oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Fix user-to-user authentication.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@3675 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Johan Danielsson
1997-10-27 23:20:47 +00:00
parent fcc4e9838f
commit 9293c68e1b
1 changed files with 40 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
kdc/kerberos5.c
View File

@@ -769,8 +769,11 @@ fix_transited_encoding(TransitedEncoding *tr,
static krb5_error_code static krb5_error_code
tgs_make_reply(KDC_REQ_BODY *b, EncTicketPart *tgt, tgs_make_reply(KDC_REQ_BODY *b,
hdb_entry *server, hdb_entry *client, EncTicketPart *tgt,
EncTicketPart *adtkt,
hdb_entry *server,
hdb_entry *client,
krb5_principal client_principal, krb5_principal client_principal,
hdb_entry *krbtgt, hdb_entry *krbtgt,
krb5_enctype cetype, krb5_enctype cetype,
@@ -784,6 +787,7 @@ tgs_make_reply(KDC_REQ_BODY *b, EncTicketPart *tgt,
int i; int i;
krb5_enctype setype; krb5_enctype setype;
Key *skey; Key *skey;
EncryptionKey *ekey;
krb5_keytype sess_ktype; krb5_keytype sess_ktype;
/* Find appropriate key */ /* Find appropriate key */
@@ -800,6 +804,9 @@ tgs_make_reply(KDC_REQ_BODY *b, EncTicketPart *tgt,
sess_ktype = skey->key.keytype; sess_ktype = skey->key.keytype;
skey = NULL; skey = NULL;
if(adtkt)
ekey = &adtkt->key;
else{
for(i = 0; i < server->keys.len; i++){ for(i = 0; i < server->keys.len; i++){
if(skey == NULL || is_better(server->keys.val[i].key.keytype, if(skey == NULL || is_better(server->keys.val[i].key.keytype,
skey->key.keytype)) skey->key.keytype))
@@ -810,7 +817,9 @@ tgs_make_reply(KDC_REQ_BODY *b, EncTicketPart *tgt,
kdc_log(0, "No key found for server"); kdc_log(0, "No key found for server");
goto out; goto out;
} }
ret = krb5_keytype_to_etype(context, skey->key.keytype, &setype); ekey = &skey->key;
}
ret = krb5_keytype_to_etype(context, ekey->keytype, &setype);
memset(&rep, 0, sizeof(rep)); memset(&rep, 0, sizeof(rep));
memset(&et, 0, sizeof(et)); memset(&et, 0, sizeof(et));
@@ -929,8 +938,8 @@ tgs_make_reply(KDC_REQ_BODY *b, EncTicketPart *tgt,
} }
krb5_encrypt_EncryptedData(context, buf + sizeof(buf) - len, len, krb5_encrypt_EncryptedData(context, buf + sizeof(buf) - len, len,
setype, setype,
server->kvno, adtkt ? 0 : server->kvno,
&skey->key, ekey,
&rep.ticket.enc_part); &rep.ticket.enc_part);
ret = encode_EncTGSRepPart(buf + sizeof(buf) - 1, ret = encode_EncTGSRepPart(buf + sizeof(buf) - 1,
@@ -1152,21 +1161,28 @@ tgs_rep2(KDC_REQ_BODY *b,
hdb_entry *server = NULL, *client = NULL; hdb_entry *server = NULL, *client = NULL;
TransitedEncoding tr; TransitedEncoding tr;
int loop = 0; int loop = 0;
EncTicketPart adtkt;
s = b->sname; s = b->sname;
r = b->realm; r = b->realm;
#if 0
if(b->kdc_options.enc_tkt_in_skey){ if(b->kdc_options.enc_tkt_in_skey){
Ticket *t; Ticket *t;
hdb_entry *uu; hdb_entry *uu;
krb5_principal p; krb5_principal p;
Key *tkey; Key *tkey;
if(b->additional_tickets == NULL){
if(b->additional_tickets == NULL ||
b->additional_tickets->len == 0){
ret = KRB5KDC_ERR_BADOPTION; /* ? */ ret = KRB5KDC_ERR_BADOPTION; /* ? */
kdc_log(0, "No second ticket present in request"); kdc_log(0, "No second ticket present in request");
goto out; goto out;
} }
t = &b->additional_tickets->val[0]; t = &b->additional_tickets->val[0];
if(!is_krbtgt(&t->sname)){
kdc_log(0, "Additional ticket is not a ticket-granting ticket");
ret = KRB5KDC_ERR_POLICY;
goto out2;
}
principalname2krb5_principal(&p, t->sname, t->realm); principalname2krb5_principal(&p, t->sname, t->realm);
uu = db_fetch(p); uu = db_fetch(p);
krb5_free_principal(context, p); krb5_free_principal(context, p);
@@ -1179,21 +1195,13 @@ tgs_rep2(KDC_REQ_BODY *b,
ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */ ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
goto out; goto out;
} }
ret = krb5_decrypt_EncryptedData(context, &t->enc_part, ret = krb5_decrypt_ticket(context, t, &tkey->key, &adtkt);
&tkey->key, &result);
if(ret){ if(ret)
/* XXX */
goto out; goto out;
s = &adtkt.cname;
r = adtkt.crealm;
} }
ret = decode_EncTicketPart(result.data, result.length, &ct, &len);
if(ret){
goto out;
}
s = ct.cname;
r = ct.crealm;
}
#endif
principalname2krb5_principal(&sp, *s, r); principalname2krb5_principal(&sp, *s, r);
krb5_unparse_name(context, sp, &spn); krb5_unparse_name(context, sp, &spn);
@@ -1246,8 +1254,9 @@ tgs_rep2(KDC_REQ_BODY *b,
goto out; goto out;
} }
ret = tgs_make_reply(b, tgt, server, client, cp, ret = tgs_make_reply(b, tgt,
krbtgt, cetype, reply); b->kdc_options.enc_tkt_in_skey ? &adtkt : NULL,
server, client, cp, krbtgt, cetype, reply);
out: out:
free(spn); free(spn);