{"action":"created","issue":{"url":"https://api.github.com/repos/krb5/krb5/issues/247","labels_url":"https://api.github.com/repos/krb5/krb5/issues/247/labels{/name}","comments_url":"https://api.github.com/repos/krb5/krb5/issues/247/comments","events_url":"https://api.github.com/repos/krb5/krb5/issues/247/events","html_url":"https://github.com/krb5/krb5/pull/247","id":55566753,"number":247,"title":"Remove starttime hack in EncTicketPart decoder","user":{"login":"greghudson","id":1131421,"avatar_url":"https://avatars.githubusercontent.com/u/1131421?v=3","gravatar_id":"","url":"https://api.github.com/users/greghudson","html_url":"https://github.com/greghudson","followers_url":"https://api.github.com/users/greghudson/followers","following_url":"https://api.github.com/users/greghudson/following{/other_user}","gists_url":"https://api.github.com/users/greghudson/gists{/gist_id}","starred_url":"https://api.github.com/users/greghudson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/greghudson/subscriptions","organizations_url":"https://api.github.com/users/greghudson/orgs","repos_url":"https://api.github.com/users/greghudson/repos","events_url":"https://api.github.com/users/greghudson/events{/privacy}","received_events_url":"https://api.github.com/users/greghudson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-27T02:15:21Z","updated_at":"2015-01-29T21:54:51Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/krb5/krb5/pulls/247","html_url":"https://github.com/krb5/krb5/pull/247","diff_url":"https://github.com/krb5/krb5/pull/247.diff","patch_url":"https://github.com/krb5/krb5/pull/247.patch"},"body":"The EncTicketPart decoder sets starttime to authtime if it wasn't\r\nincluded in the ASN.1 value.  This is problematic for upcoming CAMMAC\r\nwork, as we will need to re-encode a received EncTicketPart to check\r\nthe KDC verifier.  Remove that behavior and just use opt_kerberos_time\r\nfor the starttime field.  Adjust krb5_decode_test.c to match the new\r\ndecoder behavior.\r\n\r\nSimilarly, remove the process_tgs_req() code which sets starttime in\r\nthe header ticket if it isn't set.  Add a comment explaining the\r\nunrelated code adjacent to it.\r\n\r\ncheck_tgs_times() used the ticket starttime without checking if it was\r\npresent.  Add a fallback to times->authtime, and narrow the function\r\ncontract to make the implementation more concise.\r\n\r\nThere is a similar hack in the EncKDCRepPart decoder; leave that alone\r\nfor now."},"comment":{"url":"https://api.github.com/repos/krb5/krb5/issues/comments/72112132","html_url":"https://github.com/krb5/krb5/pull/247#issuecomment-72112132","issue_url":"https://api.github.com/repos/krb5/krb5/issues/247","id":72112132,"user":{"login":"kaduk","id":1894506,"avatar_url":"https://avatars.githubusercontent.com/u/1894506?v=3","gravatar_id":"","url":"https://api.github.com/users/kaduk","html_url":"https://github.com/kaduk","followers_url":"https://api.github.com/users/kaduk/followers","following_url":"https://api.github.com/users/kaduk/following{/other_user}","gists_url":"https://api.github.com/users/kaduk/gists{/gist_id}","starred_url":"https://api.github.com/users/kaduk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaduk/subscriptions","organizations_url":"https://api.github.com/users/kaduk/orgs","repos_url":"https://api.github.com/users/kaduk/repos","events_url":"https://api.github.com/users/kaduk/events{/privacy}","received_events_url":"https://api.github.com/users/kaduk/received_events","type":"User","site_admin":false},"created_at":"2015-01-29T21:54:51Z","updated_at":"2015-01-29T21:54:51Z","body":"Perhaps the comment \"/* Depends only on request, ticket, and time. */\" in the last chunk of tgs_policy.c should be updated to match the narrowed contract of check_tgs_times().\r\nOtherwise, it looks okay."}}