krb5 commit: Issue an error from KDC on S4U2Self failures

[Greg Hudson]

https://github.com/krb5/krb5/commit/9544229ff3b6793cad39ce7d8dd2467ec2cf4f45
commit 9544229ff3b6793cad39ce7d8dd2467ec2cf4f45
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Oct 20 07:12:19 2021 +0200

    Issue an error from KDC on S4U2Self failures
    
    Commit 3b163eed1cf1f55dd4a7bc6d6fffc34f55695b00 mistakenly separated
    the call to kdc_process_s4u2self_req() from its error check, causing
    the KDC to ignore S4U2Self padata with bad checksums.  Restore the
    error check so that the KDC replies with an error as intended.
    
    [ghudson at mit.edu: removed old error check later on in the code;
    rewrote commit message]
    
    ticket: 9038 (new)

 src/kdc/do_tgs_req.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 32dc65f..45837fb 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -276,6 +276,8 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
         au_state->status = status;
         kau_s4u2self(kdc_context, errcode ? FALSE : TRUE, au_state);
         au_state->s4u2self_user = NULL;
+        if (errcode)
+            goto cleanup;
     }
 
     /* For user-to-user and S4U2Proxy requests, decrypt the second ticket. */
@@ -295,9 +297,6 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
         goto cleanup;
     }
 
-    if (errcode)
-        goto cleanup;
-
     if (s4u_x509_user != NULL && client == NULL) {
         /*
          * For an S4U2Self referral request (the requesting service is