2020-07-31 17:31:53 +00:00
|
|
|
From 5037c0fe698ad00a8e8f53fdcfc3d3b1c3537aba Mon Sep 17 00:00:00 2001
|
2020-06-15 20:57:30 +00:00
|
|
|
From: Alexander Scheel <ascheel@redhat.com>
|
|
|
|
Date: Fri, 30 Jun 2017 16:03:01 -0400
|
|
|
|
Subject: [PATCH] Refactor krb5 GSS checksum handling
|
|
|
|
|
|
|
|
Separate out checksum handling from kg_accept_krb5() into a new helper
|
|
|
|
process_checksum().
|
|
|
|
|
|
|
|
[ghudson@mit.edu: simplified checksum processing and made it use
|
|
|
|
k5-input.h instead of TREAD_ macros; moved more flag handling into
|
|
|
|
helper]
|
|
|
|
|
|
|
|
[iboukris: adjusted helper function arguments, allowing access to the
|
|
|
|
full authenticator for subsequent changes]
|
|
|
|
|
|
|
|
(cherry picked from commit 64d56233f9816a2a93f6e8d3030c8ed6ce397735)
|
|
|
|
[rharwood@redhat.com: problem with typo fix commit, I think]
|
|
|
|
---
|
|
|
|
src/lib/gssapi/krb5/accept_sec_context.c | 383 +++++++++++------------
|
|
|
|
1 file changed, 179 insertions(+), 204 deletions(-)
|
|
|
|
|
|
|
|
diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
|
|
|
|
index c5bddb1e8..70dd7fc0c 100644
|
|
|
|
--- a/src/lib/gssapi/krb5/accept_sec_context.c
|
|
|
|
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
|
|
|
|
@@ -98,6 +98,7 @@
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "k5-int.h"
|
|
|
|
+#include "k5-input.h"
|
|
|
|
#include "gssapiP_krb5.h"
|
|
|
|
#ifdef HAVE_MEMORY_H
|
|
|
|
#include <memory.h>
|
|
|
|
@@ -413,6 +414,174 @@ kg_process_extension(krb5_context context,
|
|
|
|
return code;
|
|
|
|
}
|
|
|
|
|
|
|
|
+/* The length of the MD5 channel bindings in an 0x8003 checksum */
|
|
|
|
+#define CB_MD5_LEN 16
|
|
|
|
+
|
|
|
|
+/* The minimum length of an 0x8003 checksum value (4-byte channel bindings
|
|
|
|
+ * length, 16-byte channel bindings, 4-byte flags) */
|
|
|
|
+#define MIN_8003_LEN (4 + CB_MD5_LEN + 4)
|
|
|
|
+
|
|
|
|
+/* The flags we accept from the initiator's authenticator checksum. */
|
|
|
|
+#define INITIATOR_FLAGS (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG | \
|
|
|
|
+ GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | \
|
|
|
|
+ GSS_C_SEQUENCE_FLAG | GSS_C_DCE_STYLE | \
|
|
|
|
+ GSS_C_IDENTIFY_FLAG | GSS_C_EXTENDED_ERROR_FLAG)
|
|
|
|
+
|
|
|
|
+/*
|
|
|
|
+ * The krb5 GSS mech appropriates the authenticator checksum field from RFC
|
|
|
|
+ * 4120 to store structured data instead of a checksum, indicated with checksum
|
|
|
|
+ * type 0x8003 (see RFC 4121 section 4.1.1). Some implementations instead send
|
|
|
|
+ * no checksum, or a regular checksum over empty data.
|
|
|
|
+ *
|
|
|
|
+ * Interpret the checksum. Read delegated creds into *deleg_out if it is not
|
|
|
|
+ * NULL. Set *flags_out to the allowed subset of token flags, plus
|
|
|
|
+ * GSS_C_DELEG_FLAG if a delegated credential was present. Process any
|
|
|
|
+ * extensions found using exts. On error, set *code_out to a krb5_error code
|
|
|
|
+ * for use as a minor status value.
