diff options
| author | Greg Hudson <ghudson@mit.edu> | 2010-01-12 01:05:37 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2010-01-12 01:05:37 +0000 |
| commit | 1e1388b0a96333a792267209cb9eb3bff4eb877d (patch) | |
| tree | 5dfc037e02b18abe1941fce41134302f86489e2b /src | |
| parent | faa810c5b59fa33d9f7db837c5bb88df5436bb30 (diff) | |
Simplify and fix FAST check for keyed checksum type
Use krb5_c_is_keyed_checksum to detect unkeyed checksums when handling
FAST requests. The old check was broken for 1.8 because
krb5_c_verify_checksum got pickier about invalid keyblocks.
ticket: 6632
target_version: 1.8
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23628 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src')
| -rw-r--r-- | src/kdc/fast_util.c | 19 |
1 files changed, 4 insertions, 15 deletions
diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c index e6503cf8a..06b1e2bc7 100644 --- a/src/kdc/fast_util.c +++ b/src/kdc/fast_util.c @@ -133,6 +133,7 @@ kdc_find_fast(krb5_kdc_req **requestptr, krb5_fast_req * fast_req = NULL; krb5_kdc_req *request = *requestptr; krb5_fast_armored_req *fast_armored_req = NULL; + krb5_checksum *cksum; krb5_boolean cksum_valid; krb5_keyblock empty_keyblock; @@ -191,11 +192,11 @@ kdc_find_fast(krb5_kdc_req **requestptr, if (plaintext.data) free(plaintext.data); } + cksum = &fast_armored_req->req_checksum; if (retval == 0) retval = krb5_c_verify_checksum(kdc_context, state->armor_key, KRB5_KEYUSAGE_FAST_REQ_CHKSUM, - checksummed_data, - &fast_armored_req->req_checksum, + checksummed_data, cksum, &cksum_valid); if (retval == 0 && !cksum_valid) { retval = KRB5KRB_AP_ERR_MODIFIED; @@ -203,19 +204,7 @@ kdc_find_fast(krb5_kdc_req **requestptr, "FAST req_checksum invalid; request modified"); } if (retval == 0) { - krb5_error_code ret; - /* - * We need to confirm that a keyed checksum is used for the - * fast_req checksum. In April 2009, the best way to do this is - * to try verifying the checksum with a keyblock with an zero - * length; if it succeeds, then an unkeyed checksum is used. - */ - ret = krb5_c_verify_checksum(kdc_context, &empty_keyblock, - KRB5_KEYUSAGE_FAST_REQ_CHKSUM, - checksummed_data, - &fast_armored_req->req_checksum, - &cksum_valid); - if (ret == 0) { + if (!krb5_c_is_keyed_cksum(cksum->checksum_type)) { retval = KRB5KDC_ERR_POLICY; krb5_set_error_message(kdc_context, KRB5KDC_ERR_POLICY, "Unkeyed checksum used in fast_req"); |