oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

(check_tgs_flags): starttime of a validate ticket should be > than

Browse Source 
current time
(*): send flags to krb5_verify_ap_req and krb5_decrypt_ticket


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@6002 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Assar Westerlund
1999-04-19 14:47:33 +00:00
parent 4ba208f29a
commit 3979b0e513
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
kdc/kerberos5.c
View File

@@ -829,7 +829,7 @@ check_tgs_flags(KDC_REQ_BODY *b, EncTicketPart *tgt, EncTicketPart *et)
kdc_log(0, "Bad request to validate ticket"); kdc_log(0, "Bad request to validate ticket");
return KRB5KDC_ERR_BADOPTION; return KRB5KDC_ERR_BADOPTION;
} }
if(*tgt->starttime < kdc_time){ if(*tgt->starttime > kdc_time){
kdc_log(0, "Early request to validate ticket"); kdc_log(0, "Early request to validate ticket");
return KRB5KRB_AP_ERR_TKT_NYV; return KRB5KRB_AP_ERR_TKT_NYV;
} }
@@ -1251,6 +1251,7 @@ tgs_rep2(KDC_REQ_BODY *b,
krb5_auth_context ac = NULL; krb5_auth_context ac = NULL;
krb5_ticket *ticket = NULL; krb5_ticket *ticket = NULL;
krb5_flags ap_req_options; krb5_flags ap_req_options;
krb5_flags verify_ap_req_flags;
const char *e_text = NULL; const char *e_text = NULL;
krb5_crypto crypto; krb5_crypto crypto;
@@ -1316,11 +1317,17 @@ tgs_rep2(KDC_REQ_BODY *b,
goto out2; goto out2;
} }
if (b->kdc_options.validate)
verify_ap_req_flags = KRB5_VERIFY_AP_REQ_IGNORE_INVALID;
else
verify_ap_req_flags = 0;
ret = krb5_verify_ap_req(context, ret = krb5_verify_ap_req(context,
&ac, &ac,
&ap_req, &ap_req,
princ, princ,
&tkey->key, &tkey->key,
verify_ap_req_flags,
&ap_req_options, &ap_req_options,
&ticket); &ticket);
@@ -1434,7 +1441,7 @@ tgs_rep2(KDC_REQ_BODY *b,
ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */ ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
goto out; goto out;
} }
ret = krb5_decrypt_ticket(context, t, &tkey->key, &adtkt); ret = krb5_decrypt_ticket(context, t, &tkey->key, 0, &adtkt);
if(ret) if(ret)
goto out; goto out;