Ticket History #6277: KLCacheHasValidTickets changed behavior

# Thu Dec 04 09:52:47 2008 tsitkova (Zhanna Tsitkova) - Ticket created

Subject:

KLCacheHasValidTickets changed behavior

Download (untitled) / with headers
text/plain 152B

Didn't set validTickets flag on expired ticket.

Vendor's priority - Serious Bug
Vendor's patch - LHA-6361873-KLCacheHasValidTickets-default-to-expired

# Thu Dec 04 09:52:47 2008 tsitkova (Zhanna Tsitkova) - Ticket 6277 MemberOf ticket 6204.

# Thu Dec 04 13:22:59 2008 tsitkova (Zhanna Tsitkova) - Comments added

Download (untitled) / with headers
text/plain 19B

Including the patch

Download LHA-6361873-KLCacheHasValidTickets-default-to-expired.patch
text/plain 966B

diff -Nur -x '*~' -x '*.orig' -x '*.rej' -x '*.pbxbtree' -x '*.pbxindex' -x lha.mode1v3 -x lha.mode2v3 -x lha.pbxuser -x windows -x .DS_Store Kerberos.AEP-6.5fc1.orig/KerberosFramework/Kerberos5/Sources/kim/lib/kim_ccache.c Kerberos.AEP-6.5fc1/KerberosFramework/Kerberos5/Sources/kim/lib/kim_ccache.c
--- Kerberos.AEP-6.5fc1.orig/KerberosFramework/Kerberos5/Sources/kim/lib/kim_ccache.c 2008-11-07 11:24:45.000000000 -0800
+++ Kerberos.AEP-6.5fc1/KerberosFramework/Kerberos5/Sources/kim/lib/kim_ccache.c 2008-11-11 13:56:53.000000000 -0800
@@ -721,7 +721,7 @@
kim_boolean out_of_credentials = FALSE;
kim_boolean found_valid_tgt = FALSE;
kim_boolean dominant_is_tgt = FALSE;
- kim_credential_state dominant_state = kim_credentials_state_valid;
+ kim_credential_state dominant_state = kim_credentials_state_expired;
kim_credential dominant_credential = NULL;

if (!err && !in_ccache) { err = check_error (KIM_NULL_PARAMETER_ERR); }

# Thu Dec 04 15:02:01 2008 tsitkova (Zhanna Tsitkova) - Comments added

RT-Send-CC:

lha@apple.com

Download (untitled) / with headers
text/plain 15B

updated CC list

# Thu Dec 04 15:12:19 2008 tsitkova (Zhanna Tsitkova) - Cc lha (Love Hornquist Astrand) added

# Fri Dec 05 13:09:51 2008 tsitkova (Zhanna Tsitkova) - Given to lxs (Alexandra Ellwood)

# Tue Dec 16 13:51:40 2008 lxs (Alexandra Ellwood) - Comments added

Download (untitled) / with headers
text/plain 864B

I'm concerned that this patch does not fix the underlying problem with this function. The patch
changes the default return value from valid to expired. However the code below is *supposed*
to catch all non-valid ticket conditions. I'm not disputing that there is a real bug here, but
changing the default return value is probably just masking the real bug where one of the non-
valid ticket conditions is not being detected by the logic.

In particular using this method of fixing the bug may mean that KIM returns that tickets are
expired when they are invalid for some other reason (need validation/not yet valid).

Would it be possible to get a description of the state of the ccache when KLCacheHasValidTickets returned that tickets were valid even though they weren't? I looked for
a regression test flagged with this bug number and didn't see one.

# Wed Sep 09 19:27:25 2015 tlyu (Taylor Yu) - Status changed from 'new' to 'resolved'

# Wed Sep 09 19:27:25 2015 tlyu (Taylor Yu) - Tags noresource added