oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: let check_PAC() to verify the incoming server and krbtgt cheksums

Browse Source 
For a normal TGS-REQ they're both signed with krbtgt key.
But for S4U2Proxy requests which ask for contrained delegation,
the keys differ.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
This commit is contained in:
Stefan Metzmacher
2011-03-25 14:57:42 +01:00
committed by Love Hörnquist Åstrand
parent b8ddbe73c4
commit 2c031ca78c
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
kdc/krb5tgs.c
View File

@@ -282,8 +282,9 @@ check_PAC(krb5_context context,
hdb_entry_ex *client, hdb_entry_ex *client,
hdb_entry_ex *server, hdb_entry_ex *server,
hdb_entry_ex *krbtgt, hdb_entry_ex *krbtgt,
const EncryptionKey *server_key, const EncryptionKey *server_check_key,
const EncryptionKey *krbtgt_check_key, const EncryptionKey *krbtgt_check_key,
const EncryptionKey *server_sign_key,
const EncryptionKey *krbtgt_sign_key, const EncryptionKey *krbtgt_sign_key,
EncTicketPart *tkt, EncTicketPart *tkt,
krb5_data *rspac, krb5_data *rspac,
@@ -328,7 +329,7 @@ check_PAC(krb5_context context,
ret = krb5_pac_verify(context, pac, tkt->authtime, ret = krb5_pac_verify(context, pac, tkt->authtime,
client_principal, client_principal,
krbtgt_check_key, NULL); server_check_key, krbtgt_check_key);
if (ret) { if (ret) {
krb5_pac_free(context, pac); krb5_pac_free(context, pac);
return ret; return ret;
@@ -351,7 +352,7 @@ check_PAC(krb5_context context,
*signedpath = 1; *signedpath = 1;
ret = _krb5_pac_sign(context, pac, tkt->authtime, ret = _krb5_pac_sign(context, pac, tkt->authtime,
client_principal, client_principal,
server_key, krbtgt_sign_key, rspac); server_sign_key, krbtgt_sign_key, rspac);
} }
krb5_pac_free(context, pac); krb5_pac_free(context, pac);
@@ -1792,7 +1793,9 @@ server_lookup:
} }
ret = check_PAC(context, config, cp, ret = check_PAC(context, config, cp,
client, server, krbtgt, ekey, &tkey_check->key, &tkey_sign->key, client, server, krbtgt,
&tkey_check->key, &tkey_check->key,
ekey, &tkey_sign->key,
tgt, &rspac, &signedpath); tgt, &rspac, &signedpath);
if (ret) { if (ret) {
const char *msg = krb5_get_error_message(context, ret); const char *msg = krb5_get_error_message(context, ret);