Commit 1cb8bfb7 authored by jan.koester's avatar jan.koester
Browse files

bugfix

parent 267d436a

plugin/krb5/krb5.cpp

+12 −6
Changes for plugin/krb5/krb5.cpp: 12 added lines, 6 removed lines.
Original line number Diff line number Diff line
@@ -3864,13 +3864,17 @@ bool Krb5KDC::gssAccept(const std::vector<uint8_t> &apReqData, GssAcceptResult & 


    /* KRB5_AP_OPTS_MUTUAL_REQUIRED = 0x20000000: the AP-REP enc-part is

     * encrypted with the TICKET session key (not the subkey). */

    /* our initial GSS sequence number, announced in the AP-REP */

    out.acceptorSeq = Krb5Crypto::randomNonce() & 0x3fffffff;

    if (ap.ap_options & 0x20000000) {

        Krb5Service svc("", "", ap.ticket.sname.realm, svcKey);

        out.apRep = svc.buildApRep(auth, et.session_key);

        out.apRep = svc.buildApRep(auth, et.session_key, out.acceptorSeq);

    }

    out.gssFlags = auth.has_gss_cksum ? auth.gss_flags : 0;

    out.initiatorSeq = auth.seq_number;

    out.acceptorSeq = auth.seq_number;   /* what buildApRep announces */

    std::cerr << "[KDC] gssAccept " << out.clientPrincipal << " subkey=" << auth.has_subkey

              << " flags=0x" << std::hex << out.gssFlags << " initSeq=0x" << out.initiatorSeq

              << " accSeq=0x" << out.acceptorSeq << std::dec << " mutual=" << !out.apRep.empty() << std::endl;

    return true;

}
@@ -4404,17 +4408,19 @@ bool Krb5Service::verifyApReq(const std::vector<uint8_t> &apReqData, 
}



std::vector<uint8_t> Krb5Service::buildApRep(const Krb5Authenticator &auth,

                                               const Krb5SessionKey &sessionKey) {

                                               const Krb5SessionKey &sessionKey,

                                               uint32_t seqNumber) {

    /* EncAPRepPart ::= [APPLICATION 27] SEQUENCE {

     *   ctime [0] KerberosTime, cusec [1] Microseconds,

     *   subkey [2] EncryptionKey OPTIONAL, seq-number [3] UInt32 OPTIONAL }

     * ctime/cusec echo the authenticator (that proves the service to the

     * client); seq-number is the acceptor's initial GSS sequence number, we

     * use the initiator's (as Windows does for DCE style, and harmless else). */

     * client); seq-number is the acceptor's initial GSS sequence number.

     * Keep it below 2^31: Windows reads it as a signed Int32 and fails on a

     * 5-byte positive encoding. */

    std::vector<uint8_t> seq;

    Asn1Der::encodeContextTag(seq, 0, Asn1Der::encodeGeneralizedTime(auth.ctime));

    Asn1Der::encodeContextTag(seq, 1, Asn1Der::encodeUInteger(auth.cusec));

    Asn1Der::encodeContextTag(seq, 3, Asn1Der::encodeUInteger(auth.seq_number));

    Asn1Der::encodeContextTag(seq, 3, Asn1Der::encodeUInteger(seqNumber & 0x7fffffff));

    std::vector<uint8_t> repData;

    Asn1Der::encodeTLV(repData, 0x7B /* [APPLICATION 27] */, Asn1Der::encodeSequence(seq));

plugin/krb5/krb5.h

+2 −1
Changes for plugin/krb5/krb5.h: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -926,7 +926,8 @@ namespace fenrirds { 


        /* Build an AP-REP response */

        std::vector<uint8_t> buildApRep(const Krb5Authenticator &auth,

                                         const Krb5SessionKey &sessionKey);

                                         const Krb5SessionKey &sessionKey,

                                        uint32_t seqNumber = 0);



    private:

        Krb5Principal        _ServicePrincipal;