sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-24 02:04:21 +03:00
Code

s4-kdc: default kvno for inter-domain trusts to zero

Browse Source 
the exact value doesn't matter, as both Samba and windows check
against the latest password, but the old default of -1 caused ASN.1
parsing errors on windows, which prevented it answering TGS requests

thanks to Hongwei Sun for finding this from a ttt trace

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Andrew Tridgell 2011-09-16 11:15:27 +10:00
parent 4577ee1f95
commit ee7cfcadc6
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
source4/kdc/db-glue.c
View File

@ -896,7 +896,15 @@ static krb5_error_code samba_kdc_trust_message2entry(krb5_context context,
goto out;
}
entry_ex->entry.kvno = -1;
entry_ex->entry.kvno = 0;
/*
we usually don't have a TRUST_AUTH_TYPE_VERSION field, as
windows doesn't create one, so we rely on the fact that both
windows and Samba don't actually check the kvno and instead
just check against the latest password blob. If we do have a
TRUST_AUTH_TYPE_VERSION field then we do use it, otherwise
we just use 0.
*/
for (i=0; i < password_blob.count; i++) {
if (password_blob.current.array[i].AuthType == TRUST_AUTH_TYPE_VERSION) {
entry_ex->entry.kvno = password_blob.current.array[i].AuthInfo.version.version;