[krbdev.mit.edu #7183] SVN Commit

[Greg Hudson via RT]

Handle PKINIT DH replies with no certs

If a PKINIT Diffie-Hellman reply contains no certificates in the
SignedData object, that may be because the signer certificate was a
trust anchor as transmitted to the KDC.  Heimdal's KDC, for instance,
filters client trust anchors out of the returned set of certificates.
Match against idctx->trustedCAs and idctx->intermediateCAs to handle
this case.  This fix only works with OpenSSL 1.0 or later; when built
against OpenSSL 0.9.x, the client will still require a cert in the
reply.

Code changes suggested by nalin at redhat.com.

https://github.com/krb5/krb5/commit/db83abc7dcfe369bd4467c78eebb7028ba0c0e0d
Author: Greg Hudson <ghudson at mit.edu>
Commit: db83abc7dcfe369bd4467c78eebb7028ba0c0e0d
Branch: master
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c |    9 ++++++++-
 1 files changed, 8 insertions(+), 1 deletions(-)