|
|
|
|
+ */
|
|
|
|
+static OM_uint32
|
|
|
|
+process_checksum(OM_uint32 *minor_status, krb5_context context,
|
|
|
|
+ gss_channel_bindings_t acceptor_cb,
|
|
|
|
+ krb5_auth_context auth_context, krb5_flags ap_req_options,
|
|
|
|
+ krb5_authenticator *authenticator, krb5_gss_ctx_ext_t exts,
|
|
|
|
+ krb5_gss_cred_id_t *deleg_out, krb5_ui_4 *flags_out,
|
|
|
|
+ krb5_error_code *code_out)
|
|
|
|
+{
|
|
|
|
+ krb5_error_code code = 0;
|
|
|
|
+ OM_uint32 status, option_id, token_flags;
|
|
|
|
+ size_t cb_len, option_len;
|
|
|
|
+ krb5_boolean valid;
|
|
|
|
+ krb5_key subkey;
|
|
|
|
+ krb5_data option, empty = empty_data();
|
|
|
|
+ krb5_checksum cb_cksum;
|
|
|
|
+ const uint8_t *token_cb, *option_bytes;
|
|
|
|
+ struct k5input in;
|
|
|
|
+ const krb5_checksum *cksum = authenticator->checksum;
|
|
|
|
+
|
|
|
|
+ cb_cksum.contents = NULL;
|
|
|
|
+
|
|
|
|
+ if (cksum == NULL) {
|
|
|
|
+ /*
|
|
|
|
+ * Some SMB client implementations use handcrafted GSSAPI code that
|
|
|
|
+ * does not provide a checksum. MS-KILE documents that the Microsoft
|
|
|
|
+ * implementation considers a missing checksum acceptable; the server
|
|
|
|
+ * assumes all flags are unset in this case, and does not check channel
|
|
|
|
+ * bindings.
|
|
|
|
+ */
|
|
|
|
+ *flags_out = 0;
|
|
|
|
+ } else if (cksum->checksum_type != CKSUMTYPE_KG_CB) {
|
|
|
|
+ /* Samba sends a regular checksum. */
|
|
|
|
+ code = krb5_auth_con_getkey_k(context, auth_context, &subkey);
|
|
|
|
+ if (code) {
|
|
|
|
+ status = GSS_S_FAILURE;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ /* Verifying the checksum ensures that this authenticator wasn't
|
|
|
|
+ * replayed from one with a checksum over actual data. */
|
|
|
|
+ code = krb5_k_verify_checksum(context, subkey,
|
|
|
|
+ KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM, &empty,
|
|
|
|
+ cksum, &valid);
|
|
|
|
+ krb5_k_free_key(context, subkey);
|
|
|
|
+ if (code || !valid) {
|
|
|
|
+ status = GSS_S_BAD_SIG;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ /* Use ap_options from the request to guess the mutual flag. */
|
|
|
|
+ *flags_out = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG;
|
|
|
|
+ if (ap_req_options & AP_OPTS_MUTUAL_REQUIRED)
|
|
|
|
+ *flags_out |= GSS_C_MUTUAL_FLAG;
|
|
|
|
+ } else {
|
|
|
|
+ /* The checksum must contain at least a fixed 24-byte part. */
|
|
|
|
+ if (cksum->length < MIN_8003_LEN) {
|
|
|
|
+ status = GSS_S_BAD_BINDINGS;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ k5_input_init(&in, cksum->contents, cksum->length);
|
|
|
|
+ cb_len = k5_input_get_uint32_le(&in);
|
|
|
|
+ if (cb_len != CB_MD5_LEN) {
|
|
|
|
+ code = KG_BAD_LENGTH;
|
|
|
|
+ status = GSS_S_FAILURE;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ token_cb = k5_input_get_bytes(&in, cb_len);
|
|
|
|
+ if (acceptor_cb != GSS_C_NO_CHANNEL_BINDINGS) {
|
|
|
|
+ code = kg_checksum_channel_bindings(context, acceptor_cb,
|
|
|
|
+ &cb_cksum);
|
|
|
|
+ if (code) {
|
|
|
|
+ status = GSS_S_BAD_BINDINGS;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+ assert(cb_cksum.length == cb_len);
|
|
|
|
+ if (k5_bcmp(token_cb, cb_cksum.contents, cb_len) != 0) {
|
|
|
|
