oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: don't add PAC_ATTRIBUTES PAC buffer for service tickets

Browse Source 
Only include the PAC_ATTRIBUTES PAC info buffer if we are issuing a TGT, as its
contents are not relevant to application services. (The buffer contains a bit
indicating whether the client explicitly or implicitly requested a PAC.)
This commit is contained in:
Luke Howard
2021-12-22 16:38:52 +11:00
parent b36ac3c15e
commit b4f3617964
2 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
kdc/kerberos5.c
View File

@@ -1891,7 +1891,8 @@ get_pac_attributes(krb5_context context, KDC_REQ *req)
*/ */
static krb5_error_code static krb5_error_code
generate_pac(astgs_request_t r, const Key *skey, const Key *tkey) generate_pac(astgs_request_t r, const Key *skey, const Key *tkey,
krb5_boolean is_tgs)
{ {
krb5_error_code ret; krb5_error_code ret;
krb5_pac p = NULL; krb5_pac p = NULL;
@@ -1962,7 +1963,7 @@ generate_pac(astgs_request_t r, const Key *skey, const Key *tkey)
rodc_id, rodc_id,
NULL, /* UPN */ NULL, /* UPN */
canon_princ, canon_princ,
&r->pac_attributes, is_tgs ? &r->pac_attributes : NULL,
&data); &data);
krb5_free_principal(r->context, client); krb5_free_principal(r->context, client);
krb5_pac_free(r->context, p); krb5_pac_free(r->context, p);
@@ -2726,7 +2727,7 @@ _kdc_as_rep(astgs_request_t r)
/* Add the PAC */ /* Add the PAC */
if (!r->et.flags.anonymous) { if (!r->et.flags.anonymous) {
generate_pac(r, skey, krbtgt_key); generate_pac(r, skey, krbtgt_key, is_tgs);
} }
if (r->client->entry.flags.synthetic) { if (r->client->entry.flags.synthetic) {

11
kdc/krb5tgs.c
View File

@@ -812,6 +812,9 @@ tgs_make_reply(astgs_request_t r,
* is implementation dependent. * is implementation dependent.
*/ */
if (mspac && !et.flags.anonymous) { if (mspac && !et.flags.anonymous) {
krb5_boolean is_tgs =
krb5_principal_is_krbtgt(r->context, server->entry.principal);
if (r->client_princ) { if (r->client_princ) {
char *cpn; char *cpn;
@@ -821,10 +824,14 @@ tgs_make_reply(astgs_request_t r,
krb5_xfree(cpn); krb5_xfree(cpn);
} }
/* The PAC should be the last change to the ticket. */ /*
* The PAC should be the last change to the ticket. PAC attributes
* are not included for service tickets.
*/
ret = _krb5_kdc_pac_sign_ticket(r->context, mspac, tgt_name, serverkey, ret = _krb5_kdc_pac_sign_ticket(r->context, mspac, tgt_name, serverkey,
krbtgtkey, rodc_id, NULL, r->client_princ, krbtgtkey, rodc_id, NULL, r->client_princ,
add_ticket_sig, &et, &r->pac_attributes); add_ticket_sig, &et,
is_tgs ? &r->pac_attributes : NULL);
if (ret) if (ret)
goto out; goto out;
} }