Ticket History #7111: Incorrect ASN.1 tag for EncASRepPart in svn trunk

From krb5-bugs-incoming-bounces@PCH.mit.edu Thu Apr 5 09:33:57 2012
Return-Path: <krb5-bugs-incoming-bounces@PCH.mit.edu>
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90])
by krbdev.mit.edu (Postfix) with ESMTP id 045A23E642;
Thu, 5 Apr 2012 09:33:56 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id q35DXuq9023925;
Thu, 5 Apr 2012 09:33:56 -0400
Received: from mailhub-dmz-3.mit.edu (MAILHUB-DMZ-3.MIT.EDU [18.9.21.42])
by pch.mit.edu (8.13.6/8.12.8) with ESMTP id q3580Zp3009828
for <krb5-bugs-incoming@PCH.mit.edu>; Thu, 5 Apr 2012 04:00:36 -0400
Received: from dmz-mailsec-scanner-1.mit.edu (DMZ-MAILSEC-SCANNER-1.MIT.EDU
[18.9.25.12])
by mailhub-dmz-3.mit.edu (8.13.8/8.9.2) with ESMTP id q3580Sxu016944
for <krb5-bugs@mit.edu>; Thu, 5 Apr 2012 04:00:35 -0400
X-AuditID: 1209190c-b7fad6d000000920-ad-4f7d51225fe2
Authentication-Results: symauth.service.identifier; spf=pass; senderid=pass
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
by dmz-mailsec-scanner-1.mit.edu (Symantec Messaging Gateway) with SMTP
id 42.F3.02336.2215D7F4; Thu, 5 Apr 2012 04:00:35 -0400 (EDT)
Received: from int-mx11.intmail.prod.int.phx2.redhat.com
(int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24])
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q3580XOP025759
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
for <krb5-bugs@mit.edu>; Thu, 5 Apr 2012 04:00:33 -0400
Received: from stef-desktop.thewalter.lan (ovpn-116-27.ams2.redhat.com
[10.36.116.27])
by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
id q3580WHN021624
for <krb5-bugs@mit.edu>; Thu, 5 Apr 2012 04:00:32 -0400
Message-ID: <4F7D511F.30804@redhat.com>
Date: Thu, 05 Apr 2012 10:00:31 +0200
From: Stef Walter <stefw@redhat.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
rv:11.0) Gecko/20120329 Thunderbird/11.0.1
MIME-Version: 1.0
To: krb5-bugs@mit.edu
Subject: Incorrect ASN.1 tag for EncASRepPart in svn trunk
Content-Type: multipart/mixed; boundary="------------040400070209010707060501"
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrGKsWRWlGSWpSXmKPExsVysWW7jK5yYK2/wccrPBYND4+zOzB6NJ05
yhzAGMVlk5Kak1mWWqRvl8CV8X5CH1PBVsGKH4/esTcwPuXrYuTkkBAwkdg98wMziM0o4C3x
5upxdoi4mMSFe+vZuhi5OIQETjBK9E19AeVsZJLYP/0jC4TzhlFi0d5+sBZeAXWJFzvOs4LY
LAKqEqt3LGICsdkEVCTmvZsDtIKDQ1QgTOL3MQeIckGJkzOfsIDYIgKiEi//HgOzhQWsJFrW
fwAbySwQILHt3TxGiIu0JZ5fmMw+gZF/FpL2WUjKZgFtYAa6Yv08IYiwvMT2t3OYIewIiXVX
PjNiiidKnDlwkG0BI/sqRtmU3Crd3MTMnOLUZN3i5MS8vNQiXUO93MwSvdSU0k2MwNAW4pTk
2cH45qDSIUYBDkYlHl6tyTX+QqyJZcWVuYcYJTmYlER5f/nX+gvxJeWnVGYkFmfEF5XmpBYf
YlQB2vVow+oLjFIsefl5qUoivBo3gVp5UxIrq1KL8mHKpDlYlMR5VbTe+QkJpCeWpGanphak
FsFkZTg4lCR4NwYALRAsSk1PrUjLzClBSDNxcIIIrkOMEhw8QBuugxTyFhck5hZnpkMUnWJU
lBLnPQaSEABJZJTmwQ0AJaf6////X2KUlRLmZWRgYBDiAVoO9D9CHpTcXjGKA/0uzPsQZApP
Zl4J3PRXQIuZgBaf/FoNsrgkESEl1cAoGXxgrkD34YmPDL/uDUmNzr137+1pxl3RIWdKyibI
Xwy3nTNZ5Osm98J3Uf3u/kVcDPO97C4Z8lg3LlLMK9iZuLye92fuxft6kY925JzbwDTx2K1L
tQuF30YJt9StL6hY+GSnbWj1J/YJ7xo8OO5K7yzbGHreatV1dRn9+paSpjP5PzYrtp1UYinO
SDTUYi4qTgQAAeTwSEkDAAA=
X-Mailman-Approved-At: Thu, 05 Apr 2012 09:33:55 -0400
X-BeenThere: krb5-bugs-incoming@mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Sender: krb5-bugs-incoming-bounces@PCH.mit.edu
Errors-To: krb5-bugs-incoming-bounces@PCH.mit.edu

