From 67a6eb321818cb8acbcaaffa49cbfc0bc17adeb0 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 29 Dec 2022 11:16:06 +0100 Subject: [PATCH] kdc: don't announce KRB5_PADATA_FX_FAST unless fast is enabled BUG: https://bugzilla.samba.org/show_bug.cgi?id=15273 Signed-off-by: Stefan Metzmacher --- kdc/kerberos5.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c index a11823c21..ad25d4c1e 100644 --- a/kdc/kerberos5.c +++ b/kdc/kerberos5.c @@ -1997,7 +1997,10 @@ add_enc_pa_rep(astgs_request_t r) KRB5_PADATA_REQ_ENC_PA_REP, cdata.data, cdata.length); if (ret) return ret; - + + if (!r->config->enable_fast) + return 0; + return krb5_padata_add(r->context, r->ek.encrypted_pa_data, KRB5_PADATA_FX_FAST, NULL, 0); } @@ -2305,6 +2308,8 @@ _kdc_as_rep(astgs_request_t r) if (!r->armor_crypto && !r->config->enable_unarmored_pa_enc_timestamp) continue; } + if (pat[n].type == KRB5_PADATA_FX_FAST && !r->config->enable_fast) + continue; ret = krb5_padata_add(r->context, r->rep.padata, pat[n].type, NULL, 0);