pull up r22264 from trunk
authorTom Yu <tlyu@mit.edu>
Fri, 17 Apr 2009 21:28:37 +0000 (21:28 +0000)
committerTom Yu <tlyu@mit.edu>
Fri, 17 Apr 2009 21:28:37 +0000 (21:28 +0000)
 ------------------------------------------------------------------------
 r22264 | ghudson | 2009-04-16 12:46:33 -0400 (Thu, 16 Apr 2009) | 12 lines
 Changed paths:
    M /trunk/src/kdc/kdc_preauth.c
    M /trunk/src/kdc/kdc_util.c

 ticket: 6470
 subject: Send explicit salt for SALTTYPE_NORMAL keys
 target_version: 1.7
 tags: pullup

 Change the signature of _make_etype_info_entry to take the canonical
 client principal instead of the request structure.  Also fixes the salt
 we compute for SALTTYPE_NOREALM keys.

 Sending an explicit salt for SALTTYPE_NORMAL keys is believed to be
 necessary for some preauth scenarios involving aliases.

ticket: 6470
version_fixed: 1.7

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-7@22265 dc483132-0cff-0310-8789-dd5450dbe970

src/kdc/kdc_preauth.c
src/kdc/kdc_util.c

index 3dda38150e8f91b8de0b7d3911feea7e684bbace..b153bbf25761fceffab1559964677a9259280214 100644 (file)
@@ -1510,7 +1510,7 @@ cleanup:
 
 static krb5_error_code
 _make_etype_info_entry(krb5_context context,
-                      krb5_kdc_req *request, krb5_key_data *client_key,
+                      krb5_principal client_princ, krb5_key_data *client_key,
                       krb5_enctype etype, krb5_etype_info_entry **entry,
                       int etype_info2)
 {
@@ -1529,8 +1529,7 @@ _make_etype_info_entry(krb5_context context,
     tmp_entry->salt = 0;
     tmp_entry->s2kparams.data = NULL;
     tmp_entry->s2kparams.length = 0;
-    retval = get_salt_from_key(context, request->client,
-                              client_key, &salt);
+    retval = get_salt_from_key(context, client_princ, client_key, &salt);
     if (retval)
        goto fail;
     if (etype_info2 && client_key->key_data_ver > 1 &&
@@ -1609,10 +1608,10 @@ etype_info_helper(krb5_context context, krb5_kdc_req *request,
        if (request_contains_enctype(context, request, db_etype)) {
            assert(etype_info2 ||
                   !enctype_requires_etype_info_2(db_etype));
-           if ((retval = _make_etype_info_entry(context, request, client_key,
-                           db_etype, &entry[i], etype_info2)) != 0) {
+           retval = _make_etype_info_entry(context, client->princ, client_key,
+                                           db_etype, &entry[i], etype_info2);
+           if (retval != 0)
                goto cleanup;
-           }
            entry[i+1] = 0;
            i++;
        }
@@ -1634,10 +1633,11 @@ etype_info_helper(krb5_context context, krb5_kdc_req *request,
 
            }
            if (request_contains_enctype(context, request, db_etype)) {
-               if ((retval = _make_etype_info_entry(context, request,
-                               client_key, db_etype, &entry[i], etype_info2)) != 0) {
+               retval = _make_etype_info_entry(context, client->princ,
+                                               client_key, db_etype,
+                                               &entry[i], etype_info2);
+               if (retval != 0)
                    goto cleanup;
-               }
                entry[i+1] = 0;
                i++;
            }
@@ -1732,9 +1732,9 @@ etype_info_as_rep_helper(krb5_context context, krb5_pa_data * padata,
     }
     entry[0] = NULL;
     entry[1] = NULL;
-    retval = _make_etype_info_entry(context, request,
-                                   client_key, encrypting_key->enctype,
-                                   entry, etype_info2);
+    retval = _make_etype_info_entry(context, client->princ, client_key,
+                                   encrypting_key->enctype, entry,
+                                   etype_info2);
     if (retval)
        goto cleanup;
 
index f54bd3403bb4cb84db631261a3ad8c71a3dbb04b..607108a996495a536d01c6c77ec425e1a34b74ec 100644 (file)
@@ -1568,6 +1568,13 @@ get_salt_from_key(krb5_context context, krb5_principal client,
 
     switch (client_key->key_data_type[1]) {
     case KRB5_KDB_SALTTYPE_NORMAL:
+       /*
+        * The client could infer the salt from the principal, but
+        * might use the wrong principal name if this is an alias.  So
+        * it's more reliable to send an explicit salt.
+        */
+       if ((retval = krb5_principal2salt(context, client, salt)))
+           return retval;
        break;
     case KRB5_KDB_SALTTYPE_V4:
        /* send an empty (V4) salt */