RT RT/krbdev.mit.edu: Ticket #7544 Handle PKINIT DH replies with no certs Signed in as guest.
[Logout]

[Home] [Search] [Configuration]

[Display] [History] [Basics] [Dates] [People] [Links] [Jumbo]

 
 

 The Basics  
Id
7544
Status
resolved
Worked
0 min
Priority
0/0
Queue
krb5
 

 Keyword Selections  
Component
Tags
Version_reported
Version_Fixed
  • 1.10.4
Target_Version
 

 Relationships  
Depends on:
Depended on by:
Parents:
Children:

Refers to:
  • 7183: (ghudson) PKINIT should handle CMS SignedData without certificates [resolved]
Referred to by:
 
 Dates  
Created: Fri Jan 11 16:03:53 2013
Starts: Not set
Started: Fri Jan 11 16:03:58 2013
Last Contact: Not set
Due: Not set
Updated: Fri Jan 11 19:07:47 2013 by tlyu
 

 People  
Owner
 tlyu
Requestors
 tlyu@mit.edu
Cc
 
AdminCc
 
 

 More about Taylor Yu  
Comments about this user:
No comment entered about this user
This user's 25 highest priority tickets:
 

History   Display mode: [Brief headers] [Full headers]
      Fri Jan 11 16:03:53 2013  tlyu - Ticket created    
     
From: tlyu@mit.edu
Subject: SVN Commit


Handle PKINIT DH replies with no certs

If a PKINIT Diffie-Hellman reply contains no certificates in the
SignedData object, that may be because the signer certificate was a
trust anchor as transmitted to the KDC.  Heimdal's KDC, for instance,
filters client trust anchors out of the returned set of certificates.
Match against idctx->trustedCAs and idctx->intermediateCAs to handle
this case.  This fix only works with OpenSSL 1.0 or later; when built
against OpenSSL 0.9.x, the client will still require a cert in the
reply.

Code changes suggested by nalin@redhat.com.

(cherry picked from commit db83abc7dcfe369bd4467c78eebb7028ba0c0e0d)

https://github.com/krb5/krb5/commit/9bbf3649867f444674716941b787f6699885c803
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: 9bbf3649867f444674716941b787f6699885c803
Branch: krb5-1.10
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c |    9 ++++++++-
 1 files changed, 8 insertions(+), 1 deletions(-)


Download (untitled) 977b
      Fri Jan 11 16:03:57 2013  tlyu - Requestor tlyu@mit.edu added    
      Fri Jan 11 16:03:58 2013  tlyu - Status changed from new to resolved    
      Fri Jan 11 16:03:59 2013  tlyu - Version_Fixed 1.10.4 added    
      Fri Jan 11 19:07:47 2013  tlyu - Ticket 7544 RefersTo ticket 7183.