svn rev #23676: trunk/src/ include/ kadmin/dbutil/ lib/kadm5/srv/ lib/kdb/
ghudson@MIT.EDU
ghudson at MIT.EDU
Thu Jan 28 16:39:31 EST 2010
http://src.mit.edu/fisheye/changelog/krb5/?cs=23676
Commit By: ghudson
Log Message:
ticket: 6650
subject: Handle migration from pre-1.7 databases with master key kvno != 1
target_version: 1.7.1
tags: pullup
krb5_dbe_lookup_mkvno assumes an mkvno of 1 for entries with no
explicit tl_data. We've seen at least one pre-1.7 KDB with a master
kvno of 0, violating this assumption. Fix this as follows:
* krb5_dbe_lookup_mkvno outputs 0 instead of 1 if no tl_data exists.
* A new function krb5_dbe_get_mkvno translates this 0 value to the
minimum version number in the mkey_list. (krb5_dbe_lookup_mkvno
cannot do this as it doesn't take the mkey_list as a parameter.)
* Call sites to krb5_dbe_lookup_mkvno are converted to
krb5_dbe_get_mkvno, except for an LDAP case where it is acceptable
to store 0 if the mkvno is unknown.
Changed Files:
U trunk/src/include/kdb.h
U trunk/src/kadmin/dbutil/kdb5_mkey.c
U trunk/src/lib/kadm5/srv/svr_principal.c
U trunk/src/lib/kdb/kdb5.c
U trunk/src/lib/kdb/libkdb5.exports
Modified: trunk/src/include/kdb.h
===================================================================
--- trunk/src/include/kdb.h 2010-01-27 22:17:12 UTC (rev 23675)
+++ trunk/src/include/kdb.h 2010-01-28 21:39:31 UTC (rev 23676)
@@ -556,12 +556,20 @@
krb5_db_entry * entry,
krb5_keyblock ** mkey);
+/* Set *mkvno to mkvno in entry tl_data, or 0 if not present. */
krb5_error_code
krb5_dbe_lookup_mkvno( krb5_context context,
krb5_db_entry * entry,
krb5_kvno * mkvno);
+/* Set *mkvno to mkvno in entry tl_data, or minimum value from mkey_list. */
krb5_error_code
+krb5_dbe_get_mkvno( krb5_context context,
+ krb5_db_entry * entry,
+ krb5_keylist_node * mkey_list,
+ krb5_kvno * mkvno);
+
+krb5_error_code
krb5_dbe_lookup_mod_princ_data( krb5_context context,
krb5_db_entry * entry,
krb5_timestamp * mod_time,
Modified: trunk/src/kadmin/dbutil/kdb5_mkey.c
===================================================================
--- trunk/src/kadmin/dbutil/kdb5_mkey.c 2010-01-27 22:17:12 UTC (rev 23675)
+++ trunk/src/kadmin/dbutil/kdb5_mkey.c 2010-01-28 21:39:31 UTC (rev 23676)
@@ -866,7 +866,7 @@
goto skip;
}
p->re_match_count++;
- retval = krb5_dbe_lookup_mkvno(util_context, ent, &old_mkvno);
+ retval = krb5_dbe_get_mkvno(util_context, ent, master_keylist, &old_mkvno);
if (retval) {
com_err(progname, retval,
"determining master key used for principal '%s'",
@@ -1137,7 +1137,7 @@
args = (struct purge_args *) ptr;
- retval = krb5_dbe_lookup_mkvno(args->kcontext, entry, &mkvno);
+ retval = krb5_dbe_get_mkvno(args->kcontext, entry, master_keylist, &mkvno);
if (retval)
return (retval);
@@ -1193,6 +1193,12 @@
}
}
+ if (master_keylist == NULL) {
+ com_err(progname, retval, "master keylist not initialized");
+ exit_status++;
+ return;
+ }
+
/* assemble & parse the master key name */
if ((retval = krb5_db_setup_mkey_name(util_context,
global_params.mkey_name,
Modified: trunk/src/lib/kadm5/srv/svr_principal.c
===================================================================
--- trunk/src/lib/kadm5/srv/svr_principal.c 2010-01-27 22:17:12 UTC (rev 23675)
+++ trunk/src/lib/kadm5/srv/svr_principal.c 2010-01-28 21:39:31 UTC (rev 23676)
@@ -874,7 +874,8 @@
if (kdb.key_data[i].key_data_kvno > entry->kvno)
entry->kvno = kdb.key_data[i].key_data_kvno;
- ret = krb5_dbe_lookup_mkvno(handle->context, &kdb, &entry->mkvno);
+ ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist,
+ &entry->mkvno);
if (ret)
goto done;
Modified: trunk/src/lib/kdb/kdb5.c
===================================================================
--- trunk/src/lib/kdb/kdb5.c 2010-01-27 22:17:12 UTC (rev 23675)
+++ trunk/src/lib/kdb/kdb5.c 2010-01-28 21:39:31 UTC (rev 23676)
@@ -1591,7 +1591,7 @@
krb5_error_code retval;
krb5_keylist_node *cur_keyblock = mkey_list;
- retval = krb5_dbe_lookup_mkvno(context, entry, &mkvno);
+ retval = krb5_dbe_get_mkvno(context, entry, mkey_list, &mkvno);
if (retval)
return (retval);
@@ -1852,7 +1852,7 @@
return (code);
if (tl_data.tl_data_length == 0) {
- *mkvno = 1; /* default for princs that lack the KRB5_TL_MKVNO data */
+ *mkvno = 0; /* Indicates KRB5_TL_MKVNO data not present */
return (0);
} else if (tl_data.tl_data_length != 2) {
return (KRB5_KDB_TRUNCATED_RECORD);
@@ -1864,6 +1864,38 @@
}
krb5_error_code
+krb5_dbe_get_mkvno(krb5_context context,
+ krb5_db_entry * entry,
+ krb5_keylist_node * mkey_list,
+ krb5_kvno * mkvno)
+{
+ krb5_error_code code;
+ krb5_kvno kvno;
+
+ if (mkey_list == NULL)
+ return EINVAL;
+
+ /* Output the value from entry tl_data if present. */
+ code = krb5_dbe_lookup_mkvno(context, entry, &kvno);
+ if (code != 0)
+ return code;
+ if (kvno != 0) {
+ *mkvno = kvno;
+ return 0;
+ }
+
+ /* Determine the minimum kvno in mkey_list and output that. */
+ kvno = (krb5_kvno) -1;
+ while (mkey_list != NULL) {
+ if (mkey_list->kvno < kvno)
+ kvno = mkey_list->kvno;
+ mkey_list = mkey_list->next;
+ }
+ *mkvno = kvno;
+ return 0;
+}
+
+krb5_error_code
krb5_dbe_update_mkvno(krb5_context context,
krb5_db_entry * entry,
krb5_kvno mkvno)
Modified: trunk/src/lib/kdb/libkdb5.exports
===================================================================
--- trunk/src/lib/kdb/libkdb5.exports 2010-01-27 22:17:12 UTC (rev 23675)
+++ trunk/src/lib/kdb/libkdb5.exports 2010-01-28 21:39:31 UTC (rev 23676)
@@ -43,6 +43,7 @@
krb5_dbe_free_key_data_contents
krb5_dbe_free_mkey_aux_list
krb5_dbe_free_key_list
+krb5_dbe_get_mkvno
krb5_dbe_lookup_last_pwd_change
krb5_dbe_lookup_actkvno
krb5_dbe_lookup_mkey_aux
More information about the cvs-krb5
mailing list