+ status = GSS_S_BAD_BINDINGS;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ /* Read the token flags and accept some of them as context flags. */
|
|
|
|
+ token_flags = k5_input_get_uint32_le(&in);
|
|
|
|
+ *flags_out = token_flags & INITIATOR_FLAGS;
|
|
|
|
+
|
|
|
|
+ /* Read the delegated credential if present. */
|
|
|
|
+ if (in.len >= 4 && (token_flags & GSS_C_DELEG_FLAG)) {
|
|
|
|
+ option_id = k5_input_get_uint16_le(&in);
|
|
|
|
+ option_len = k5_input_get_uint16_le(&in);
|
|
|
|
+ option_bytes = k5_input_get_bytes(&in, option_len);
|
|
|
|
+ option = make_data((uint8_t *)option_bytes, option_len);
|
|
|
|
+ if (in.status) {
|
|
|
|
+ code = KG_BAD_LENGTH;
|
|
|
|
+ status = GSS_S_FAILURE;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+ if (option_id != KRB5_GSS_FOR_CREDS_OPTION) {
|
|
|
|
+ status = GSS_S_FAILURE;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ /* Store the delegated credential. */
|
|
|
|
+ code = rd_and_store_for_creds(context, auth_context, &option,
|
|
|
|
+ deleg_out);
|
|
|
|
+ if (code) {
|
|
|
|
+ status = GSS_S_FAILURE;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+ *flags_out |= GSS_C_DELEG_FLAG;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ /* Process any extensions at the end of the checksum. Extensions use
|
|
|
|
+ * 4-byte big-endian tag and length instead of 2-byte little-endian. */
|
|
|
|
+ while (in.len > 0) {
|
|
|
|
+ option_id = k5_input_get_uint32_be(&in);
|
|
|
|
+ option_len = k5_input_get_uint32_be(&in);
|
|
|
|
+ option_bytes = k5_input_get_bytes(&in, option_len);
|
|
|
|
+ option = make_data((uint8_t *)option_bytes, option_len);
|
|
|
|
+ if (in.status) {
|
|
|
|
+ code = KG_BAD_LENGTH;
|
|
|
|
+ status = GSS_S_FAILURE;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ code = kg_process_extension(context, auth_context, option_id,
|
|
|
|
+ &option, exts);
|
|
|
|
+ if (code) {
|
|
|
|
+ status = GSS_S_FAILURE;
|
|
|
|
+ goto fail;
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ status = GSS_S_COMPLETE;
|
|
|
|
+
|
|
|
|
+fail:
|
|
|
|
+ free(cb_cksum.contents);
|
|
|
|
+ *code_out = code;
|
|
|
|
+ return status;
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
static OM_uint32
|
|
|
|
kg_accept_krb5(minor_status, context_handle,
|
|
|
|
verifier_cred_handle, input_token,
|
|
|
|
@@ -433,17 +602,13 @@ kg_accept_krb5(minor_status, context_handle,
|
|
|
|
krb5_gss_ctx_ext_t exts;
|
|
|
|
{
|
|
|
|
krb5_context context;
|
|
|
|
- unsigned char *ptr, *ptr2;
|
|
|
|
+ unsigned char *ptr;
|
|
|
|
char *sptr;
|
|
|
|
- OM_uint32 tmp;
|
|
|
|
- size_t md5len;
|
|
|
|
krb5_gss_cred_id_t cred = 0;
|
|
|
|
krb5_data ap_rep, ap_req;
|
|
|
|
- unsigned int i;
|
|
|
|
krb5_error_code code;
|
|
|
|
krb5_address addr, *paddr;
|
|
|
|
krb5_authenticator *authdat = 0;
|
|
|
|
- krb5_checksum reqcksum;
|
|
|
|
krb5_gss_name_t name = NULL;
|
|
|
|
krb5_ui_4 gss_flags = 0;
|
|
|
|
krb5_gss_ctx_id_rec *ctx = NULL;
|
|
|
|
@@ -451,8 +616,6 @@ kg_accept_krb5(minor_status, context_handle,
|
|
|
|
gss_buffer_desc token;
|
|
|
|
krb5_auth_context auth_context = NULL;
|
|
|
|
krb5_ticket * ticket = NULL;
|
|
|
|
- int option_id;
|
|
|
|
- krb5_data option;
|
|
|
|
const gss_OID_desc *mech_used = NULL;
