oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: use actual client princ for KRB5SignedPath

Browse Source 
When generating KRB5SignedPath in the AS, use the reply client name rather than
the one from the request, so validation will work correctly in the TGS.
This commit is contained in:
Luke Howard
2019-05-06 17:45:09 +10:00
committed by Jeffrey Altman
parent b7fe0fb85a
commit c634146b14
2 changed files with 23 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
kdc/kerberos5.c
View File

@@ -2242,17 +2242,27 @@ _kdc_as_rep(kdc_request_t r,
_kdc_log_timestamp(context, config, "AS-REQ", r->et.authtime, r->et.starttime,
r->et.endtime, r->et.renew_till);
/* do this as the last thing since this signs the EncTicketPart */
ret = _kdc_add_KRB5SignedPath(context,
config,
r->server,
setype,
r->client->entry.principal,
NULL,
NULL,
&r->et);
if (ret)
goto out;
{
krb5_principal client_principal;
ret = _krb5_principalname2krb5_principal(context, &client_principal,
rep.cname, rep.crealm);
if (ret)
goto out;
/* do this as the last thing since this signs the EncTicketPart */
ret = _kdc_add_KRB5SignedPath(context,
config,
r->server,
setype,
client_principal,
NULL,
NULL,
&r->et);
krb5_free_principal(context, client_principal);
if (ret)
goto out;
}
log_as_req(context, config, r->reply_key.keytype, setype, b);

4
kdc/krb5tgs.c
View File

@@ -104,7 +104,7 @@ _kdc_add_KRB5SignedPath(krb5_context context,
krb5_kdc_configuration *config,
hdb_entry_ex *krbtgt,
krb5_enctype enctype,
krb5_principal client,
krb5_const_principal client,
krb5_const_principal server,
krb5_principals principals,
EncTicketPart *tkt)
@@ -124,7 +124,7 @@ _kdc_add_KRB5SignedPath(krb5_context context,
{
KRB5SignedPathData spd;
spd.client = client;
spd.client = rk_UNCONST(client);
spd.authtime = tkt->authtime;
spd.delegated = principals;
spd.method_data = NULL;