Check the adtkt in the constrained delegation case too.

git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@18101 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2006-09-18 17:30:19 +00:00
parent 467d6b124c
commit cafd935d88

View File

@@ -1491,7 +1491,7 @@ server_lookup:
}
/*
*
* Constrained delegation
*/
if (client != NULL
@@ -1524,17 +1524,12 @@ server_lookup:
if (adtkt.flags.forwardable == 0) {
kdc_log(context, config, 0,
"missing forwardable flag on ticket for "
"Missing forwardable flag on ticket for "
"constrained delegation from %s to %s ", spn, cpn);
ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
goto out;
}
/*
* Check that the KDC have issued this ticket
*/
require_signedpath = 1;
ret = check_constrained_delegation(context, config, client, sp);
if (ret) {
kdc_log(context, config, 0,
@@ -1559,9 +1554,36 @@ server_lookup:
goto out;
}
/*
* Check KRB5SignedPath in authorization data and add new entry to
* make sure servers can't fake a ticket to us.
*/
ret = check_KRB5SignedPath(context,
config,
krbtgt,
&adtkt,
&spp,
1);
if (ret) {
kdc_log(context, config, 0,
"KRB5SignedPath check from service %s failed "
"for delegation to %s for client %s "
"from %s failed with %s",
spn, str, cpn, from, krb5_get_err_text(context, ret));
free(str);
goto out;
}
kdc_log(context, config, 0, "constrained delegation for %s "
"from %s to %s", str, cpn, spn);
free(str);
/*
* Also require that the KDC have issue the service's krbtgt
* used to do the request.
*/
require_signedpath = 1;
}
/*
@@ -1591,11 +1613,7 @@ server_lookup:
goto out;
}
/*
* Check KRB5SignedPath in authorization data and add new entry to
* make sure servers can't fake a ticket to us.
*/
/* also check the krbtgt for signature */
ret = check_KRB5SignedPath(context,
config,
krbtgt,