krb5 commit: Check timestamp in PKINIT kdcpreauth module

[Greg Hudson]

https://github.com/krb5/krb5/commit/54984d618e01027abe73e6772fe7049c79938518
commit 54984d618e01027abe73e6772fe7049c79938518
Author: Thomas Calderon <thomas.calderon at ssi.gouv.fr>
Date:   Fri Feb 6 15:55:34 2015 +0100

    Check timestamp in PKINIT kdcpreauth module
    
    RFC 4556 requires the KDC to check the PKAuthenticator timestamp in
    order to prevent replays after the five-minute clock skew window.  (A
    replay attack has minimal value; it only causes the KDC to issue a
    ticket which an attacker cannot decrypt.)
    
    [ghudson at mit.edu: rewrote commit message; squashed with typo fix;
    style fixes]
    
    ticket: 8123 (new)

 src/plugins/preauth/pkinit/pkinit_srv.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
index 5639fca..b472741 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -429,6 +429,11 @@ pkinit_server_verify_padata(krb5_context context,
             goto cleanup;
         }
 
+        retval = krb5_check_clockskew(context,
+                                      auth_pack->pkAuthenticator.ctime);
+        if (retval)
+            goto cleanup;
+
         /* check dh parameters */
         if (auth_pack->clientPublicValue != NULL) {
             retval = server_check_dh(context, plgctx->cryptoctx,