oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

(fix_transited_encoding): also verify with policy, unless asked not to

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@13027 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Johan Danielsson
2003-10-20 16:45:28 +00:00
parent 88e4f61f85
commit 5d138af639
1 changed files with 60 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
kdc/kerberos5.c
View File

@@ -996,13 +996,8 @@ as_rep(KDC_REQ *req,
copy_HostAddresses(b->addresses, et.caddr); copy_HostAddresses(b->addresses, et.caddr);
} }
{
krb5_data empty_string;
krb5_data_zero(&empty_string);
et.transited.tr_type = DOMAIN_X500_COMPRESS; et.transited.tr_type = DOMAIN_X500_COMPRESS;
et.transited.contents = empty_string; krb5_data_zero(&et.transited.contents);
}
copy_EncryptionKey(&et.key, &ek.key); copy_EncryptionKey(&et.key, &ek.key);
@@ -1212,21 +1207,22 @@ check_tgs_flags(KDC_REQ_BODY *b, EncTicketPart *tgt, EncTicketPart *et)
static krb5_error_code static krb5_error_code
fix_transited_encoding(TransitedEncoding *tr, fix_transited_encoding(TransitedEncoding *tr,
EncTicketPart *et,
KDCOptions *f,
const char *client_realm, const char *client_realm,
const char *server_realm, const char *server_realm,
const char *tgt_realm) const char *tgt_realm)
{ {
krb5_error_code ret = 0; krb5_error_code ret = 0;
if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)){ char **realms, **tmp;
char **realms = NULL, **tmp; int num_realms;
int num_realms = 0;
int i; int i;
if(tr->tr_type && tr->contents.length != 0) {
if(tr->tr_type != DOMAIN_X500_COMPRESS) { if(tr->tr_type != DOMAIN_X500_COMPRESS) {
kdc_log(0, "Unknown transited type: %u", kdc_log(0, "Unknown transited type: %u", tr->tr_type);
tr->tr_type);
return KRB5KDC_ERR_TRTYPE_NOSUPP; return KRB5KDC_ERR_TRTYPE_NOSUPP;
} }
ret = krb5_domain_x500_decode(context, ret = krb5_domain_x500_decode(context,
tr->contents, tr->contents,
&realms, &realms,
@@ -1237,7 +1233,8 @@ fix_transited_encoding(TransitedEncoding *tr,
krb5_warn(context, ret, "Decoding transited encoding"); krb5_warn(context, ret, "Decoding transited encoding");
return ret; return ret;
} }
} if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) {
/* not us, so add the previous realm to transited set */
if (num_realms < 0 || num_realms + 1 > UINT_MAX/sizeof(*realms)) { if (num_realms < 0 || num_realms + 1 > UINT_MAX/sizeof(*realms)) {
ret = ERANGE; ret = ERANGE;
goto free_realms; goto free_realms;
@@ -1254,16 +1251,41 @@ fix_transited_encoding(TransitedEncoding *tr,
goto free_realms; goto free_realms;
} }
num_realms++; num_realms++;
free_TransitedEncoding(tr); }
tr->tr_type = DOMAIN_X500_COMPRESS; if(!f->disable_transited_check) {
ret = krb5_domain_x500_encode(realms, num_realms, &tr->contents); ret = krb5_check_transited(context, client_realm,
server_realm,
realms, num_realms, NULL);
if(ret) {
size_t l = 0;
char *rs;
krb5_warn(context, ret, "cross-realm from %s to %s",
client_realm, server_realm);
for(i = 0; i < num_realms; i++)
l += strlen(realms[i]) + 2;
rs = malloc(l);
if(rs != NULL) {
*rs = '\0';
for(i = 0; i < num_realms; i++) {
if(i > 0)
strlcat(rs, ", ", l);
strlcat(rs, realms[i], l);
}
krb5_warnx(context, "transited realms: %s", rs);
free(rs);
}
goto free_realms;
}
et->flags.transited_policy_checked = 1;
}
ret = krb5_domain_x500_encode(realms, num_realms, &et->transited.contents);
if(ret) if(ret)
krb5_warn(context, ret, "Encoding transited encoding"); krb5_warn(context, ret, "Encoding transited encoding");
free_realms: free_realms:
for(i = 0; i < num_realms; i++) for(i = 0; i < num_realms; i++)
free(realms[i]); free(realms[i]);
free(realms); free(realms);
}
return ret; return ret;
} }
@@ -1331,8 +1353,7 @@ tgs_make_reply(KDC_REQ_BODY *b,
if(ret) if(ret)
goto out; goto out;
copy_TransitedEncoding(&tgt->transited, &et.transited); ret = fix_transited_encoding(&tgt->transited, &et, &f,
ret = fix_transited_encoding(&et.transited,
*krb5_princ_realm(context, client_principal), *krb5_princ_realm(context, client_principal),
*krb5_princ_realm(context, server->principal), *krb5_princ_realm(context, server->principal),
*krb5_princ_realm(context, krbtgt->principal)); *krb5_princ_realm(context, krbtgt->principal));