[31585] in CVS-changelog-for-Kerberos-V5
krb5 commit: Avoid prep_questions calls after preauth failures
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Fri Oct 30 12:56:20 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261030073010.06D4110582A@krbdev.mit.edu>
Date: Fri, 30 Oct 2026 03:30:10 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/b4fba326e92360705012becf3fe89ffc7c39164f
commit b4fba326e92360705012becf3fe89ffc7c39164f
Author: Greg Hudson <ghudson@mit.edu>
Date: Thu Aug 27 20:55:16 2026 -0400
Avoid prep_questions calls after preauth failures
In the libkrb5 AS-REQ logic, on receipt of a PREAUTH_FAILED reply from
the KDC, we mark the selected preauth type as having failed using
k5_preauth_note_failed(), and see if we can preauthenticate using a
different mechanism. process_pa_data() correctly filters out types
marked as failed, but fill_response_items() does not, so we still call
the prep_questions() method of previously failed mechanisms. Add the
missing filtering to avoid confusing mechanisms and/or adding
inappropriate response items to the set.
src/lib/krb5/krb/preauth2.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
index e199f50f9..3df9597b4 100644
--- a/src/lib/krb5/krb/preauth2.c
+++ b/src/lib/krb5/krb/preauth2.c
@@ -955,7 +955,8 @@ fill_response_items(krb5_context context, krb5_init_creds_context ctx,
k5_response_items_reset(ctx->rctx.items);
for (i = 0; in_padata[i] != NULL; i++) {
pa = in_padata[i];
- if (!pa_type_allowed(ctx, pa->pa_type))
+ if (!pa_type_allowed(ctx, pa->pa_type) ||
+ previously_failed(ctx, pa->pa_type))
continue;
h = find_module(context, ctx, pa->pa_type, &modreq);
if (h == NULL)
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