|
|
|
|
OM_uint32 major_status = GSS_S_FAILURE;
|
|
|
|
OM_uint32 tmp_minor_status;
|
|
|
|
@@ -463,7 +626,6 @@ kg_accept_krb5(minor_status, context_handle,
|
|
|
|
krb5int_access kaccess;
|
|
|
|
int cred_rcache = 0;
|
|
|
|
int no_encap = 0;
|
|
|
|
- int token_deleg_flag = 0;
|
|
|
|
krb5_flags ap_req_options = 0;
|
|
|
|
krb5_enctype negotiated_etype;
|
|
|
|
krb5_authdata_context ad_context = NULL;
|
|
|
|
@@ -489,7 +651,6 @@ kg_accept_krb5(minor_status, context_handle,
|
|
|
|
output_token->length = 0;
|
|
|
|
output_token->value = NULL;
|
|
|
|
token.value = 0;
|
|
|
|
- reqcksum.contents = 0;
|
|
|
|
ap_req.data = 0;
|
|
|
|
ap_rep.data = 0;
|
|
|
|
|
|
|
|
@@ -654,195 +815,16 @@ kg_accept_krb5(minor_status, context_handle,
|
|
|
|
|
|
|
|
krb5_auth_con_getauthenticator(context, auth_context, &authdat);
|
|
|
|
|
|
|
|
- if (authdat->checksum == NULL) {
|
|
|
|
- /*
|
|
|
|
- * Some SMB client implementations use handcrafted GSSAPI code that
|
|
|
|
- * does not provide a checksum. MS-KILE documents that the Microsoft
|
|
|
|
- * implementation considers a missing checksum acceptable; the server
|
|
|
|
- * assumes all flags are unset in this case, and does not check channel
|
|
|
|
- * bindings.
|
|
|
|
- */
|
|
|
|
- gss_flags = 0;
|
|
|
|
- } else if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) {
|
|
|
|
- /* Samba does not send 0x8003 GSS-API checksums */
|
|
|
|
- krb5_boolean valid;
|
|
|
|
- krb5_key subkey;
|
|
|
|
- krb5_data zero;
|
|
|
|
+ major_status = process_checksum(minor_status, context, input_chan_bindings,
|
|
|
|
+ auth_context, ap_req_options,
|
|
|
|
+ authdat, exts,
|
|
|
|
+ delegated_cred_handle ? &deleg_cred : NULL,
|
|
|
|
+ &gss_flags, &code);
|
|
|
|
|
|
|
|
- code = krb5_auth_con_getkey_k(context, auth_context, &subkey);
|
|
|
|
- if (code) {
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
+ if (major_status != GSS_S_COMPLETE)
|
|
|
|
+ goto fail;
|
|
|
|
|
|
|
|
- zero.length = 0;
|
|
|
|
- zero.data = "";
|
|
|
|
-
|
|
|
|
- code = krb5_k_verify_checksum(context,
|
|
|
|
- subkey,
|
|
|
|
- KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM,
|
|
|
|
- &zero,
|
|
|
|
- authdat->checksum,
|
|
|
|
- &valid);
|
|
|
|
- krb5_k_free_key(context, subkey);
|
|
|
|
- if (code || !valid) {
|
|
|
|
- major_status = GSS_S_BAD_SIG;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- /* Use ap_options from the request to guess the mutual flag. */
|
|
|
|
- gss_flags = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG;
|
|
|
|
- if (ap_req_options & AP_OPTS_MUTUAL_REQUIRED)
|
|
|
|
- gss_flags |= GSS_C_MUTUAL_FLAG;
|
|
|
|
- } else {
|
|
|
|
- /* gss krb5 v1 */
|
|
|
|
-
|
|
|
|
- /* stash this now, for later. */
|
|
|
|
- code = krb5_c_checksum_length(context, CKSUMTYPE_RSA_MD5, &md5len);
|
|
|
|
- if (code) {
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- /* verify that the checksum is correct */
|
|
|
|
-
|
|
|
|
- /*
|
|
|
|
- The checksum may be either exactly 24 bytes, in which case
|
|
|
|
- no options are specified, or greater than 24 bytes, in which case
|
|
|
|
- one or more options are specified. Currently, the only valid
|
|
|
|
- option is KRB5_GSS_FOR_CREDS_OPTION ( = 1 ).
