diff options
| author | Luke Howard <lukeh@padl.com> | 2009-08-07 22:50:57 +0000 |
|---|---|---|
| committer | Luke Howard <lukeh@padl.com> | 2009-08-07 22:50:57 +0000 |
| commit | 644071305d97e40bc07c60132d1c9d4cf1b39672 (patch) | |
| tree | 02a230cc46da20331f6ecbd161d26fd10cbd411e | |
| parent | 84a7732997c4ce0bed6d82d58e7501b0371513b1 (diff) | |
| download | krb5-644071305d97e40bc07c60132d1c9d4cf1b39672.zip krb5-644071305d97e40bc07c60132d1c9d4cf1b39672.tar.gz krb5-644071305d97e40bc07c60132d1c9d4cf1b39672.tar.bz2 | |
only return S4U enc_padata if KRB5_S4U_OPTS_USE_REPLY_KEY_USAGE is set in the request
git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/s4u@22505 dc483132-0cff-0310-8789-dd5450dbe970
| -rw-r--r-- | src/kdc/kdc_util.c | 3 | ||||
| -rw-r--r-- | src/lib/krb5/krb/s4u_creds.c | 22 |
2 files changed, 19 insertions, 6 deletions
diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c index 88196ad..39b8f56 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c @@ -1959,7 +1959,8 @@ kdc_process_s4u2self_rep(krb5_context context, else enctype = tgs_session->enctype; - if (!enctype_requires_etype_info_2(enctype)) { + if ((req_s4u_user->user_id.options & KRB5_S4U_OPTS_USE_REPLY_KEY_USAGE) && + enctype_requires_etype_info_2(enctype) == FALSE) { padata.length = req_s4u_user->cksum.length + rep_s4u_user.cksum.length; padata.contents = (krb5_octet *)malloc(padata.length); if (padata.contents == NULL) { diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c index 1d0e532..ad9bfe3 100644 --- a/src/lib/krb5/krb/s4u_creds.c +++ b/src/lib/krb5/krb/s4u_creds.c @@ -401,6 +401,12 @@ verify_s4u2self_reply(krb5_context context, else usage = KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST; + if (!not_newer && + !krb5_c_is_keyed_cksum(rep_s4u_user->cksum.checksum_type)) { + code = KRB5KRB_AP_ERR_INAPP_CKSUM; + goto cleanup; + } + code = krb5_c_verify_checksum(context, subkey, usage, datap, &rep_s4u_user->cksum, &valid); if (code != 0) @@ -410,7 +416,17 @@ verify_s4u2self_reply(krb5_context context, goto cleanup; } - if (enc_s4u_padata != NULL) { + /* + * KDCs that support KRB5_S4U_OPTS_USE_REPLY_KEY_USAGE also return + * S4U enc_padata for older (pre-AES) encryption types only. + */ + if (not_newer && + (rep_s4u_user->user_id.options & KRB5_S4U_OPTS_USE_REPLY_KEY_USAGE)) { + if (enc_s4u_padata == NULL) { + code = KRB5_KDCREP_MODIFIED; + goto cleanup; + } + /* * According to the terribly written specification, the value of * the padata here is the concatenated checksums. Presumably @@ -427,10 +443,6 @@ verify_s4u2self_reply(krb5_context context, code = KRB5_KDCREP_MODIFIED; goto cleanup; } - } else if (not_newer == FALSE && /* XXX this should be removed */ - !krb5_c_is_keyed_cksum(rep_s4u_user->cksum.checksum_type)) { - code = KRB5KRB_AP_ERR_INAPP_CKSUM; - goto cleanup; } cleanup: |