oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

more checking for addresses and stuff

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@2107 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Assar Westerlund
1997-07-09 04:57:55 +00:00
parent f79e8aeda5
commit b6064bad2f
2 changed files with 46 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
lib/krb5/rd_priv.c
View File

@@ -40,6 +40,26 @@ krb5_rd_priv(krb5_context context,
if (r) if (r)
return r; return r;
/* check sender address */
if (part.s_address
&& !krb5_address_compare (context,
auth_context->remote_address,
part.s_address)) {
r = KRB5KRB_AP_ERR_BADADDR;
goto failure_part;
}
/* check receiver address */
if (part.r_address
&& !krb5_address_compare (context,
auth_context->local_address,
part.r_address)) {
r = KRB5KRB_AP_ERR_BADADDR;
goto failure_part;
}
/* check timestamp */ /* check timestamp */
if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) { if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
struct timeval tv; struct timeval tv;
@@ -49,7 +69,7 @@ krb5_rd_priv(krb5_context context,
part.usec == NULL || part.usec == NULL ||
*part.timestamp - tv.tv_sec > 600) { *part.timestamp - tv.tv_sec > 600) {
r = KRB5KRB_AP_ERR_SKEW; r = KRB5KRB_AP_ERR_SKEW;
goto failure_priv; goto failure_part;
} }
} }
@@ -60,19 +80,19 @@ krb5_rd_priv(krb5_context context,
if (part.seq_number == NULL || if (part.seq_number == NULL ||
*part.seq_number != ++auth_context->remote_seqnumber) { *part.seq_number != ++auth_context->remote_seqnumber) {
r = KRB5KRB_AP_ERR_BADORDER; r = KRB5KRB_AP_ERR_BADORDER;
goto failure_priv; goto failure_part;
} }
} }
r = krb5_data_copy (outbuf, part.user_data.data, part.user_data.length); r = krb5_data_copy (outbuf, part.user_data.data, part.user_data.length);
if (r) if (r)
goto failure_priv; goto failure_part;
free_EncKrbPrivPart (&part); free_EncKrbPrivPart (&part);
free_KRB_PRIV (&priv); free_KRB_PRIV (&priv);
return 0; return 0;
failure_priv: failure_part:
free_EncKrbPrivPart (&part); free_EncKrbPrivPart (&part);
failure: failure:

22
lib/krb5/rd_safe.c
View File

@@ -24,10 +24,32 @@ krb5_rd_safe(krb5_context context,
r = KRB5KRB_AP_ERR_MSG_TYPE; r = KRB5KRB_AP_ERR_MSG_TYPE;
goto failure; goto failure;
} }
/* XXX - checksum collision-proff and keyed */
if (safe.cksum.cksumtype != CKSUMTYPE_RSA_MD4) { if (safe.cksum.cksumtype != CKSUMTYPE_RSA_MD4) {
r = KRB5KRB_AP_ERR_INAPP_CKSUM; r = KRB5KRB_AP_ERR_INAPP_CKSUM;
goto failure; goto failure;
} }
/* check sender address */
if (safe.safe_body.s_address
&& !krb5_address_compare (context,
auth_context->remote_address,
safe.safe_body.s_address)) {
r = KRB5KRB_AP_ERR_BADADDR;
goto failure;
}
/* check receiver address */
if (safe.safe_body.r_address
&& !krb5_address_compare (context,
auth_context->local_address,
safe.safe_body.r_address)) {
r = KRB5KRB_AP_ERR_BADADDR;
goto failure;
}
/* check timestamp */ /* check timestamp */
if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) { if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
struct timeval tv; struct timeval tv;