[krbdev.mit.edu #8988] git commit
"Greg Hudson via RT" <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
Mon Mar 08 18:52:07 2021: Request 8988 was acted upon. Transaction: Ticket created by [email protected] Queue: krb5 Subject: git commit Owner: [email protected] Requestors: Status: new Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8988 > Only require one valid pkinit anchor/pool value When processing pkinit_anchor or pkinit_pool values, return successfully if at least one value is successfully loaded (or if none are configured). pkinit_identity_prompt() was the backstop against trying anonymous PKINIT without configured anchors. After this change it no longer is, so add an explicit check for no anchors in pkinit_client_process(). [[email protected]: added code to clear ignored errors; made minor style edits; added no-anchors check] https://github.com/krb5/krb5/commit/414cf4152c9743ca3aaef4cf9fb13628ec5f7896 Author: Ken Hornstein <[email protected]> Committer: Greg Hudson <[email protected]> Commit: 414cf4152c9743ca3aaef4cf9fb13628ec5f7896 Branch: master src/plugins/preauth/pkinit/pkinit_clnt.c | 5 +++++ src/plugins/preauth/pkinit/pkinit_identity.c | 25 ++++++++++++++++++++----- 2 files changed, 25 insertions(+), 5 deletions(-)