diff options
| -rw-r--r-- | src/lib/krb5/krb/walk_rtree.c | 6 | ||||
| -rwxr-xr-x | src/tests/t_crossrealm.py | 11 |
2 files changed, 17 insertions, 0 deletions
diff --git a/src/lib/krb5/krb/walk_rtree.c b/src/lib/krb5/krb/walk_rtree.c index 0566a55..f4e8e35 100644 --- a/src/lib/krb5/krb/walk_rtree.c +++ b/src/lib/krb5/krb/walk_rtree.c @@ -133,6 +133,12 @@ k5_client_realm_path(krb5_context context, const krb5_data *client, if (retval) return retval; + /* A capaths value of "." means no intermediates. */ + if (capvals != NULL && capvals[0] != NULL && *capvals[0] == '.') { + profile_free_list(capvals); + capvals = NULL; + } + /* Count capaths (if any) and allocate space. Leave room for the client * realm, server realm, and terminator. */ for (i = 0; capvals != NULL && capvals[i] != NULL; i++); diff --git a/src/tests/t_crossrealm.py b/src/tests/t_crossrealm.py index 0d967b8..cd4facf 100755 --- a/src/tests/t_crossrealm.py +++ b/src/tests/t_crossrealm.py @@ -78,6 +78,17 @@ r1, r2, r3, r4 = cross_realms(4, xtgts=((0,1), (1,2), (2,3)), test_kvno(r1, r4.host_princ, 'KDC capaths') stop(r1, r2, r3, r4) +# A capaths value of '.' should enforce direct cross-realm, with no +# intermediate. +capaths = {'capaths': {'A.X': {'B.X': '.'}}} +r1, r2, r3 = cross_realms(3, xtgts=((0,1), (1,2)), + args=({'realm': 'A.X', 'krb5_conf': capaths}, + {'realm': 'X'}, {'realm': 'B.X'})) +output = r1.run([kvno, r3.host_princ], expected_code=1) +if 'Server krbtgt/B.X@A.X not found in Kerberos database' not in output: + fail('capaths ".": Expected error message not in output') +stop(r1, r2, r3) + # Test transited error. The KDC for C does not recognize B as an # intermediate realm for A->C, so it refuses to issue a service # ticket. |