enc_padata can include empty sequence

There are two issues with return_enc_padata.
1)  It often will return an empty sequence of enc_padata rather than not including the field
2) FAST negotiation is double supported in the referral tgs path and not supported in the non-referral path

Rewrite the return_enc_padata logic to:

* Split  out referral interactions with kdb into its own function
* Use add_pa_data_element

ticket: 6656
target_version: 1.8
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23712 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 7 insertions, 23 deletions

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 26fde1e0c9..52256e7bd8 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -948,31 +948,15 @@ tgt_again:
         status  = "generating reply key";
         goto cleanup;
     }
-    if (is_referral && isflagset(s_flags, KRB5_KDB_FLAG_CANONICALIZE)) {
-        int idx = 0;
-
-        errcode = return_enc_padata(kdc_context, pkt, request,
-                                    reply_key, &server, &reply_encpart);
-        if (errcode) {
-            status = "KDC_RETURN_ENC_PADATA";
-            goto cleanup;
-        }
-        /* Not referral. */
-        reply_encpart.enc_padata = calloc(3, sizeof(krb5_pa_data *));
-        if (reply_encpart.enc_padata == NULL) {
-            errcode = ENOMEM;
-            status = "Allocating enc_padata";
-            goto cleanup;
-        }
-        errcode = kdc_handle_protected_negotiation(pkt, request, reply_key,
-                                                   reply_encpart.enc_padata,
-                                                   &idx);
-        if (errcode != 0) {
-            status = "protected negotiation";
-            goto cleanup;
-        }
+    errcode = return_enc_padata(kdc_context, pkt, request,
+                                reply_key, &server, &reply_encpart,
+                                is_referral && isflagset(s_flags, KRB5_KDB_FLAG_CANONICALIZE));
+    if (errcode) {
+        status = "KDC_RETURN_ENC_PADATA";
+        goto cleanup;
     }
 
+
     errcode = krb5_encode_kdc_rep(kdc_context, KRB5_TGS_REP, &reply_encpart,
                                   subkey ? 1 : 0,
                                   reply_key,