|
|
|
|
- */
|
|
|
|
-
|
|
|
|
- if ((authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) ||
|
|
|
|
- (authdat->checksum->length < 24)) {
|
|
|
|
- code = 0;
|
|
|
|
- major_status = GSS_S_BAD_BINDINGS;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- ptr = (unsigned char *) authdat->checksum->contents;
|
|
|
|
-
|
|
|
|
- TREAD_INT(ptr, tmp, 0);
|
|
|
|
-
|
|
|
|
- if (tmp != md5len) {
|
|
|
|
- code = KG_BAD_LENGTH;
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- /*
|
|
|
|
- The following section of code attempts to implement the
|
|
|
|
- optional channel binding facility as described in RFC2743.
|
|
|
|
-
|
|
|
|
- Since this facility is optional channel binding may or may
|
|
|
|
- not have been provided by either the client or the server.
|
|
|
|
-
|
|
|
|
- If the server has specified input_chan_bindings equal to
|
|
|
|
- GSS_C_NO_CHANNEL_BINDINGS then we skip the check. If
|
|
|
|
- the server does provide channel bindings then we compute
|
|
|
|
- a checksum and compare against those provided by the
|
|
|
|
- client. */
|
|
|
|
-
|
|
|
|
- if ((code = kg_checksum_channel_bindings(context,
|
|
|
|
- input_chan_bindings,
|
|
|
|
- &reqcksum))) {
|
|
|
|
- major_status = GSS_S_BAD_BINDINGS;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- /* Always read the clients bindings - eventhough we might ignore them */
|
|
|
|
- TREAD_STR(ptr, ptr2, reqcksum.length);
|
|
|
|
-
|
|
|
|
- if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS ) {
|
|
|
|
- if (memcmp(ptr2, reqcksum.contents, reqcksum.length) != 0) {
|
|
|
|
- xfree(reqcksum.contents);
|
|
|
|
- reqcksum.contents = 0;
|
|
|
|
- code = 0;
|
|
|
|
- major_status = GSS_S_BAD_BINDINGS;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- xfree(reqcksum.contents);
|
|
|
|
- reqcksum.contents = 0;
|
|
|
|
-
|
|
|
|
- /* Read the token flags. Remember if GSS_C_DELEG_FLAG was set, but
|
|
|
|
- * mask it out until we actually read a delegated credential. */
|
|
|
|
- TREAD_INT(ptr, gss_flags, 0);
|
|
|
|
- token_deleg_flag = (gss_flags & GSS_C_DELEG_FLAG);
|
|
|
|
- gss_flags &= ~GSS_C_DELEG_FLAG;
|
|
|
|
-
|
|
|
|
- /* if the checksum length > 24, there are options to process */
|
|
|
|
-
|
|
|
|
- i = authdat->checksum->length - 24;
|
|
|
|
- if (i && token_deleg_flag) {
|
|
|
|
- if (i >= 4) {
|
|
|
|
- TREAD_INT16(ptr, option_id, 0);
|
|
|
|
- TREAD_INT16(ptr, option.length, 0);
|
|
|
|
- i -= 4;
|
|
|
|
-
|
|
|
|
- if (i < option.length) {
|
|
|
|
- code = KG_BAD_LENGTH;
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- /* have to use ptr2, since option.data is wrong type and
|
|
|
|
- macro uses ptr as both lvalue and rvalue */
|
|
|
|
-
|
|
|
|
- TREAD_STR(ptr, ptr2, option.length);
|
|
|
|
- option.data = (char *) ptr2;
|
|
|
|
-
|
|
|
|
- i -= option.length;
|
|
|
|
-
|
|
|
|
- if (option_id != KRB5_GSS_FOR_CREDS_OPTION) {
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- /* store the delegated credential */
|
|
|
|
-
|
|
|
|
- code = rd_and_store_for_creds(context, auth_context, &option,
|
|
|
|
- (delegated_cred_handle) ?
