From 3ed57da7e3beff1e3841f0744292476ba729fe67 Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Mon, 11 May 2009 20:56:53 +0000 Subject: [PATCH] pull up r22325 from trunk ------------------------------------------------------------------------ r22325 | hartmans | 2009-05-07 16:35:28 -0400 (Thu, 07 May 2009) | 18 lines Changed paths: M /trunk/src/include/k5-int.h M /trunk/src/lib/krb5/krb/decode_kdc.c M /trunk/src/lib/krb5/krb/gc_via_tkt.c M /trunk/src/lib/krb5/libkrb5.exports Subject: Try decrypting using session key if subkey fails in tgs rep handling ticket: 6484 Tags: pullup Target_Version: 1.7 Heimdal at least up through 1.2 incorrectly encrypts the TGS response in the session key not the subkey when a subkey is supplied. See RFC 4120 page 35. Work around this by trying decryption using the session key after the subkey fails. * decode_kdc_rep.c: rename to krb5int_decode_tgs_rep; only used for TGS and now needs to take keyusage * gc_via_tkt: pass in session key and appropriate usage if subkey fails. Note that the dead code to process AS responses in decode_kdc_rep is not removed by this commit. That will be removed as FAST TGS client support is integrated post 1.7. ticket: 6484 version_fixed: 1.7 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-7@22340 dc483132-0cff-0310-8789-dd5450dbe970 --- src/include/k5-int.h | 4 ++-- src/lib/krb5/krb/decode_kdc.c | 6 ++---- src/lib/krb5/krb/gc_via_tkt.c | 14 +++++++++++--- src/lib/krb5/libkrb5.exports | 1 - 4 files changed, 15 insertions(+), 10 deletions(-) diff --git a/src/include/k5-int.h b/src/include/k5-int.h index ca6769c11..eb4e2faec 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -2644,10 +2644,10 @@ krb5_error_code krb5int_send_tgs * in with the subkey needed to decrypt the TGS * response. Otherwise it will be set to null. */ -krb5_error_code krb5_decode_kdc_rep +krb5_error_code krb5int_decode_tgs_rep (krb5_context, krb5_data *, - const krb5_keyblock *, + const krb5_keyblock *, krb5_keyusage, krb5_kdc_rep ** ); krb5_error_code krb5int_find_authdata (krb5_context context, krb5_authdata *const * ticket_authdata, diff --git a/src/lib/krb5/krb/decode_kdc.c b/src/lib/krb5/krb/decode_kdc.c index a75bbf266..689e2a241 100644 --- a/src/lib/krb5/krb/decode_kdc.c +++ b/src/lib/krb5/krb/decode_kdc.c @@ -43,17 +43,15 @@ */ krb5_error_code -krb5_decode_kdc_rep(krb5_context context, krb5_data *enc_rep, const krb5_keyblock *key, krb5_kdc_rep **dec_rep) +krb5int_decode_tgs_rep(krb5_context context, krb5_data *enc_rep, const krb5_keyblock *key, + krb5_keyusage usage, krb5_kdc_rep **dec_rep) { krb5_error_code retval; krb5_kdc_rep *local_dec_rep; - krb5_keyusage usage; if (krb5_is_as_rep(enc_rep)) { - usage = KRB5_KEYUSAGE_AS_REP_ENCPART; retval = decode_krb5_as_rep(enc_rep, &local_dec_rep); } else if (krb5_is_tgs_rep(enc_rep)) { - usage = KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY; retval = decode_krb5_tgs_rep(enc_rep, &local_dec_rep); } else { return KRB5KRB_AP_ERR_MSG_TYPE; diff --git a/src/lib/krb5/krb/gc_via_tkt.c b/src/lib/krb5/krb/gc_via_tkt.c index e8dbd97fe..83c8026fc 100644 --- a/src/lib/krb5/krb/gc_via_tkt.c +++ b/src/lib/krb5/krb/gc_via_tkt.c @@ -290,9 +290,17 @@ krb5_get_cred_via_tkt (krb5_context context, krb5_creds *tkt, goto error_4; } - if ((retval = krb5_decode_kdc_rep(context, &tgsrep.response, - subkey, &dec_rep))) - goto error_4; + /* Unfortunately, Heimdal at least up through 1.2 encrypts using + the session key not the subsession key. So we try both. */ + if ((retval = krb5int_decode_tgs_rep(context, &tgsrep.response, + subkey, + KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY, &dec_rep))) { + if ((krb5int_decode_tgs_rep(context, &tgsrep.response, + &tkt->keyblock, + KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY, &dec_rep)) == 0) + retval = 0; + else goto error_4; + } if (dec_rep->msg_type != KRB5_TGS_REP) { retval = KRB5KRB_AP_ERR_MSG_TYPE; diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports index 45e5002f0..bd50fddb5 100644 --- a/src/lib/krb5/libkrb5.exports +++ b/src/lib/krb5/libkrb5.exports @@ -185,7 +185,6 @@ krb5_copy_ticket krb5_create_secure_file krb5_crypto_us_timeofday krb5_decode_authdata_container -krb5_decode_kdc_rep krb5_decode_ticket krb5_decrypt_tkt_part krb5_default_pwd_prompt1 -- 2.26.2