[27910] in CVS-changelog-for-Kerberos-V5
krb5 commit: Don't change realm in find_alternate_tgs
daemon@ATHENA.MIT.EDU (Greg Hudson)
Thu Aug 29 18:04:07 2013
Date: Thu, 29 Aug 2013 18:04:01 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201308292204.r7TM41uN008398@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/ba31a9317bdef13d73e98afe493695601f91d134
commit ba31a9317bdef13d73e98afe493695601f91d134
Author: Greg Hudson <ghudson@mit.edu>
Date: Thu Aug 29 09:07:57 2013 -0400
Don't change realm in find_alternate_tgs
If a client makes a TGS request for a cross-realm TGS within a
different realm from the one we normally serve (e.g. the KDC realm is
X, and a client makes a TGS request for the server krbtgt/Y@Z), look
for alternate TGS principals within the requested server realm, not
the realm we normally serve.
This change shouldn't break any working well-formed TGS requests,
because changing the realm would trigger a failure in check_tgs_tgt.
It may fix some corner cases when multiple realms are served out of
the same KDB. But primarily, this change makes referrals and aliases
easier to reason about, by eliminating a case where server->princ has
a different realm from request->server after the call to
search_sprinc().
src/kdc/do_tgs_req.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 6415e28..e66badb 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -1027,7 +1027,7 @@ find_alternate_tgs(kdc_realm_t *kdc_active_realm, krb5_principal princ,
while (--pl2 > plist) {
tmp = *krb5_princ_realm(kdc_context, *pl2);
krb5_princ_set_realm(kdc_context, *pl2,
- krb5_princ_realm(kdc_context, tgs_server));
+ krb5_princ_realm(kdc_context, princ));
retval = db_get_svc_princ(kdc_context, *pl2, 0, &server, status);
krb5_princ_set_realm(kdc_context, *pl2, &tmp);
if (retval == KRB5_KDB_NOENTRY)
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
