oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: Don't keep trying keys for encrypted-challenge if one decrypts but fails to verify

Browse Source 
This also enables a KRB5KRB_AP_ERR_SKEW error to be returned to the
client.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
This commit is contained in:
Joseph Sutton
2021-11-16 20:22:03 +13:00
committed by Luke Howard
parent 0ea840ebfc
commit 54129c319c
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
kdc/kerberos5.c
View File

@@ -637,7 +637,12 @@ pa_enc_chal_validate(astgs_request_t r, const PA_DATA *pa)
krb5_error_code ret2;
char *str = NULL;
krb5_crypto_destroy(r->context, longtermcrypto);
invalidPassword = (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY);
if (!invalidPassword) {
goto out;
}
ret2 = krb5_enctype_to_string(r->context, k->key.keytype, &str);
if (ret2)
@@ -648,7 +653,6 @@ pa_enc_chal_validate(astgs_request_t r, const PA_DATA *pa)
krb5_free_error_message(r->context, msg);
free(str);
krb5_crypto_destroy(r->context, longtermcrypto);
continue;
}