diff options
| author | Sam Hartman <hartmans@mit.edu> | 2009-11-24 01:05:30 +0000 |
|---|---|---|
| committer | Sam Hartman <hartmans@mit.edu> | 2009-11-24 01:05:30 +0000 |
| commit | d55064e02f1078be49e9ff4200bc98cff7002834 (patch) | |
| tree | 265ac9aa5120bd645944c7423ca811e381b28f23 /src | |
| parent | a47489bddf97bb20dc561500ba581a5b64c7479a (diff) | |
| download | krb5-d55064e02f1078be49e9ff4200bc98cff7002834.tar.gz krb5-d55064e02f1078be49e9ff4200bc98cff7002834.tar.xz krb5-d55064e02f1078be49e9ff4200bc98cff7002834.zip | |
KDC MUST NOT accept ap-request armor in FAST TGS
Per the latest preauth framework spec, the working group has decided
to forbid ap-request armor in the TGS request because of security
problems with that armor type.
This commit was tested against an implementation of FAST TGS client to
confirm that if explicit armor is sent, the request is rejected.
ticket: 6585
target_version: 1.7.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23325 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src')
| -rw-r--r-- | src/kdc/fast_util.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c index 17b844752..310faf09a 100644 --- a/src/kdc/fast_util.c +++ b/src/kdc/fast_util.c @@ -148,6 +148,11 @@ kdc_find_fast(krb5_kdc_req **requestptr, if (retval == 0 &&fast_armored_req->armor) { switch (fast_armored_req->armor->armor_type) { case KRB5_FAST_ARMOR_AP_REQUEST: + if (tgs_subkey) { + krb5_set_error_message( kdc_context, KRB5KDC_ERR_PREAUTH_FAILED, + "Ap-request armor not permitted with TGS"); + return KRB5KDC_ERR_PREAUTH_FAILED; + } retval = armor_ap_request(state, fast_armored_req->armor); break; default: |