3Kevin Wasserman2-0/+27
krb5_stdccv3_switch_to() calls cc_ccache_set_default(). krb5_stdccv3_resolve() checks for NULL or empty residual and calls cc_context_get_default_ccache_name() in those cases. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> (cherry picked from commit 2648a94ea1cf3dec91186dfec59b75de9dac793d) ticket: 7198 version_fixed: 1.10.3 status: resolved
2012-06-25Fix crash on invalid DIR ccache primary fileGreg Hudson1-2/+2
If read_primary_file() fails with an error other than ENOENT, abort cache resolution rather than dereferencing a null pointer. Reported by Oliver Loch. (cherry picked from commit 036ca94bdc00cc8eb248dc5c0da85ab556d3373e) ticket: 7185 version_fixed: 1.10.3 status: resolved
2012-06-15Use correct profile var in krb5_get_tgs_ktypesTom Yu1-1/+1
In r21879, when we converted to using KRB5_CONF macros for profile variable names, we made a typo in krb5_get_tgs_ktypes and erroneously started using default_tkt_enctypes instead of default_tgs_enctypes for TGS requests. Fix the typo and return to the documented behavior. (cherry picked from commit 627ed34ba368fe989b7498bddf9d9dae40d76135) ticket: 7155 version_fixed: 1.10.3 status: resolved
2012-05-30Make dependTom Yu1-1/+1
2012-05-29Null pointer deref in kadmind [CVE-2012-1013]Richard Basch1-1/+1
The fix for #6626 could cause kadmind to dereference a null pointer if a create-principal request contains no password but does contain the KRB5_KDB_DISALLOW_ALL_TIX flag (e.g. "addprinc -randkey -allow_tix name"). Only clients authorized to create principals can trigger the bug. Fix the bug by testing for a null password in check_1_6_dummy. CVSSv2 vector: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C [ghudson@mit.edu: Minor style change and commit message] (cherry picked from commit c5be6209311d4a8f10fda37d0d3f876c1b33b77b) ticket: 7152 version_fixed: 1.10.2 status: resolved
2012-05-29Export gss_mech_krb5_wrong from libgssapi_krb5Greg Hudson1-0/+1
Although there are few legitimate reasons to use gss_mech_krb5_wrong, it's declared in the public header and exported in the Windows DLL. So export it from the Unix library as well. (cherry picked from commit 9b693c2c5370a3a792f594ccb08475465438cd19) ticket: 7148 version_fixed: 1.10.2 status: resolved
2012-05-29Fix S4U user identification in preauth caseGreg Hudson1-4/+2
In 1.10, encrypted timestamp became a built-in module instead of a hardcoded padata handler. This changed the behavior of krb5_get_init_creds as invoked by s4u_identify_user such that KRB5_PREAUTH_FAILED is returned instead of the gak function's error. (Module failures are not treated as hard errors, while hardcoded padata handler errors are.) Accordingly, we should look for KRB5_PREAUTH_FAILED in s4u_identify_user. On a less harmful note, the gak function was returning a protocol error code instead of a com_err code, and the caller was testing for a different protocol error code (KDC_ERR_PREAUTH_REQUIRED) which could never be returned by krb5_get_init_creds. Clean up both of those by returning KRB5_PREAUTH_FAILED from the gak function and testing for that alone. Reported by Michael Morony. (cherry picked from commit 33a64a7f9dc7342880f7a477a8b3447891d20af5) ticket: 7136 version_fixed: 1.10.2 status: resolved
2012-05-21Export krb5_set_trace_callback/filenameGreg Hudson2-0/+5
krb5_set_trace_callback and krb5_set_trace_filename were added to krb5.h in krb5 1.9, but were mistakenly left out of the library export lists. Add them now. Reported by Russ Allbery. (backported from commit 61e6ab231b75f7ac3ff8967f002436e48ce05620) ticket: 7143 version_fixed: 1.10.2 status: resolved
2012-05-16In sn2princ, getaddrinfo without AI_ADDRCONFIGGreg Hudson1-1/+1
When canonicalizing a principal, use AI_CANONNAME alone in the hint flags for getaddrinfo, for two reasons. First, it works around a gnu libc bug where getaddrinfo does a PTR lookup for the canonical name (we tried to work around this in r24977 bug the addition of AI_ADDRCONFIG caused the same problem as the use of AF_INET). Second, an IPv4-only host should be able create a principal for an IPv6-only host even if it can't contact the host. This does result in extra AAAA queries in the common case (IPv4-only host contacting IPv4-only service), which is unfortunate. But we need to leave that optimization up to the platform at this point. (cherry picked from commit c3ab5fe0b01a68b14d5657740006488721b48b7b) ticket: 7124 version_fixed: 1.10.2 status: resolved
2012-05-15Make password change work without default realmGreg Hudson1-0/+5
This fix is not very general or clean, but is suitable for backporting because it is minimally invasive. A more comprehensive fix will follow. (cherry picked from commit b9ff95a51ef11742abc9687a70b6d8324eda6803) ticket: 7127 version_fixed: 1.10.2 status: resolved
2012-05-15Use correct name-type in TGS-REQs for 2008R2 RODCsTom Yu2-12/+19
Correctly set the name-type for the TGS principals to KRB5_NT_SRV_INST in TGS-REQs. (Previously, only AS-REQs had the name-type set in this way.) Windows Server 2008 R2 read-only domain controllers (RODCs) insist on having the correct name-type for the TGS principal in TGS-REQs as well as AS-REQs, at least for the TGT-forwarding case. Thanks to Sebastian Galiano for reporting this bug and helping with testing. (cherry picked from commit 5994d8928b8ff88751b14bc60c7d7bfce8b30e57) ticket: 7120 version_fixed: 1.10.2 status: resolved
2012-05-15Clear preauth use counts for each AS requestGreg Hudson1-0/+1
Initialize use_count fields in krb5_preauth_request_context_init, which is invoked before each AS request. Previously they were initialized only in krb5_init_preauth_context, which is only invoked once per krb5 library context. (cherry picked from commit f469d77cc53c43a2e85f80ab3cf68caa82c4d24b) ticket: 7119 version_fixed: 1.10.2 status: resolved
2012-05-15Try all history keys to decrypt password historyGreg Hudson3-45/+62
A database created prior to 1.3 will have multiple password history keys, and kadmin prior to 1.8 won't necessarily choose the first one. So if there are multiple keys, we have to try them all. If none of the keys can decrypt a password history entry, don't fail the password change operation; it's not worth it without positive evidence of password reuse. (backported from commit 2782e80a12bccd920fa71e23166ac97c4470a637) ticket: 7099 version_fixed: 1.10.2 status: resolved
2012-03-07Pull up r25730 from trunkTom Yu1-0/+4
------------------------------------------------------------------------ r25730 | ghudson | 2012-03-05 12:35:14 -0500 (Mon, 05 Mar 2012) | 15 lines ticket: 7098 subject: Fix spurious password expiry warning target_version: 1.9.4 tags: pullup r24241 (#6755) introduced a bug where if the KDC sends a LastReq entry containing an account expiry time, we send a prompter warning for password expiry even if there was no entry containing a password expiry time. Typically, this results in the message "Warning: Your password will expire in less than one hour on Thu Jan 1 12:00:00 1970". Fix this by explicitly checking for pw_exp == 0 in warn_pw_expiry() after we've gotten past the conditional for invoking the callback. ticket: 7098 version_fixed: 1.10.1 status: resolved git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25741 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit v1.1 at 2024-09-08 05:00:04 +0000