svn rev #22154: trunk/ doc/ src/config-files/ src/lib/krb5/krb/

[hartmans@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=22154
Commit By: hartmans
Log Message:
ticket: 1624
Target_version: 1.7
tags: pullup

Use the preferred checksum for non-DES keys in the kdc_req path and
all the time in the ap_req checksum path.  This breaks code to support
DCE versions prior to 1.1 but uses the correct checksum for protocol
compatibility.


Changed Files:
U   trunk/doc/admin.texinfo
U   trunk/src/config-files/krb5.conf.M
U   trunk/src/lib/krb5/krb/mk_req_ext.c
U   trunk/src/lib/krb5/krb/send_tgs.c
Modified: trunk/doc/admin.texinfo
===================================================================
--- trunk/doc/admin.texinfo	2009-03-31 23:51:48 UTC (rev 22153)
+++ trunk/doc/admin.texinfo	2009-04-01 18:25:02 UTC (rev 22154)
@@ -462,7 +462,8 @@
 An integer which specifies the type of checksum to use.  Used for
 compatability with DCE security servers which do not support the
 default @value{DefaultChecksumType} used by this version of Kerberos.
-The possible values and their meanings are as follows.
+Note that the ap_req_checksum_type variable's value is ignored.  The
+kdc_req_checksum_type is only used for DES keys.   The possible values and their meanings are as follows.
 
 @comment taken from krb5/src/include/krb5.h[in]
 @table @b

Modified: trunk/src/config-files/krb5.conf.M
===================================================================
--- trunk/src/config-files/krb5.conf.M	2009-03-31 23:51:48 UTC (rev 22153)
+++ trunk/src/config-files/krb5.conf.M	2009-04-01 18:25:02 UTC (rev 22154)
@@ -143,15 +143,11 @@
 For compatability with DCE security servers which do not support the
 default CKSUMTYPE_RSA_MD5 used by this version of Kerberos. Use a value
 of 2 to use the CKSUMTYPE_RSA_MD4 instead. This applies to DCE 1.1 and
-earlier.
+earlier.  This value is only used for DES keys; other keys use the
+preferred checksum type for those keys.
 
 .IP ap_req_checksum_type 
-This allows you to set the checksum type used in the authenticator of
-KRB_AP_REQ messages.  The default value for this type is
-CKSUMTYPE_RSA_MD5.  For compatibility with applications linked against
-DCE version 1.1 or earlier Kerberos libraries, use a value of 2 to use
-the CKSUMTYPE_RSA_MD4
-instead.
+This obsolete variable is not used.
 
 .IP safe_checksum_type 
 This allows you to set the preferred keyed-checksum type for use in KRB_SAFE

Modified: trunk/src/lib/krb5/krb/mk_req_ext.c
===================================================================
--- trunk/src/lib/krb5/krb/mk_req_ext.c	2009-03-31 23:51:48 UTC (rev 22153)
+++ trunk/src/lib/krb5/krb/mk_req_ext.c	2009-04-01 18:25:02 UTC (rev 22154)
@@ -205,8 +205,13 @@
 	    checksum.length = in_data->length;
 	    checksum.contents = (krb5_octet *) in_data->data;
 	} else {
+	    krb5_cksumtype cksumtype;
+	    retval = krb5int_c_mandatory_cksumtype(context, (*auth_context)->keyblock->enctype,
+						   &cksumtype);
+	    if (retval)
+		goto cleanup_cksum;
 	    if ((retval = krb5_c_make_checksum(context, 
-					       (*auth_context)->req_cksumtype,
+					       cksumtype,
 					       (*auth_context)->keyblock,
 					       KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM,
 					       in_data, &checksum)))

Modified: trunk/src/lib/krb5/krb/send_tgs.c
===================================================================
--- trunk/src/lib/krb5/krb/send_tgs.c	2009-03-31 23:51:48 UTC (rev 22153)
+++ trunk/src/lib/krb5/krb/send_tgs.c	2009-04-01 18:25:02 UTC (rev 22154)
@@ -51,6 +51,7 @@
 tgs_construct_tgsreq(krb5_context context, krb5_data *in_data,
             krb5_creds *in_cred, krb5_data *outbuf, krb5_keyblock *subkey)
 {   
+    krb5_cksumtype cksumtype;
     krb5_error_code       retval;
     krb5_checksum         checksum;
     krb5_authenticator    authent;
@@ -63,9 +64,20 @@
     request.authenticator.kvno = 0;
     request.ap_options = 0;
     request.ticket = 0;
-
+    switch (in_cred->keyblock.enctype) {
+    case ENCTYPE_DES_CBC_CRC:
+    case ENCTYPE_DES_CBC_MD4:
+    case ENCTYPE_DES_CBC_MD5:
+	cksumtype = context->kdc_req_sumtype;
+	break;
+    default:
+	retval = krb5int_c_mandatory_cksumtype(context, in_cred->keyblock.enctype, &cksumtype);
+	if (retval)
+	    goto cleanup;
+    }
+    
     /* Generate checksum */
-    if ((retval = krb5_c_make_checksum(context, context->kdc_req_sumtype,
+    if ((retval = krb5_c_make_checksum(context, cksumtype,
                        &in_cred->keyblock,
                        KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM,
                        in_data, &checksum))) {