svn rev #23708: branches/krb5-1-8/src/kdc/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=23708
Commit By: tlyu
Log Message:
ticket: 6655
version_fixed: 1.8
status: resolved

pull up r23697 from trunk

 ------------------------------------------------------------------------
 r23697 | ghudson | 2010-02-04 22:43:54 -0500 (Thu, 04 Feb 2010) | 12 lines

 ticket: 6655
 subject: Fix cross-realm handling of AD-SIGNEDPATH
 target_version: 1.8
 tags: pullup

 Avoid setting AD-SIGNEDPATH when returning a cross-realm TGT.
 Previously we were avoiding it when answering a cross-realm client,
 which was wrong.

 Don't fail out on an invalid AD-SIGNEDPATH checksum; just don't trust
 the ticket for S4U2Proxy (as if AD-SIGNEDPATH weren't present).


Changed Files:
U   branches/krb5-1-8/src/kdc/kdc_authdata.c
U   branches/krb5-1-8/src/kdc/kdc_util.c
U   branches/krb5-1-8/src/kdc/kdc_util.h
Modified: branches/krb5-1-8/src/kdc/kdc_authdata.c
===================================================================
--- branches/krb5-1-8/src/kdc/kdc_authdata.c	2010-02-08 20:55:39 UTC (rev 23707)
+++ branches/krb5-1-8/src/kdc/kdc_authdata.c	2010-02-08 20:55:43 UTC (rev 23708)
@@ -897,10 +897,6 @@
                                   valid);
 
     krb5_free_data(context, data);
-
-    if (code == 0 && *valid == FALSE)
-        code = KRB5KRB_AP_ERR_MODIFIED;
-
     return code;
 }
 
@@ -952,8 +948,10 @@
     if (code != 0)
         goto cleanup;
 
-    *pdelegated = sp->delegated;
-    sp->delegated = NULL;
+    if (*path_is_signed) {
+        *pdelegated = sp->delegated;
+        sp->delegated = NULL;
+    }
 
 cleanup:
     krb5_free_ad_signedpath(context, sp);
@@ -1179,7 +1177,9 @@
         }
     }
 
-    if (!isflagset(flags, KRB5_KDB_FLAG_CROSS_REALM) &&
+    /* No point in including signedpath authdata for a cross-realm TGT, since
+     * it will be presented to a different KDC. */
+    if (!is_cross_tgs_principal(server->princ) &&
         !only_pac_p(context, enc_tkt_reply->authorization_data)) {
         code = make_ad_signedpath(context,
                                   for_user_princ,

Modified: branches/krb5-1-8/src/kdc/kdc_util.c
===================================================================
--- branches/krb5-1-8/src/kdc/kdc_util.c	2010-02-08 20:55:39 UTC (rev 23707)
+++ branches/krb5-1-8/src/kdc/kdc_util.c	2010-02-08 20:55:43 UTC (rev 23708)
@@ -192,6 +192,17 @@
     return FALSE;
 }
 
+/* Returns TRUE if principal is the name of a cross-realm TGS. */
+krb5_boolean
+is_cross_tgs_principal(krb5_const_principal principal)
+{
+    return (krb5_princ_size(kdc_context, principal) >= 2 &&
+            data_eq_string(*krb5_princ_component(kdc_context, principal, 0),
+                           KRB5_TGS_NAME) &&
+            !data_eq(*krb5_princ_component(kdc_context, principal, 1),
+                     *krb5_princ_realm(kcd_context, principal)));
+}
+
 /*
  * given authentication data (provides seed for checksum), verify checksum
  * for source data.

Modified: branches/krb5-1-8/src/kdc/kdc_util.h
===================================================================
--- branches/krb5-1-8/src/kdc/kdc_util.h	2010-02-08 20:55:39 UTC (rev 23707)
+++ branches/krb5-1-8/src/kdc/kdc_util.h	2010-02-08 20:55:43 UTC (rev 23708)
@@ -42,6 +42,7 @@
 krb5_boolean realm_compare (krb5_const_principal, krb5_const_principal);
 krb5_boolean is_local_principal(krb5_const_principal princ1);
 krb5_boolean krb5_is_tgs_principal (krb5_const_principal);
+krb5_boolean is_cross_tgs_principal(krb5_const_principal);
 krb5_error_code
 add_to_transited (krb5_data *,
                   krb5_data *,