svn rev #24946: trunk/src/lib/krb5/krb/

[ghudson@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24946
Commit By: ghudson
Log Message:
ticket: 6917
subject: Restore fallback non-referral TGS request to same realm
target_version: 1.9.2
tags: pullup

MIT krb5 1.2 and earlier KDCs reject TGS requests if the canonicalize
bit is set.  Prior to 1.9, we used to handle this by making a
non-referral fallback request on any error, but the rewrite in 1.9
mistakenly changed the behavior so that fallback requests are only
made if the original request used the referral realm and the fallback
realm is different from the default realm.  Restore the old behavior.


Changed Files:
U   trunk/src/lib/krb5/krb/get_creds.c
Modified: trunk/src/lib/krb5/krb/get_creds.c
===================================================================
--- trunk/src/lib/krb5/krb/get_creds.c	2011-05-26 18:05:49 UTC (rev 24945)
+++ trunk/src/lib/krb5/krb/get_creds.c	2011-06-03 01:00:52 UTC (rev 24946)
@@ -466,13 +466,10 @@
 
 /***** STATE_REFERRALS *****/
 
-/*
- * Possibly retry a request in the fallback realm after a referral request
- * failure in the local realm.  Expects ctx->reply_code to be set to the error
- * from a referral request.
- */
+/* Possibly try a non-referral request after a referral request failure.
+ * Expects ctx->reply_code to be set to the error from a referral request. */
 static krb5_error_code
-try_fallback_realm(krb5_context context, krb5_tkt_creds_context ctx)
+try_fallback(krb5_context context, krb5_tkt_creds_context ctx)
 {
     krb5_error_code code;
     char **hrealms;
@@ -481,9 +478,10 @@
     if (ctx->referral_count > 1)
         return ctx->reply_code;
 
-    /* Only fall back if the original request used the referral realm. */
+    /* If the request used a specified realm, make a non-referral request to
+     * that realm (in case it's a KDC which rejects KDC_OPT_CANONICALIZE). */
     if (!krb5_is_referral_realm(&ctx->req_server->realm))
-        return ctx->reply_code;
+        return begin_non_referral(context, ctx);
 
     if (ctx->server->length < 2) {
         /* We need a type/host format principal to find a fallback realm. */
@@ -496,10 +494,10 @@
     if (code != 0)
         return code;
 
-    /* Give up if the fallback realm isn't any different. */
+    /* If the fallback realm isn't any different, use the existing TGT. */
     if (data_eq_string(ctx->server->realm, hrealms[0])) {
         krb5_free_host_realm(context, hrealms);
-        return ctx->reply_code;
+        return begin_non_referral(context, ctx);
     }
 
     /* Rewrite server->realm to be the fallback realm. */
@@ -536,9 +534,9 @@
     krb5_error_code code;
     const krb5_data *referral_realm;
 
-    /* Possibly retry with the fallback realm on error. */
+    /* Possibly try a non-referral fallback request on error. */
     if (ctx->reply_code != 0)
-        return try_fallback_realm(context, ctx);
+        return try_fallback(context, ctx);
 
     if (krb5_principal_compare(context, ctx->reply_creds->server,
                                ctx->server)) {