|
|
|
|
- &deleg_cred : NULL);
|
|
|
|
- if (code) {
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
-
|
|
|
|
- gss_flags |= GSS_C_DELEG_FLAG;
|
|
|
|
- } /* if i >= 4 */
|
|
|
|
- /* ignore any additional trailing data, for now */
|
|
|
|
- }
|
|
|
|
- while (i > 0) {
|
|
|
|
- /* Process Type-Length-Data options */
|
|
|
|
- if (i < 8) {
|
|
|
|
- code = KG_BAD_LENGTH;
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
- TREAD_INT(ptr, option_id, 1);
|
|
|
|
- TREAD_INT(ptr, option.length, 1);
|
|
|
|
- i -= 8;
|
|
|
|
- if (i < option.length) {
|
|
|
|
- code = KG_BAD_LENGTH;
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
- TREAD_STR(ptr, ptr2, option.length);
|
|
|
|
- option.data = (char *)ptr2;
|
|
|
|
-
|
|
|
|
- i -= option.length;
|
|
|
|
-
|
|
|
|
- code = kg_process_extension(context, auth_context,
|
|
|
|
- option_id, &option, exts);
|
|
|
|
- if (code != 0) {
|
|
|
|
- major_status = GSS_S_FAILURE;
|
|
|
|
- goto fail;
|
|
|
|
- }
|
|
|
|
- }
|
|
|
|
- }
|
|
|
|
+ major_status = GSS_S_FAILURE;
|
|
|
|
|
|
|
|
if (exts->iakerb.conv && !exts->iakerb.verified) {
|
|
|
|
major_status = GSS_S_BAD_SIG;
|
|
|
|
@@ -869,12 +851,7 @@ kg_accept_krb5(minor_status, context_handle,
|
|
|
|
ctx->mech_used = (gss_OID) mech_used;
|
|
|
|
ctx->auth_context = auth_context;
|
|
|
|
ctx->initiate = 0;
|
|
|
|
- ctx->gss_flags = (GSS_C_TRANS_FLAG |
|
|
|
|
- ((gss_flags) & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG |
|
|
|
|
- GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG |
|
|
|
|
- GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_FLAG |
|
|
|
|
- GSS_C_DCE_STYLE | GSS_C_IDENTIFY_FLAG |
|
|
|
|
- GSS_C_EXTENDED_ERROR_FLAG)));
|
|
|
|
+ ctx->gss_flags = gss_flags | GSS_C_TRANS_FLAG;
|
|
|
|
ctx->seed_init = 0;
|
|
|
|
ctx->cred_rcache = cred_rcache;
|
|
|
|
|
|
|
|
@@ -1161,8 +1138,6 @@ fail:
|
|
|
|
|
|
|
|
krb5_auth_con_free(context, auth_context);
|
|
|
|
}
|
|
|
|
- if (reqcksum.contents)
|
|
|
|
- xfree(reqcksum.contents);
|
|
|
|
if (ap_rep.data)
|
|
|
|
krb5_free_data_contents(context, &ap_rep);
|
|
|
|
if (major_status == GSS_S_COMPLETE ||
|