Fix in_clock_skew() and use it in AS client code

Add a context parameter to the in_clock_skew() macro so that it isn't
implicitly relying on a local variable.  Use it in
get_in_tkt.c:verify_as_reply().

diff --git a/src/lib/krb5/krb/gc_via_tkt.c b/src/lib/krb5/krb/gc_via_tkt.c
index 4c0a1a46120abc45d998337a6dc532db8f3b250f..c85d8b8d84715a4c5976a4092806968c5c938bd5 100644 (file)
--- a/src/lib/krb5/krb/gc_via_tkt.c
+++ b/src/lib/krb5/krb/gc_via_tkt.c
@@ -305,7 +305,7 @@ krb5int_process_tgs_reply(krb5_context context,
         goto cleanup;
 
     if (!in_cred->times.starttime &&
-        !in_clock_skew(dec_rep->enc_part2->times.starttime,
+        !in_clock_skew(context, dec_rep->enc_part2->times.starttime,
                        timestamp)) {
         retval = KRB5_KDCREP_SKEW;
         goto cleanup;

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index dfc7fa8a25db553024be26ba599765c4cda516fc..2ad0bd6ce7923abbf7419fe8aca7b5eab8267d88 100644 (file)
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -287,8 +287,8 @@ verify_as_reply(krb5_context            context,
             return retval;
     } else {
         if ((request->from == 0) &&
-            (labs(as_reply->enc_part2->times.starttime - time_now)
-             > context->clockskew))
+            !in_clock_skew(context, as_reply->enc_part2->times.starttime,
+                           time_now))
             return (KRB5_KDCREP_SKEW);
     }
     return 0;

diff --git a/src/lib/krb5/krb/int-proto.h b/src/lib/krb5/krb/int-proto.h
index 57411a91c3c0e2ccdb250ef10077ff222c213c8b..82fa03dee3a44b7349f5cb7aaa866b24066df79b 100644 (file)
--- a/src/lib/krb5/krb/int-proto.h
+++ b/src/lib/krb5/krb/int-proto.h
@@ -83,7 +83,8 @@ krb5int_construct_matching_creds(krb5_context context, krb5_flags options,
                                  krb5_creds *in_creds, krb5_creds *mcreds,
                                  krb5_flags *fields);
 
-#define in_clock_skew(date, now) (labs((date)-(now)) < context->clockskew)
+#define in_clock_skew(context, date, now)               \
+    (labs((date) - (now)) < (context)->clockskew)
 
 #define IS_TGS_PRINC(p) ((p)->length == 2 &&                            \
                          data_eq_string((p)->data[0], KRB5_TGS_NAME))