oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

(krb5_decrypt_ticket): try to verify transited realms, unless the

Browse Source 
transited-policy-checked flag is set


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@13026 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Johan Danielsson
2003-10-20 16:43:30 +00:00
parent df034198d5
commit 88e4f61f85
1 changed files with 34 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
lib/krb5/rd_req.c
View File

@@ -129,6 +129,32 @@ krb5_decode_ap_req(krb5_context context,
return 0; return 0;
} }
static krb5_error_code
check_transited(krb5_context context, Ticket *ticket, EncTicketPart *enc)
{
char **realms;
int num_realms;
krb5_error_code ret;
if(enc->transited.tr_type != DOMAIN_X500_COMPRESS)
return KRB5KDC_ERR_TRTYPE_NOSUPP;
if(enc->transited.contents.length == 0)
return 0;
ret = krb5_domain_x500_decode(context, enc->transited.contents,
&realms, &num_realms,
enc->crealm,
ticket->realm);
if(ret)
return ret;
ret = krb5_check_transited(context, enc->crealm,
ticket->realm,
realms, num_realms, NULL);
free(realms);
return ret;
}
krb5_error_code krb5_error_code
krb5_decrypt_ticket(krb5_context context, krb5_decrypt_ticket(krb5_context context,
Ticket *ticket, Ticket *ticket,
@@ -161,6 +187,14 @@ krb5_decrypt_ticket(krb5_context context,
krb5_clear_error_string (context); krb5_clear_error_string (context);
return KRB5KRB_AP_ERR_TKT_EXPIRED; return KRB5KRB_AP_ERR_TKT_EXPIRED;
} }
if(!t.flags.transited_policy_checked) {
ret = check_transited(context, ticket, &t);
if(ret) {
free_EncTicketPart(&t);
return ret;
}
}
} }
if(out) if(out)
@@ -209,29 +243,6 @@ out:
return ret; return ret;
} }
#if 0
static krb5_error_code
check_transited(krb5_context context,
krb5_ticket *ticket)
{
char **realms;
int num_realms;
krb5_error_code ret;
if(ticket->ticket.transited.tr_type != DOMAIN_X500_COMPRESS)
return KRB5KDC_ERR_TRTYPE_NOSUPP;
ret = krb5_domain_x500_decode(ticket->ticket.transited.contents,
&realms, &num_realms,
ticket->client->realm,
ticket->server->realm);
if(ret)
return ret;
ret = krb5_check_transited_realms(context, realms, num_realms, NULL);
free(realms);
return ret;
}
#endif
krb5_error_code krb5_error_code
krb5_verify_ap_req(krb5_context context, krb5_verify_ap_req(krb5_context context,