diff options
| author | Tom Yu <tlyu@mit.edu> | 2010-10-15 21:42:25 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2010-10-15 21:42:25 +0000 |
| commit | 32be985ded03e342a307f9c321152ff46451745a (patch) | |
| tree | 02477c20689c904c83cfd5b8cd99b3e8a189116b | |
| parent | d4da5fa8b83164300b97d0d3b1a859c76335c65a (diff) | |
| download | krb5-32be985ded03e342a307f9c321152ff46451745a.zip krb5-32be985ded03e342a307f9c321152ff46451745a.tar.gz krb5-32be985ded03e342a307f9c321152ff46451745a.tar.bz2 | |
pull up r24399 from trunk
------------------------------------------------------------------------
r24399 | ghudson | 2010-09-30 23:45:43 -0400 (Thu, 30 Sep 2010) | 12 lines
ticket: 6768
subject: GSSAPI forwarded credentials must be encrypted in session key
target_version: 1.8.4
tags: pullup
When IAKERB support was added, the krb5_mk_req checksum function
gained access to the send subkey. This caused GSSAPI forwarded
credentials to be encrypted in the subkey, which violates RFC 4121
section 4.1.1 and is not accepted by Microsoft's implementation.
Temporarily null out the send subkey in the auth context so that
krb5_mk_ncred uses the session key instead.
ticket: 6768
version_fixed: 1.8.4
target_version: 1.8.4
status: resolved
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24460 dc483132-0cff-0310-8789-dd5450dbe970
| -rw-r--r-- | src/lib/gssapi/krb5/init_sec_context.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c index cbc9ed9..344c312 100644 --- a/src/lib/gssapi/krb5/init_sec_context.c +++ b/src/lib/gssapi/krb5/init_sec_context.c @@ -234,9 +234,7 @@ struct gss_checksum_data { krb5_data checksum_data; }; -#ifdef CFX_EXERCISE #include "../../krb5/krb/auth_con.h" -#endif static krb5_error_code KRB5_CALLCONV make_gss_checksum (krb5_context context, krb5_auth_context auth_context, void *cksum_data, krb5_data **out) @@ -247,6 +245,7 @@ make_gss_checksum (krb5_context context, krb5_auth_context auth_context, struct gss_checksum_data *data = cksum_data; krb5_data credmsg; unsigned int junk; + krb5_key send_subkey; data->checksum_data.data = 0; credmsg.data = 0; @@ -262,13 +261,22 @@ make_gss_checksum (krb5_context context, krb5_auth_context auth_context, assert(data->cred->name != NULL); + /* + * RFC 4121 4.1.1 specifies forwarded credentials must be encrypted in + * the session key, but krb5_fwd_tgt_creds will use the send subkey if + * it's set in the auth context. Null out the send subkey temporarily. + */ + send_subkey = auth_context->send_subkey; + auth_context->send_subkey = NULL; + code = krb5_fwd_tgt_creds(context, auth_context, 0, data->cred->name->princ, data->ctx->there->princ, data->cred->ccache, 1, &credmsg); - /* turn KRB5_AUTH_CONTEXT_DO_TIME back on */ + /* Turn KRB5_AUTH_CONTEXT_DO_TIME back on and reset the send subkey. */ krb5_auth_con_setflags(context, auth_context, con_flags); + auth_context->send_subkey = send_subkey; if (code) { /* don't fail here; just don't accept/do the delegation |