oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

verify_mic_des3: If MIC verification fails, retry using the `old' MIC

Browse Source 
computation (with zero IV).


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@12168 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Jacques A. Vidrine
2003-04-28 15:19:12 +00:00
parent 605ca7a30e
commit 5773846f71
2 changed files with 42 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
lib/gssapi/krb5/verify_mic.c
View File

@@ -143,7 +143,7 @@ verify_mic_des3
OM_uint32 ret; OM_uint32 ret;
krb5_crypto crypto; krb5_crypto crypto;
krb5_data seq_data; krb5_data seq_data;
int cmp; int cmp, docompat;
Checksum csum; Checksum csum;
char *tmp; char *tmp;
char ivec[8]; char ivec[8];
@@ -173,7 +173,9 @@ verify_mic_des3
} }
/* verify sequence number */ /* verify sequence number */
if (context_handle->more_flags & COMPAT_OLD_DES3) docompat = (context_handle->more_flags & COMPAT_OLD_DES3);
retry:
if (docompat)
memset(ivec, 0, 8); memset(ivec, 0, 8);
else else
memcpy(ivec, p + 8, 8); memcpy(ivec, p + 8, 8);
@@ -183,16 +185,22 @@ verify_mic_des3
KRB5_KU_USAGE_SEQ, KRB5_KU_USAGE_SEQ,
p, 8, &seq_data, ivec); p, 8, &seq_data, ivec);
if (ret) { if (ret) {
gssapi_krb5_set_error_string (); if (docompat++) {
krb5_crypto_destroy (gssapi_krb5_context, crypto); gssapi_krb5_set_error_string ();
*minor_status = ret; krb5_crypto_destroy (gssapi_krb5_context, crypto);
return GSS_S_FAILURE; *minor_status = ret;
return GSS_S_FAILURE;
} else
goto retry;
} }
if (seq_data.length != 8) { if (seq_data.length != 8) {
krb5_crypto_destroy (gssapi_krb5_context, crypto);
krb5_data_free (&seq_data); krb5_data_free (&seq_data);
return GSS_S_BAD_MIC; if (docompat++) {
krb5_crypto_destroy (gssapi_krb5_context, crypto);
return GSS_S_BAD_MIC;
} else
goto retry;
} }
krb5_auth_getremoteseqnumber (gssapi_krb5_context, krb5_auth_getremoteseqnumber (gssapi_krb5_context,
@@ -208,8 +216,11 @@ verify_mic_des3
cmp = memcmp (seq, seq_data.data, seq_data.length); cmp = memcmp (seq, seq_data.data, seq_data.length);
krb5_data_free (&seq_data); krb5_data_free (&seq_data);
if (cmp != 0) { if (cmp != 0) {
krb5_crypto_destroy (gssapi_krb5_context, crypto); if (docompat++) {
return GSS_S_BAD_MIC; krb5_crypto_destroy (gssapi_krb5_context, crypto);
return GSS_S_BAD_MIC;
} else
goto retry;
} }
/* verify checksum */ /* verify checksum */

31
lib/gssapi/verify_mic.c
View File

@@ -143,7 +143,7 @@ verify_mic_des3
OM_uint32 ret; OM_uint32 ret;
krb5_crypto crypto; krb5_crypto crypto;
krb5_data seq_data; krb5_data seq_data;
int cmp; int cmp, docompat;
Checksum csum; Checksum csum;
char *tmp; char *tmp;
char ivec[8]; char ivec[8];
@@ -173,7 +173,9 @@ verify_mic_des3
} }
/* verify sequence number */ /* verify sequence number */
if (context_handle->more_flags & COMPAT_OLD_DES3) docompat = (context_handle->more_flags & COMPAT_OLD_DES3);
retry:
if (docompat)
memset(ivec, 0, 8); memset(ivec, 0, 8);
else else
memcpy(ivec, p + 8, 8); memcpy(ivec, p + 8, 8);
@@ -183,16 +185,22 @@ verify_mic_des3
KRB5_KU_USAGE_SEQ, KRB5_KU_USAGE_SEQ,
p, 8, &seq_data, ivec); p, 8, &seq_data, ivec);
if (ret) { if (ret) {
gssapi_krb5_set_error_string (); if (docompat++) {
krb5_crypto_destroy (gssapi_krb5_context, crypto); gssapi_krb5_set_error_string ();
*minor_status = ret; krb5_crypto_destroy (gssapi_krb5_context, crypto);
return GSS_S_FAILURE; *minor_status = ret;
return GSS_S_FAILURE;
} else
goto retry;
} }
if (seq_data.length != 8) { if (seq_data.length != 8) {
krb5_crypto_destroy (gssapi_krb5_context, crypto);
krb5_data_free (&seq_data); krb5_data_free (&seq_data);
return GSS_S_BAD_MIC; if (docompat++) {
krb5_crypto_destroy (gssapi_krb5_context, crypto);
return GSS_S_BAD_MIC;
} else
goto retry;
} }
krb5_auth_getremoteseqnumber (gssapi_krb5_context, krb5_auth_getremoteseqnumber (gssapi_krb5_context,
@@ -208,8 +216,11 @@ verify_mic_des3
cmp = memcmp (seq, seq_data.data, seq_data.length); cmp = memcmp (seq, seq_data.data, seq_data.length);
krb5_data_free (&seq_data); krb5_data_free (&seq_data);
if (cmp != 0) { if (cmp != 0) {
krb5_crypto_destroy (gssapi_krb5_context, crypto); if (docompat++) {
return GSS_S_BAD_MIC; krb5_crypto_destroy (gssapi_krb5_context, crypto);
return GSS_S_BAD_MIC;
} else
goto retry;
} }
/* verify checksum */ /* verify checksum */