Fix KDC to drop repeated in-progress requests

When a KDC receives a repeated request while the original request is
still in progress, it is supposed to be to drop the request.  Commit
f07760088b72a11c54dd72efbc5739f231a4d4b0 introduced a bug in this
logic, causing the KDC to instead send an empty reply.  In
kdc_check_lookaside(), return a NULL reply_packet for empty entries,
restoring the expected behavior.

[ghudson@mit.edu: edited commit message, added a comment]

ticket: 8477 (new)
target_version: 1.14-next
target_version: 1.13-next
tags: pullup

diff --git a/src/kdc/replay.c b/src/kdc/replay.c
index 76fd772b03e7238c4dc5fb7ec2d87de7bc95b8bb..2d93498d7a9c74f44d550b6690aebdf3cb81d055 100644 (file)
--- a/src/kdc/replay.c
+++ b/src/kdc/replay.c
@@ -177,6 +177,11 @@ kdc_check_lookaside(krb5_context kcontext, krb5_data *req_packet,
 
     e->num_hits++;
     hits++;
+
+    /* Leave *reply_packet_out as NULL for an in-progress entry. */
+    if (e->reply_packet.length == 0)
+        return TRUE;
+
     return (krb5_copy_data(kcontext, &e->reply_packet,
                            reply_packet_out) == 0);
 }