Commit 1bef768e authored by jan.koester's avatar jan.koester
Browse files

test

parent 449e78ca

src/krb5.cpp

+28 −3
Changes for src/krb5.cpp: 28 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -2940,9 +2940,34 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le 
        }



        if (!paVerified) {

            return buildStandardError(KDC_ERR_PREAUTH_FAILED,

                                       "Pre-authentication failed",

                                       req.cname.realm, "krbtgt");

            /*

             * Return PREAUTH_REQUIRED (not PREAUTH_FAILED) with ETYPE-INFO2.

             * MIT kinit sends the first AS-REQ speculatively (possibly with

             * PA-FX-FAST or a wrong PA-ENC-TIMESTAMP).  The KDC must always

             * reply with ETYPE-INFO2 so the client learns the correct salt

             * and enctype before retrying.

             */

            std::string salt = req.cname.realm + req.cname.name;

            auto etypeInfo = Asn1Der::encodeEtypeInfo2(selectedEtype, salt);

            auto paEtypeInfo = Asn1Der::encodePaData(KRB5_PADATA_ETYPE_INFO2, etypeInfo);



            Krb5Error preAuthErr;

            preAuthErr.pvno = 5;

            preAuthErr.msg_type = KRB_ERROR;

            preAuthErr.stime = time(nullptr);

            preAuthErr.susec = 0;

            preAuthErr.error_code = KDC_ERR_PREAUTH_REQUIRED;

            preAuthErr.sname = Krb5Principal(KRB5_NT_SRV_INST, req.cname.realm,

                                              "krbtgt", req.cname.realm);

            preAuthErr.e_text = "Additional pre-authentication required";



            auto paEncTs = Asn1Der::encodePaData(KRB5_PADATA_ENC_TIMESTAMP, {});

            std::vector<uint8_t> methodData;

            methodData.insert(methodData.end(), paEncTs.begin(), paEncTs.end());

            methodData.insert(methodData.end(), paEtypeInfo.begin(), paEtypeInfo.end());

            preAuthErr.e_data = Asn1Der::encodeSequence(methodData);



            return preAuthErr.serialize();

        }

    }

src/krb5.h

+1 −2
Changes for src/krb5.h: 1 added line, 2 removed lines.
Original line number Diff line number Diff line
@@ -42,7 +42,6 @@ 
#include <netplus/eventapi.h>

#include <netplus/crypto/aes.h>

#include <netplus/crypto/sha.h>

#include <netplus/crypto/hkdf.h>



#include "backend.h"

#include "exception.h"
@@ -593,7 +592,7 @@ namespace authdb { 
     * Kerberos 5 Crypto Operations (using netplus)

     *

     * Supports standard key derivation per RFC 3961/3962 for MIT/Heimdal

     * compatibility, plus HKDF-based key derivation for newer enc types.

     * compatibility.  Uses PBKDF2-HMAC-SHA1, AES-CTS, and HMAC-SHA1-96.

     **************************************************************************/

    class VISIBILITY Krb5Crypto {

    public: