oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

allow the non preauth case again

Browse Source
This commit is contained in:
Love Hornquist Astrand
2013-07-11 15:56:04 +02:00
parent 3ad1bf2dcc
commit efe81b12ef
1 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
kdc/kerberos5.c
View File

@@ -513,7 +513,9 @@ pa_enc_chal_validate(kdc_request_t r, const PA_DATA *pa)
set_salt_padata(&r->outpadata, k->salt); set_salt_padata(&r->outpadata, k->salt);
krb5_free_keyblock_contents(r->context, &r->reply_key); krb5_free_keyblock_contents(r->context, &r->reply_key);
ret = krb5_copy_keyblock_contents(r->context, &k->key, &r->reply_key); ret = krb5_copy_keyblock_contents(r->context, &k->key, &r->reply_key);
ret = 0; if (ret)
goto out;
break; break;
} }
if (i < r->client->entry.keys.len) if (i < r->client->entry.keys.len)
@@ -1571,7 +1573,7 @@ _kdc_as_rep(kdc_request_t r,
KDCOptions f; KDCOptions f;
krb5_enctype setype; krb5_enctype setype;
krb5_error_code ret = 0; krb5_error_code ret = 0;
Key *ckey, *skey; Key *skey;
int found_pa = 0; int found_pa = 0;
int i, flags = HDB_F_FOR_AS_REQ; int i, flags = HDB_F_FOR_AS_REQ;
METHOD_DATA error_method; METHOD_DATA error_method;
@@ -1744,7 +1746,8 @@ _kdc_as_rep(kdc_request_t r,
} }
} }
if (found_pa == 0 && (require_preauth_p(r) || b->kdc_options.request_anonymous)) { if (found_pa == 0) {
Key *ckey = NULL;
size_t n; size_t n;
for (n = 0; n < sizeof(pat) / sizeof(pat[0]); n++) { for (n = 0; n < sizeof(pat) / sizeof(pat[0]); n++) {
@@ -1788,9 +1791,25 @@ _kdc_as_rep(kdc_request_t r,
goto out; goto out;
} }
ret = KRB5KDC_ERR_PREAUTH_REQUIRED; /*
_kdc_set_e_text(r, "Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ"); * send requre preauth is its required or anon is requested,
goto out; * anon is today only allowed via preauth mechanisms.
*/
if (require_preauth_p(r) || b->kdc_options.request_anonymous) {
ret = KRB5KDC_ERR_PREAUTH_REQUIRED;
_kdc_set_e_text(r, "Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ");
goto out;
}
if (ckey == NULL) {
ret = KRB5KDC_ERR_CLIENT_NOTYET;
_kdc_set_e_text(r, "Doesn't have a client key available");
goto out;
}
krb5_free_keyblock_contents(r->context, &r->reply_key);
ret = krb5_copy_keyblock_contents(r->context, &ckey->key, &r->reply_key);
if (ret)
goto out;
} }
if (r->clientdb->hdb_auth_status) if (r->clientdb->hdb_auth_status)