pull up r23628 from trunk

 ------------------------------------------------------------------------
 r23628 | ghudson | 2010-01-11 20:05:37 -0500 (Mon, 11 Jan 2010) | 9 lines

 ticket: 6632
 subject: Simplify and fix FAST check for keyed checksum type
 target_version: 1.8
 tags: pullup

 Use krb5_c_is_keyed_checksum to detect unkeyed checksums when handling
 FAST requests.  The old check was broken for 1.8 because
 krb5_c_verify_checksum got pickier about invalid keyblocks.

ticket: 6632
version_fixed: 1.8
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23649 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c
index e6503cf8ac4decbe52f393dbd3b8475d081d8ade..06b1e2bc7a60503707f89ac4388f68dc48650c89 100644 (file)
--- a/src/kdc/fast_util.c
+++ b/src/kdc/fast_util.c
@@ -133,6 +133,7 @@ kdc_find_fast(krb5_kdc_req **requestptr,
     krb5_fast_req * fast_req = NULL;
     krb5_kdc_req *request = *requestptr;
     krb5_fast_armored_req *fast_armored_req = NULL;
+    krb5_checksum *cksum;
     krb5_boolean cksum_valid;
     krb5_keyblock empty_keyblock;
 
@@ -191,11 +192,11 @@ kdc_find_fast(krb5_kdc_req **requestptr,
             if (plaintext.data)
                 free(plaintext.data);
         }
+        cksum = &fast_armored_req->req_checksum;
         if (retval == 0)
             retval = krb5_c_verify_checksum(kdc_context, state->armor_key,
                                             KRB5_KEYUSAGE_FAST_REQ_CHKSUM,
-                                            checksummed_data,
-                                            &fast_armored_req->req_checksum,
+                                            checksummed_data, cksum,
                                             &cksum_valid);
         if (retval == 0 && !cksum_valid) {
             retval = KRB5KRB_AP_ERR_MODIFIED;
@@ -203,19 +204,7 @@ kdc_find_fast(krb5_kdc_req **requestptr,
                                    "FAST req_checksum invalid; request modified");
         }
         if (retval == 0) {
-            krb5_error_code ret;
-            /*
-             * We need to confirm that a keyed checksum is used for the
-             * fast_req checksum.  In April 2009, the best way to do this is
-             * to try verifying the checksum with a keyblock with an zero
-             * length; if it succeeds, then an unkeyed checksum is used.
-             */
-            ret  = krb5_c_verify_checksum(kdc_context, &empty_keyblock,
-                                          KRB5_KEYUSAGE_FAST_REQ_CHKSUM,
-                                          checksummed_data,
-                                          &fast_armored_req->req_checksum,
-                                          &cksum_valid);
-            if (ret == 0) {
+            if (!krb5_c_is_keyed_cksum(cksum->checksum_type)) {
                 retval = KRB5KDC_ERR_POLICY;
                 krb5_set_error_message(kdc_context, KRB5KDC_ERR_POLICY,
                                        "Unkeyed checksum used in fast_req");