svn rev #24406: trunk/src/ kdc/ lib/apputils/ lib/krb5/error_tables/

[hartmans@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24406
Commit By: hartmans
Log Message:
kdc: add KRB5KDC_ERR_DISCARD

Add an error to be returned by a preauth mechanism indicating that the KDC should not respond to a packet.

* Do not generate an error response in this case
* Drop a TCP connection if we are not going to respond to it.


Changed Files:
U   trunk/src/kdc/do_as_req.c
U   trunk/src/kdc/kdc_preauth.c
U   trunk/src/lib/apputils/net-server.c
U   trunk/src/lib/krb5/error_tables/k5e1_err.et
Modified: trunk/src/kdc/do_as_req.c
===================================================================
--- trunk/src/kdc/do_as_req.c	2010-10-01 17:12:37 UTC (rev 24405)
+++ trunk/src/kdc/do_as_req.c	2010-10-01 17:12:41 UTC (rev 24406)
@@ -633,6 +633,8 @@
         if (status == 0) {
             status = emsg;
         }
+        if (errcode == KRB5KDC_ERR_DISCARD)
+            goto discard;
         errcode -= ERROR_TABLE_BASE_krb5;
         if (errcode < 0 || errcode > 128)
             errcode = KRB_ERR_GENERIC;
@@ -643,7 +645,7 @@
         status = 0;
     }
 
-    if (emsg)
+discard: if (emsg)
         krb5_free_error_message(kdc_context, emsg);
     if (enc_tkt_reply.authorization_data != NULL)
         krb5_free_authdata(kdc_context, enc_tkt_reply.authorization_data);

Modified: trunk/src/kdc/kdc_preauth.c
===================================================================
--- trunk/src/kdc/kdc_preauth.c	2010-10-01 17:12:37 UTC (rev 24405)
+++ trunk/src/kdc/kdc_preauth.c	2010-10-01 17:12:41 UTC (rev 24406)
@@ -1202,6 +1202,7 @@
     case KRB5KDC_ERR_REVOCATION_STATUS_UNAVAILABLE:
         /* This value is shared with KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED. */
         /* case KRB5KDC_ERR_KEY_TOO_WEAK: */
+    case KRB5KDC_ERR_DISCARD:
         return retval;
     default:
         return KRB5KDC_ERR_PREAUTH_FAILED;

Modified: trunk/src/lib/apputils/net-server.c
===================================================================
--- trunk/src/lib/apputils/net-server.c	2010-10-01 17:12:37 UTC (rev 24405)
+++ trunk/src/lib/apputils/net-server.c	2010-10-01 17:12:41 UTC (rev 24406)
@@ -1759,6 +1759,8 @@
                 com_err(prog, err, "while dispatching (tcp)");
                 goto kill_tcp_connection;
             }
+            if (conn->u.tcp.response == NULL)
+                goto kill_tcp_connection;
         have_response:
             queue_tcp_outgoing_response(conn);
             FD_CLR(conn->fd, &sstate.rfds);

Modified: trunk/src/lib/krb5/error_tables/k5e1_err.et
===================================================================
--- trunk/src/lib/krb5/error_tables/k5e1_err.et	2010-10-01 17:12:37 UTC (rev 24405)
+++ trunk/src/lib/krb5/error_tables/k5e1_err.et	2010-10-01 17:12:41 UTC (rev 24406)
@@ -33,5 +33,5 @@
 error_code KRB5_PLUGIN_VER_NOTSUPP, "Plugin does not support interface version"
 error_code KRB5_PLUGIN_BAD_MODULE_SPEC, "Invalid module specifier"
 error_code KRB5_PLUGIN_NAME_NOTFOUND, "Plugin module name not found"
-
+error_code KRB5KDC_ERR_DISCARD, "The KDC should discard this request"
 end