Files
heimdal/lib/krb5
Jeffrey Altman 68dbf1ba10 krb5: fcc_next_cred do not return removed creds
commit a9bd3c6e50 ("Fix racy file ccache
corruption in cred_delete()") implemented krb5_cc_remove_cred() for
"FILE" ccaches by overwriting the removed credential endtime value
with zero (Unix Epoch).  However, it did not modify fcc_get_next()
to filter out these deleted entries.  As a result, invalid credentials
can be returned from the FILE ccache where endtime < starttime.
RFC4120 requires endtime >= starttime for all tickets.

MIT Kerberos since d3b39a8bac6206b5ea78b0bf6a2958c1df0b0dd5
("Implement krb5_cc_remove_cred for remaining types") modifies a
removed cred by setting

  endtime = 0
  authtime = -1

and then filters out removed creds from the fcc_next_cred() results.

In 2013 Heimdal broke interop with MIT processes that share the
FILE ccache by implementing remove by setting "endtime = 0" and
now MIT has broken interop with the Heimdal implementation of
fcc_remove_cred() by checking for both "endtime = 0" and "authtime = -1".

This change filters results from fcc_get_next() when the "endtime == 0"
which is acceptable because a KDC is not permitted to return a
ticket with an endtime == 0.
2024-09-03 14:19:20 -04:00
..
2024-06-16 23:30:48 -04:00
2022-01-14 17:10:16 -06:00
2024-06-16 23:30:48 -04:00
2022-11-01 16:10:57 -05:00
2011-05-21 11:57:31 -07:00
2021-09-19 13:25:27 +10:00
2023-11-28 21:34:35 -05:00
2024-06-16 23:30:48 -04:00
2022-09-22 22:13:05 -04:00
2018-09-10 14:42:18 -04:00
2023-11-28 21:37:56 -05:00
2017-04-29 01:05:59 -04:00
2024-06-16 23:30:48 -04:00
2023-11-28 21:34:35 -05:00
2016-04-16 16:58:08 -05:00
2024-06-16 23:30:48 -04:00
2012-01-10 22:54:50 +01:00
2022-01-14 17:10:16 -06:00
2024-06-16 23:30:48 -04:00
2024-06-16 23:30:48 -04:00
2024-06-16 23:30:48 -04:00
2021-03-26 18:47:49 -05:00
2011-07-24 16:02:22 -07:00
2014-04-25 02:42:17 +02:00
2011-05-21 11:57:31 -07:00
2014-04-25 02:42:17 +02:00
2011-05-21 11:57:31 -07:00
2011-05-21 11:57:31 -07:00
2011-05-21 11:57:31 -07:00
2005-10-08 15:39:42 +00:00
2007-07-15 20:49:46 +00:00
2022-01-19 23:38:27 -06:00
2024-09-03 13:35:38 -04:00
2022-01-24 15:38:47 -06:00
2023-11-02 20:19:54 -05:00
2022-09-22 22:13:05 -04:00
2014-03-24 23:07:49 -05:00
2022-01-14 17:10:16 -06:00
2011-05-21 11:57:31 -07:00
2022-09-22 22:13:05 -04:00
2023-11-28 21:34:35 -05:00
2023-06-20 12:19:48 -05:00
2022-11-22 11:34:54 -05:00
2023-11-28 21:34:35 -05:00
2023-06-20 12:19:48 -05:00
2023-05-26 14:10:11 -05:00
2016-11-20 17:43:51 -06:00
2022-01-19 23:38:27 -06:00
2022-11-01 16:10:57 -05:00
2024-06-16 23:30:48 -04:00
2023-01-04 16:17:09 -06:00
2023-01-04 16:17:09 -06:00
2023-01-04 16:17:09 -06:00
2012-05-28 13:14:55 +01:00
2011-05-21 11:57:31 -07:00
2024-06-16 23:30:48 -04:00
2019-01-02 13:56:04 -05:00
2010-09-18 14:45:33 -07:00
2022-01-19 23:38:27 -06:00
2022-01-18 15:40:54 -06:00
2022-02-11 16:02:27 -06:00
2011-05-21 11:57:31 -07:00
2009-05-04 06:17:40 +00:00
2014-04-29 11:04:21 -06:00
2009-05-04 06:17:40 +00:00
2021-11-29 12:50:26 +11:00
2022-01-14 17:10:16 -06:00
2011-05-21 11:57:31 -07:00
2009-05-04 06:17:40 +00:00
2009-05-04 06:17:40 +00:00
2009-05-04 06:17:40 +00:00
2009-05-04 06:17:40 +00:00
2022-01-19 23:38:27 -06:00
2022-01-14 17:59:49 -06:00
2011-05-21 11:57:31 -07:00
2021-08-09 21:46:24 +10:00
2022-01-14 17:10:16 -06:00