diff options
| author | Andreas Schneider <asn@samba.org> | 2015-07-17 09:03:25 +0200 |
|---|---|---|
| committer | Andreas Schneider <asn@cryptomilk.org> | 2015-07-17 11:01:23 +0200 |
| commit | 33817876cb7ecb9432cfefad1cf67ae75260310d (patch) | |
| tree | ce8d2ebd278dd779f03576077cb752ab74f971ad | |
| parent | 6aa0ae50e286e99d2fd85d1f92302a318f066fa3 (diff) | |
| download | samba-33817876cb7ecb9432cfefad1cf67ae75260310d.tar.gz | |
s4-kerberos: Make sure we handle kvno's in keytabs correctly
Signed-off-by: Andreas Schneider <asn@samba.org>
| -rw-r--r-- | source4/auth/kerberos/kerberos_util.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c index b7f5ab0f09f..76d46bc13f1 100644 --- a/source4/auth/kerberos/kerberos_util.c +++ b/source4/auth/kerberos/kerberos_util.c @@ -522,6 +522,7 @@ krb5_error_code smb_krb5_remove_obsolete_keytab_entries(TALLOC_CTX *mem_ctx, } do { + krb5_kvno old_kvno = kvno - 1; krb5_keytab_entry entry; bool matched = false; uint32_t i; @@ -556,8 +557,14 @@ krb5_error_code smb_krb5_remove_obsolete_keytab_entries(TALLOC_CTX *mem_ctx, continue; } - /* Delete it, if it is not kvno - 1 */ - if (entry.vno != (kvno - 1)) { + /* + * Delete it, if it is not kvno - 1. + * + * Some keytab files store the kvno only in 8bits. Limit the + * compare to 8bits, so that we don't miss old keys and delete + * them. + */ + if ((entry.vno & 0xff) != (old_kvno & 0xff)) { krb5_error_code rc; /* Release the enumeration. We are going to |