diff options
| author | Stefan Metzmacher <metze@samba.org> | 2016-01-07 14:12:14 +0100 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2016-07-22 23:34:20 +0200 |
| commit | 08ead28c6996b4e6bf51b2fd9214217724fe01be (patch) | |
| tree | 3386dbf1b60ac29a94900c50943a2f22abcb9612 /source4/heimdal | |
| parent | fbd061095396b986be297061bc5108cc30eb57ad (diff) | |
| download | samba-08ead28c6996b4e6bf51b2fd9214217724fe01be.tar.gz | |
HEIMDAL:lib/krb5: allow predefined PAC_{LOGON_NAME,PRIVSVR_CHECKSUM,SERVER_CHECKSUM} elements in _krb5_pac_sign()
A caller may want to specify an explicit order of PAC elements,
e.g. the PAC_UPN_DNS_INFO element should be placed after the PAC_LOGON_NAME
element.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This is commit 7cd40a610569d5e54ebe323672794fb6415b5dac in heimdal master.
Diffstat (limited to 'source4/heimdal')
| -rw-r--r-- | source4/heimdal/lib/krb5/pac.c | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c index 19663d2c364..7ac95bdcdba 100644 --- a/source4/heimdal/lib/krb5/pac.c +++ b/source4/heimdal/lib/krb5/pac.c @@ -979,6 +979,40 @@ _krb5_pac_sign(krb5_context context, krb5_data_zero(&logon); + for (i = 0; i < p->pac->numbuffers; i++) { + if (p->pac->buffers[i].type == PAC_SERVER_CHECKSUM) { + if (p->server_checksum == NULL) { + p->server_checksum = &p->pac->buffers[i]; + } + if (p->server_checksum != &p->pac->buffers[i]) { + ret = EINVAL; + krb5_set_error_message(context, ret, + N_("PAC have two server checksums", "")); + goto out; + } + } else if (p->pac->buffers[i].type == PAC_PRIVSVR_CHECKSUM) { + if (p->privsvr_checksum == NULL) { + p->privsvr_checksum = &p->pac->buffers[i]; + } + if (p->privsvr_checksum != &p->pac->buffers[i]) { + ret = EINVAL; + krb5_set_error_message(context, ret, + N_("PAC have two KDC checksums", "")); + goto out; + } + } else if (p->pac->buffers[i].type == PAC_LOGON_NAME) { + if (p->logon_name == NULL) { + p->logon_name = &p->pac->buffers[i]; + } + if (p->logon_name != &p->pac->buffers[i]) { + ret = EINVAL; + krb5_set_error_message(context, ret, + N_("PAC have two logon names", "")); + goto out; + } + } + } + if (p->logon_name == NULL) num++; if (p->server_checksum == NULL) |