[31625] in CVS-changelog-for-Kerberos-V5
krb5 commit: Exclude nested AD-IF-RELEVANT authdata in KDC
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:56:57 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165653.A8AF0105814@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:56:53 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/e81ea7f9a9c2e04faf5d24452f96a0419a047aac
commit e81ea7f9a9c2e04faf5d24452f96a0419a047aac
Author: Greg Hudson <ghudson@mit.edu>
Date: Sat Aug 1 16:38:18 2026 -0400
Exclude nested AD-IF-RELEVANT authdata in KDC
When including authdata from a KDC request, the KDC tries to filter
out authdata types that should only originate from KDCs using
is_kdc_issued_authdata(). This check is not strictly necessary for
authdata security and is not a sufficient mechanism for authdata
security by itself (because new KDC-origin-only authdata types can be
added over time), but it can mitigate the impact of some bugs.
When the authdata type is AD-IF-RELEVANT, is_kdc_issued_authdata()
performs minimal decoding on the container, extracting only the
authdata types. This is good because it limits the amount of KDC time
and memory a client can consume by requesting an authdata element
packed with nested containers. But it also means we miss KDC-issued
authdata elements within nested AD-IF-RELEVANT containers; such
elements would be found by krb5_find_authdata() so are still operable.
In is_kdc_issued_authdata(), assume that any client-provided authdata
element containing a nested AD-IF-RELEVANT container is nefarious and
filter it out. Also remove the desired_type parameter as we no longer
need it.
Discovered by Claude and Ada Logics, and by Alejandro Pacheco. Test
case adapted from a patch by Alejandro Pacheco.
ticket: 9229 (new)
tags: pullup
target_version: 1.22-next
src/kdc/kdc_authdata.c | 14 +++++++++-----
src/tests/t_authdata.py | 8 ++++++++
2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c
index 398df2196..0ebd23599 100644
--- a/src/kdc/kdc_authdata.c
+++ b/src/kdc/kdc_authdata.c
@@ -106,10 +106,9 @@ unload_authdata_plugins(krb5_context context)
}
/* Return true if authdata should be filtered when copying from untrusted
- * authdata. If desired_type is non-zero, look only for that type. */
+ * authdata. */
static krb5_boolean
-is_kdc_issued_authdatum(krb5_authdata *authdata,
- krb5_authdatatype desired_type)
+is_kdc_issued_authdatum(krb5_authdata *authdata)
{
krb5_boolean result = FALSE;
krb5_authdatatype ad_type;
@@ -134,7 +133,12 @@ is_kdc_issued_authdatum(krb5_authdata *authdata,
case KRB5_AUTHDATA_WIN2K_PAC:
case KRB5_AUTHDATA_CAMMAC:
case KRB5_AUTHDATA_AUTH_INDICATOR:
- result = desired_type ? (desired_type == ad_types[i]) : TRUE;
+ result = TRUE;
+ break;
+ case KRB5_AUTHDATA_IF_RELEVANT:
+ /* Assume nested AD-IF-RELEVANT containers are trying to hide
+ * KDC-issued authdata and filter them out. */
+ result = TRUE;
break;
default:
result = FALSE;
@@ -216,7 +220,7 @@ add_filtered_authdata(krb5_authdata ***existing_list,
/* Remove KDC-issued elements from copy. */
j = 0;
for (i = 0; copy[i] != NULL; i++) {
- if (is_kdc_issued_authdatum(copy[i], 0)) {
+ if (is_kdc_issued_authdatum(copy[i])) {
free(copy[i]->contents);
free(copy[i]);
} else {
diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py
index d7b89cc26..2f7546f74 100644
--- a/src/tests/t_authdata.py
+++ b/src/tests/t_authdata.py
@@ -26,6 +26,14 @@ if ' -5: test1' not in out or '?-6: test2' not in out:
if 'fake' in out:
fail('KDC-only authdata not filtered for request with authdata')
+# Nested if-relevant containers are also filtered, whether or not they
+# contain KDC-only authdata types.
+mark('request authdata nested')
+out = realm.run(['./adata', realm.host_princ, '??-7', 'nested',
+ '??128', 'nestedfakepac', '???^-8', 'nestedfakekdcissued'])
+if 'nested' in out or 'fake' in out:
+ fail('Nested authdata not filtered for request with authdata')
+
mark('AD-MANDATORY-FOR-KDC')
realm.run(['./adata', realm.host_princ, '!-1', 'mandatoryforkdc'],
expected_code=1, expected_msg='KDC policy rejects request')
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
