diff options
| author | Tom Yu <tlyu@mit.edu> | 2012-09-20 15:35:56 -0400 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2012-10-15 19:41:14 -0400 |
| commit | 688dce2916b04932ffb42c2ff265a00ce01d7189 (patch) | |
| tree | aaa28e4580c5d413e4efd90f93658c4ba1a9c443 /src | |
| parent | 970fc63c63c13a9a15fd0c6dcb6ba7a11ab63c36 (diff) | |
| download | krb5-688dce2916b04932ffb42c2ff265a00ce01d7189.tar.gz krb5-688dce2916b04932ffb42c2ff265a00ce01d7189.tar.xz krb5-688dce2916b04932ffb42c2ff265a00ce01d7189.zip | |
Enforce TGS principals having 2 components
RFC 4120 section 7.3 says that TGS principal names have two
components. Make krb5_is_tgs_principal() and is_cross_tgs_principal()
enforce this constraint. Code elsewhere in the KDC already checks for
two components anyway.
Diffstat (limited to 'src')
| -rw-r--r-- | src/kdc/kdc_util.c | 22 |
1 files changed, 13 insertions, 9 deletions
diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c index a2a9b4b07..4f6ce6f30 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c @@ -145,22 +145,26 @@ is_local_principal(krb5_const_principal princ1) krb5_boolean krb5_is_tgs_principal(krb5_const_principal principal) { - if ((krb5_princ_size(kdc_context, principal) > 0) && - data_eq_string (*krb5_princ_component(kdc_context, principal, 0), - KRB5_TGS_NAME)) + if (krb5_princ_size(kdc_context, principal) != 2) + return FALSE; + if (data_eq_string(*krb5_princ_component(kdc_context, principal, 0), + KRB5_TGS_NAME)) return TRUE; - return FALSE; + else + return FALSE; } /* Returns TRUE if principal is the name of a cross-realm TGS. */ krb5_boolean is_cross_tgs_principal(krb5_const_principal principal) { - return (krb5_princ_size(kdc_context, principal) >= 2 && - data_eq_string(*krb5_princ_component(kdc_context, principal, 0), - KRB5_TGS_NAME) && - !data_eq(*krb5_princ_component(kdc_context, principal, 1), - *krb5_princ_realm(kdc_context, principal))); + if (!krb5_is_tgs_principal(principal)) + return FALSE; + if (!data_eq(*krb5_princ_component(kdc_context, principal, 1), + *krb5_princ_realm(kdc_context, principal))) + return TRUE; + else + return FALSE; } /* |