From cf3fafb2f0558f0ca984ebe33afd15c97192e17c Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 24 Feb 2017 13:41:53 -0500 Subject: Fix PKINIT two-component matching rule parsing In pkinit_matching.c:parse_rule_set(), apply the default relation when parsing the second component of a rule, not the third. Otherwise we apply no default relation to two-component matching rules, effectively reducing such rules to their second components. Reported by Sumit Bose. (cherry picked from commit 67ae7bbe1ea7032d1cb79682be3a14e7e13ec64f) ticket: 8553 version_fixed: 1.14.5 --- src/plugins/preauth/pkinit/pkinit_matching.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c index a3bf3f4..a50c50c 100644 --- a/src/plugins/preauth/pkinit/pkinit_matching.c +++ b/src/plugins/preauth/pkinit/pkinit_matching.c @@ -409,7 +409,7 @@ parse_rule_set(krb5_context context, } rs->num_crs = 0; while (remaining > 0) { - if (rs->relation == relation_none && rs->num_crs > 1) { + if (rs->relation == relation_none && rs->num_crs > 0) { pkiDebug("%s: Assuming AND relation for multiple components in rule '%s'\n", __FUNCTION__, rule_in); rs->relation = relation_and; -- cgit v1.1