oysteikt/heimdal
0
0
Fork 0
Code Issues 4 Pull Requests Releases Activity

kdc: support pkinit_kdc_revoke for pkinit anchors

Browse Source 
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
This commit is contained in:
Kacper Boström
2022-05-05 13:03:27 +02:00
committed by Jennifer Sutton
parent bddc275275
commit abd35b246a
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kdc/kerberos5.c
+5 -1
View File
@@ -536,7 +536,11 @@ pa_pkinit_validate(astgs_request_t r, const PA_DATA *pa)
ret = _kdc_pk_rd_padata(r, pa, &pkp);
if (ret || pkp == NULL) {
ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
if (ret == HX509_CERT_REVOKED) {
ret = KRB5_KDC_ERR_CLIENT_NOT_TRUSTED;
} else {
ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
}
_kdc_r_log(r, 4, "Failed to decode PKINIT PA-DATA -- %s",
r->cname);
goto out;
kdc/pkinit.c
+2
View File
@@ -797,6 +797,8 @@ _kdc_pk_rd_padata(astgs_request_t priv,
hx509_verify_attach_anchors(cp->verify_ctx, trust_anchors);
hx509_certs_free(&trust_anchors);
hx509_verify_attach_revoke(cp->verify_ctx, kdc_identity->revokectx);
if (config->pkinit_allow_proxy_certs)
hx509_verify_set_proxy_certificate(cp->verify_ctx, 1);