Domainkey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=nf8XERch5Fk+X0MyeMnptCSYcYe9gWmZUaaGt7+TpuJwgAv19Yb3zmNJs9SUEtrL2oorebXPs50po+7DprieF3QTFo+6tcIee9pD1anwRjkYk9tAiH4ny4L5c/6nGSMlVoko/WY1hd8YZ1Hy30lXo0pjX5vyH44lr+J5ZXZrDWE=
Message-ID: <4d569c330711091316j7fc35cf1xff80a78bc0dfd0dc@mail.gmail.com>
Date: Fri, 9 Nov 2007 16:16:52 -0500
From: "Kevin Coffman" <kwc@citi.umich.edu>
Sender: kwcoffman@gmail.com
To: rt-comment@krbdev.mit.edu, rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #5840] Prevent kadm5_decrypt_key() from coercing the keytype if the requested ktype == -1
In-Reply-To: <rt-5840-25655.14.4358841754909@krbdev.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <rt-5840@krbdev.mit.edu> <rt-5840-25655.14.4358841754909@krbdev.mit.edu>
RT-Send-Cc: 
Content-Length: 1251

FYI, this is a dup of RT#2059.

On Nov 9, 2007 3:48 PM, Jeffrey Altman via RT <rt-comment@krbdev.mit.edu> wrote:
> Tom Yu via RT wrote:
> >>>>>> "jaltman" == Jeffrey Altman via RT <rt-comment@krbdev.mit.edu> writes:
> >
> > jaltman> +    if (ktype == -1)
> > jaltman> +        keyblock->enctype = ktype;
> >
> > Isn't this backwards if you want -1 to mean the enctype doesn't get
> > coerced?
> >
> You are correct.  I manually copied the patch backward.  The problem
> with manually pulling patches by eyeballing them from other systems.
> Corrected patch:
>
> Index: svr_principal.c
>
> ===================================================================
>
> --- svr_principal.c     (revision 20163)
>
> +++ svr_principal.c     (working copy)
>
> @@ -2156,7 +2156,8 @@
>
>       * inexact match on the enctype; this behavior will go away when
>
>       * the key storage architecture gets redesigned for 1.3.
>
>       */
>
> -    keyblock->enctype = ktype;
>
> +    if (ktype != -1)
>
> +        keyblock->enctype = ktype;
>
>      if (kvnop)
>
>          *kvnop = key_data->key_data_kvno;
>
>
> _______________________________________________
>
> krb5-bugs mailing list
> krb5-bugs@mit.edu
> https://mailman.mit.edu/mailman/listinfo/krb5-bugs
>
>