[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: heimdal 0.8-rc3

rd_req.c will try and verify a PAC form a Microsoft W2k3 AD KDC
if present, by calling the new pac.c. This tries to vErify the
checksums of the PAC.

The checksum of the PAC may be encrypted in the session key, or
the server's key depending on  f KDC_OPT_ENC_TKT_IN SKEY
was set in the ap_req_options.


   "For the server's checksum, the key used to generate the signature should be
    the same key used to encrypt the ticket. Thus, if the enc_tkt_in_skey option
    is used, the session key from the  server's TGT should be used. "

The code was not checking if this was the case and always using the
skey and thus would fail to decrypt PAC_SERVER_CHECKSUM.

Suggested fix:

--- ,rd_req.c	Thu Jan  4 05:27:20 2007
+++ rd_req.c	Mon Jan 15 15:44:18 2007
@@ -855,7 +855,8 @@
-				  &o->ticket->ticket.key,
+				(o->ap_req_options & KDC_OPT_ENC_TKT_IN_SKEY) ?
+				  &o->ticket->ticket.key : o->keyblock,
  	    krb5_pac_free(context, pac);
  	    if (ret)

Love Hörnquist Åstrand wrote:
> Hello
> I've just created a heimdal 0.8-rc3 snapshot.
> ftp://ftp.pdc.kth.se/pub/heimdal/src/snapshots/heimdal-0.8-rc3.tar.ga
> ftp://ftp.pdc.kth.se/pub/heimdal/src/snapshots/heimdal-0.8-rc3.dmg
> Basicly what needs to happen before release is fixing (text) error message
> for GSS-API mech-glue layer and testing on more platforms.
> Testing is mostly automated and very simple to set up, please read
> here if you want to contribute.
> http://www.pdc.kth.se/heimdal/help/#buildfarm
> Love


  Douglas E. Engert  <DEEngert@anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444