Subject: Re: [krbdev.mit.edu #2234] kdc_util.c bug - validate_tgs_request clears all kdc_options
From: Wyllys Ingersoll <wyllys.ingersoll@sun.com>
Reply-To: wyllys.ingersoll@sun.com
To: rt-comment@krbdev.mit.edu
Cc: krb5-prs@mit.edu
In-Reply-To: <rt-2234-9842.6.52929477840146@krbdev.mit.edu>
References: <rt-2234-9842.6.52929477840146@krbdev.mit.edu>
Content-Type: text/plain
Message-Id: <1076612644.7268.50.camel@pebblebeach.wki.test.net>
MIME-Version: 1.0
Date: Thu, 12 Feb 2004 14:04:04 -0500
Content-Transfer-Encoding: 7bit
RT-Send-Cc: 
Content-Length: 859

On Thu, 2004-02-12 at 13:30, ""Jeffrey Altman [Kermit Project]" via RT"
wrote:
> Wyllys Ingersoll via RT wrote:
> 
> >The new code in kdc_util.c
> >
> >    request->kdc_options &= ~(TGS_OPTIONS_HANDLED);
> >
> >Actually causes clears the kdc_options field of all
> >handled options, which (in most cases) zeros the field.
> >This is probably not intended...  
> >
> >To properly disable unrecognized flags, I think you need
> >to do something like this:
> >
> >badflags = (request->kdc_options & ~(TGS_OPTIONS_HANDLED));
> >request->kdc_options &= ~badflags;
> >
> >-Wyllys
> >
> >
> Shouldn't this simply be?
> 
>    request->kdc_options &= TGS_OPTIONS_HANDLED;

er, yup.  That'll work too,  I was thinking in reverse :)

Though, the original suggestion might be OK if you wanted
to log a message to indicate what unsupported flags were received.

-Wyllys