This is a multi-part message in MIME format.
--------------040400070209010707060501
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

System: Linux stef-desktop.thewalter.lan 3.3.0-8.fc17.x86_64 #1 SMP Thu
Mar 29 18:18:26 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
Architecture: x86_64


During a recent commit "Data-driven ASN.1 decoder" the ASN.1 tag for
EncASRepPart was set to 24 instead of the correct 25.

See: svn://anonsvn.mit.edu/krb5/trunk@25693


Build krb5 from svn trunk. Authentication with KDC fails.


Patch is attached.


--------------040400070209010707060501
Content-Type: text/x-patch;
name="0002-Fix-incorrect-ASN.1-tag-for-EncASRepPart.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="0002-Fix-incorrect-ASN.1-tag-for-EncASRepPart.patch"

From: Stef Walter <stefw@gnome.org>
Date: Thu, 5 Apr 2012 09:15:08 +0200
Subject: [PATCH 2/2] Fix incorrect ASN.1 tag for EncASRepPart

---
src/lib/krb5/asn.1/asn1_k_encode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
index 467e2de..d8a2a87 100644
--- a/src/lib/krb5/asn.1/asn1_k_encode.c
+++ b/src/lib/krb5/asn.1/asn1_k_encode.c
@@ -723,7 +723,7 @@ static const struct atype_info *enc_tkt_part_fields[] = {
DEFSEQTYPE(untagged_enc_tkt_part, krb5_enc_tkt_part, enc_tkt_part_fields);
DEFAPPTAGGEDTYPE(enc_tkt_part, 3, untagged_enc_tkt_part);

-DEFAPPTAGGEDTYPE(enc_as_rep_part, 24, enc_kdc_rep_part);
+DEFAPPTAGGEDTYPE(enc_as_rep_part, 25, enc_kdc_rep_part);
DEFAPPTAGGEDTYPE(enc_tgs_rep_part, 26, enc_kdc_rep_part);

DEFCTAGGEDTYPE(kdc_rep_0, 0, krb5_version);
--
1.7.9.3


--------------040400070209010707060501--

Fix app tag choices for decoding EncASRepPart

When decoding an AS-REP enc part, we should accept app tags 26 (the
bogus one we generate) and 25 (the correct value). We were accepting
26 and 24. Bug report and fix by stefw@gnome.org.

https://github.com/krb5/krb5/commit/db9da51673393125d96f9d83b8d236861ba2fae9
Commit By: ghudson
Revision: 25802
Changed Files:
U trunk/src/lib/krb5/asn.1/asn1_k_encode.c