From c2e68593a5411490ebcd07b6c60c90fc33f999c5 Mon Sep 17 00:00:00 2001 From: Ralph Boehme Date: Thu, 4 Jul 2024 14:59:54 +0200 Subject: [PATCH] lib/krb5: use check_fast() in _krb5_fast_unwrap_error() At least Windows KDCs return KRB5KRB_AP_ERR_SKEW without edata in response to TGS-REQ. This ensures the callers see the KRB5KRB_AP_ERR_SKEW error and not KRB5_KDCREP_MODIFIED "FAST fast response is missing FX-FAST". For the response to an amored AS-REQ, we'll now return KRB5KRB_AP_ERR_MODIFIED instead of KRB5_KDCREP_MODIFIED, but if there's an attack the exact error code doesn't matter. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15676 Pair-Programmed-With: Stefan Metzmacher Signed-off-by: Ralph Boehme Signed-off-by: Stefan Metzmacher --- lib/krb5/fast.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/krb5/fast.c b/lib/krb5/fast.c index 338c4facf..a8a664d7c 100644 --- a/lib/krb5/fast.c +++ b/lib/krb5/fast.c @@ -694,10 +694,14 @@ _krb5_fast_unwrap_error(krb5_context context, idx = 0; pa = krb5_find_padata(md->val, md->len, KRB5_PADATA_FX_FAST, &idx); if (pa == NULL) { - ret = KRB5_KDCREP_MODIFIED; - krb5_set_error_message(context, ret, - N_("FAST fast response is missing FX-FAST", "")); - goto out; + /* + * Typically _krb5_fast_wrap_req() has set KRB5_FAST_EXPECTED, which + * means check_fast() will complain and return KRB5KRB_AP_ERR_MODIFIED. + * + * But for TGS-REP init_tgs_req() clears KRB5_FAST_EXPECTED and we'll + * ignore a missing KRB5_PADATA_FX_FAST. + */ + return check_fast(context, state); } ret = unwrap_fast_rep(context, state, pa, &fastrep);