pull up r20413 from trunk

 r20413@cathode-dark-space:  jaltman | 2008-06-18 15:36:49 -0400
 ticket: 5924
 tags: pullup

 This patch is derived from a patch originally submitted to RT
 by: Nik Conwell <nik@bu.edu>

 krb5_set_real_time() accepts as input the time of the KDC
 or an application server as a combination of seconds and
 microseconds.  Often it is the case that the time source
 does not provide the real time with less than one second
 granularity.  Up until this patch such a caller would fill
 in the microseconds parameter as zero.   krb5_set_real_time()
 would treat the zero microseconds as the actual reported
 time and compute a microsecond based offset.

 During a one second window subsequent calls to
 krb5_set_real_time() would have an ever increasing offset
 size until the number of seconds is incremented.  This
 in turn produces a side effect in which the microseconds
 value of the local clock is effectively erased.

 If there are multiple processes or threads on the same
 machine each requesting service tickets using the same
 client principal for the same service principal where
 the number of seconds reported by the KDC are equivalent,
 then they will now all create authenticators with
 exactly the same timestamp.  As a result, the authenticating
 service will detect a replay attack even though the
 authenticators are actually unique.  The replay cache
 only maintains a tuple of client, server and timestamp.

 This patch modifies the interpretation of the microseconds
 parameter.  If -1 is specified, the microseconds offset is
 ignored.

ticket: 5924
version_fixed: 1.6.4

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@20519 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index ee0a1127e7568ac280a4cff5c1a3ea8737fc3343..a4bd64f26f5efc8734e2d668c725cea037daabf8 100644 (file)
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -290,7 +290,7 @@ verify_as_reply(krb5_context                context,
 
     if (context->library_options & KRB5_LIBOPT_SYNC_KDCTIME) {
        retval = krb5_set_real_time(context,
-                                   as_reply->enc_part2->times.authtime, 0);
+                                   as_reply->enc_part2->times.authtime, -1);
        if (retval)
            return retval;
     } else {

diff --git a/src/lib/krb5/os/toffset.c b/src/lib/krb5/os/toffset.c
index 967b9d62be2aa2012fa72879eb0413d2b9795107..a54a7886487fc02549fa7e705b3068d2dff3cf7d 100644 (file)
--- a/src/lib/krb5/os/toffset.c
+++ b/src/lib/krb5/os/toffset.c
@@ -34,6 +34,9 @@
  * routines will return the correct time as corrected by difference
  * between the system time and the "real time" as passed to this
  * routine
+ *
+ * If the real time microseconds are given as -1 the caller doesn't
+ * know the microseconds value so the usec offset is always zero.
  */
 krb5_error_code KRB5_CALLCONV
 krb5_set_real_time(krb5_context context, krb5_timestamp seconds, krb5_int32 microseconds)
@@ -45,8 +48,10 @@ krb5_set_real_time(krb5_context context, krb5_timestamp seconds, krb5_int32 micr
     retval = krb5_crypto_us_timeofday(&sec, &usec);
     if (retval)
            return retval;
+
     os_ctx->time_offset = seconds - sec;
-    os_ctx->usec_offset = microseconds - usec;
+    os_ctx->usec_offset = (microseconds > -1) ? microseconds - usec : 0;
+
     os_ctx->os_flags = ((os_ctx->os_flags & ~KRB5_OS_TOFFSET_TIME) |
                        KRB5_OS_TOFFSET_VALID);
     return 0;