diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/include/krb5/krb5.hin | 6 | ||||
| -rw-r--r-- | src/lib/krb5/krb/pac.c | 8 |
2 files changed, 8 insertions, 6 deletions
diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index f3d0225a0..83c2dc721 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -7506,13 +7506,13 @@ krb5_pac_parse(krb5_context context, const void *ptr, size_t len, * @param [in] pac PAC handle * @param [in] authtime Expected timestamp * @param [in] principal Expected principal name (or NULL) - * @param [in] server Key to validate server checksum + * @param [in] server Key to validate server checksum (or NULL) * @param [in] privsvr Key to validate KDC checksum (or NULL) * * This function validates @a pac against the supplied @a server, @a privsvr, * @a principal and @a authtime. If @a principal is NULL, the principal and - * authtime are not verified. If @a privsvr is NULL, the KDC checksum is not - * verified. + * authtime are not verified. If @a server or @a privsvr is NULL, the + * corresponding checksum is not verified. * * If successful, @a pac is marked as verified. * diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c index f173b042e..23aa9305b 100644 --- a/src/lib/krb5/krb/pac.c +++ b/src/lib/krb5/krb/pac.c @@ -637,9 +637,11 @@ krb5_pac_verify(krb5_context context, if (server == NULL) return EINVAL; - ret = k5_pac_verify_server_checksum(context, pac, server); - if (ret != 0) - return ret; + if (server != NULL) { + ret = k5_pac_verify_server_checksum(context, pac, server); + if (ret != 0) + return ret; + } if (privsvr != NULL) { ret = k5_pac_verify_kdc_checksum(context, pac, privsvr); |