Re: [krbdev.mit.edu #8579] AutoReply: duplicate caching of some cross-realm TGTs
>From deae811366b0e0a41c57ae5ec8662a3eac938a2f Mon Sep 17 00:00:00 2001
From: "Richard E. Silverman" <[hidden email]>
Date: Tue, 18 Apr 2017 22:20:50 -0400
Subject: [PATCH] Fix repeated caching of certain credentials.
Under certain circumstances, we would get duplicate caching of cross-realm
tickets. krb5_cc_store_cred() had two problems:
1) It avoided duplicate caching the second time it (potentially) stored a
credential, but not the first time (which is where this was happening).
2) The method it used to avoid duplicates was flawed anyway. It called
krb5_cc_remove_cred() before storing, to first remove any matching
credentials. This seems like an odd approach to begin with... but
worse: krb5_cc_remove_cred() is actually no-op for the file ccache
type! (see cc_file.c:fcc_remove_cred()).
Fix this by storing the credential only if there is no matching one
already in the ccache.
I'm not at all sure that this is the right approach, as there are a number
of questions: Was the omission of the first duplicate check intentional?
Was there some reason for using the remove-then-add approach? Some other
cross-realm TGTs aren't cached at all, and we don't get such duplicate
under other circumstances -- so is the duplicate checking supposed to
happen elsewhere? Etc.
src/lib/krb5/ccache/ccfns.c | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)