Support credentials encrypted in the session key rather than

the subsession key.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15181 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog
index b27558ce456471902427b3b67809198ca9c6ffaf..fa7b7c8b5afd83a687c0b03d2442cf08717c472e 100644 (file)
--- a/src/lib/krb5/krb/ChangeLog
+++ b/src/lib/krb5/krb/ChangeLog
@@ -1,3 +1,14 @@
+2003-02-11  Sam Hartman  <hartmans@mit.edu>
+
+       * rd_cred.c (krb5_rd_cred): Free creds using krb5_free_tgt_creds
+       and make sure they are set to null in case of  error.
+
+2003-02-07  Sam Hartman  <hartmans@mit.edu>
+
+       * rd_cred.c (krb5_rd_cred): Allow the tickets to be encrypted the
+       session key as well as the  subsession key; for GSSAPI this tends
+       to be what happens.
+
 2003-02-04  Sam Hartman  <hartmans@mit.edu>
 
        * get_in_tkt.c (krb5_get_init_creds): Default to addressless tickets

diff --git a/src/lib/krb5/krb/rd_cred.c b/src/lib/krb5/krb/rd_cred.c
index d930efc1543f6f5a6ce836a235dbcb44a97dda6d..228219f765cb9fca628ba7b1e37250086f22cf20 100644 (file)
--- a/src/lib/krb5/krb/rd_cred.c
+++ b/src/lib/krb5/krb/rd_cred.c
@@ -184,11 +184,19 @@ krb5_rd_cred(krb5_context context, krb5_auth_context auth_context, krb5_data *pc
         return KRB5_RC_REQUIRED;
 
 
+/* If decrypting with the first keyblock we try fails, perhaps the
+ * credentials are stored in the session key so try decrypting with
+    * that.
+*/
     if ((retval = krb5_rd_cred_basic(context, pcreddata, keyblock,
                                     &replaydata, pppcreds))) {
-      return retval;
+       if ((retval = krb5_rd_cred_basic(context, pcreddata,
+                                        auth_context->keyblock,
+                                        &replaydata, pppcreds))) {
+           return retval;
     }
-
+    }
+    
     if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME) {
         krb5_donot_replay replay;
         krb5_timestamp currenttime;
@@ -231,8 +239,10 @@ krb5_rd_cred(krb5_context context, krb5_auth_context auth_context, krb5_data *pc
     }
 
 error:;
-    if (retval)
-       krb5_xfree(*pppcreds);
+    if (retval) {
+       krb5_free_tgt_creds(context, *pppcreds);
+       *pppcreds = NULL;
+    }
     return retval;
 }