oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

tgs-req: strip forwardable and proxiable if the server is disallowed

Browse Source
This commit is contained in:
Isaac Boukris
2020-01-18 14:47:02 +01:00
committed by Jeffrey Altman
parent 921d528d8b
commit 839b073fac
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
kdc/krb5tgs.c
View File

@@ -912,6 +912,12 @@ tgs_make_reply(astgs_request_t r,
et.flags.hw_authent = tgt->flags.hw_authent;
et.flags.ok_as_delegate = server->entry.flags.ok_as_delegate;
/* See MS-KILE 3.3.5.1 */
if (!server->entry.flags.forwardable)
et.flags.forwardable = 0;
if (!server->entry.flags.proxiable)
et.flags.proxiable = 0;
/*
* For anonymous tickets, we should filter out positive authorization data
* that could reveal the client's identity, and return a policy error for

4
tests/kdc/check-kdc.in
View File

@@ -460,6 +460,10 @@ ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
${klist} -f | grep ${server} | grep FRA > /dev/null || \
{ ec=1 ; eval "${testfailed}"; }
echo "Testing strip of forwardable when the server is disallowed in TGS-REQ"
${kgetcred} sensitive@${R} || { ec=1 ; eval "${testfailed}"; }
${klist} -f | grep sensitive | grep FRA > /dev/null && \
{ ec=1 ; eval "${testfailed}"; }
echo "Specific enctype"; > messages.log
${kinit} --password-file=${objdir}/foopassword \