diff options
| author | Greg Hudson <ghudson@mit.edu> | 2020-08-26 11:15:11 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2020-09-07 16:30:35 -0400 |
| commit | c770dfd7e2e5ca91fc1c450f60c2f546c0c2bd61 (patch) | |
| tree | 5b02b34cd5983b29566d8d2b50dad649e5602213 /src/lib/krb5 | |
| parent | 91596ae028cf458b61c03c13dee8c0b7039b8d76 (diff) | |
| download | krb5-c770dfd7e2e5ca91fc1c450f60c2f546c0c2bd61.zip krb5-c770dfd7e2e5ca91fc1c450f60c2f546c0c2bd61.tar.gz krb5-c770dfd7e2e5ca91fc1c450f60c2f546c0c2bd61.tar.bz2 | |
Fix KRB5_GC_CACHED for S4U2Self requests
In krb5_get_credentials_for_user(), always exit after the first cache
check if KRB5_GC_CACHED is specified. Not making network requests
with this flag is more important than finding a post-realm-discovery
cached entry.
If KRB5_GC_CACHED is specified without a principal name, fail
immediately, as we cannot check the cache by certificate.
ticket: 8942 (new)
Diffstat (limited to 'src/lib/krb5')
| -rw-r--r-- | src/lib/krb5/krb/s4u_creds.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c index fe15b24..73b59ff 100644 --- a/src/lib/krb5/krb/s4u_creds.c +++ b/src/lib/krb5/krb/s4u_creds.c @@ -665,11 +665,13 @@ krb5_get_credentials_for_user(krb5_context context, krb5_flags options, /* Uncanonicalised check */ code = krb5_get_credentials(context, options | KRB5_GC_CACHED, ccache, in_creds, out_creds); - if (code != KRB5_CC_NOTFOUND && code != KRB5_CC_NOT_KTYPE) - goto cleanup; - - if ((options & KRB5_GC_CACHED) && !(options & KRB5_GC_CANONICALIZE)) + if ((code != KRB5_CC_NOTFOUND && code != KRB5_CC_NOT_KTYPE) || + (options & KRB5_GC_CACHED)) goto cleanup; + } else if (options & KRB5_GC_CACHED) { + /* Fail immediately, since we can't check the cache by certificate. */ + code = KRB5_CC_NOTFOUND; + goto cleanup; } code = s4u_identify_user(context, in_creds, subject_cert, &realm); @@ -683,8 +685,7 @@ krb5_get_credentials_for_user(krb5_context context, krb5_flags options, mcreds.client = realm; code = krb5_get_credentials(context, options | KRB5_GC_CACHED, ccache, &mcreds, out_creds); - if ((code != KRB5_CC_NOTFOUND && code != KRB5_CC_NOT_KTYPE) - || (options & KRB5_GC_CACHED)) + if (code != KRB5_CC_NOTFOUND && code != KRB5_CC_NOT_KTYPE) goto cleanup; } |