Commit c50ef04e authored by jan.koester's avatar jan.koester
Browse files

test

parent 2ec00224

plugin/krb5/krb5.cpp

+21 −1
Changes for plugin/krb5/krb5.cpp: 21 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -2805,12 +2805,30 @@ std::vector<std::string> Krb5KDC::getRealmNames() const { 
}



RealmInfo *Krb5KDC::resolveRealm(const std::string &realm) {

    auto it = _Realms.find(realm);

    /* realm names compare case-insensitively (Windows asks for

     * user@example.com as readily as user@EXAMPLE.COM) */

    auto it = _Realms.find(toUpperRealm(realm));

    if (it == _Realms.end())

        it = _Realms.find(realm);

    if (it == _Realms.end())

        return nullptr;

    return &it->second;

}



/* a request's realms in the spelling of our realm table, so that the

 * tickets we issue and every later realm comparison use one form */

void Krb5KDC::canonicalizeRealms(Krb5KdcReq &req) {

    auto canon = [&](std::string &r) {

        if (_Realms.count(r)) return;

        std::string u = toUpperRealm(r);

        if (_Realms.count(u)) r = u;

    };

    canon(req.cname.realm);

    canon(req.sname.realm);

    if (req.sname.name == "krbtgt")

        canon(req.sname.instance);

}



bool Krb5KDC::getCrossRealmKey(const std::string &localRealm,

                                const std::string &remoteRealm,

                                std::vector<uint8_t> &key) {
@@ -2946,6 +2964,7 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le 
        std::string errRealm = _Realms.empty() ? "UNKNOWN" : _Realms.begin()->first;

        return buildStandardError(KRB_ERR_GENERIC, "Malformed AS-REQ", errRealm, "krbtgt");

    }

    canonicalizeRealms(req);



    if (req.pvno != 5) {

        return buildStandardError(KDC_ERR_BAD_PVNO, "Unsupported protocol version",
@@ -3269,6 +3288,7 @@ std::vector<uint8_t> Krb5KDC::handleStandardTgsReq(const uint8_t *data, size_t l 
        std::string errRealm = _Realms.empty() ? "UNKNOWN" : _Realms.begin()->first;

        return buildStandardError(KRB_ERR_GENERIC, "Malformed TGS-REQ", errRealm, "krbtgt");

    }

    canonicalizeRealms(req);



    if (req.pvno != 5) {

        return buildStandardError(KDC_ERR_BAD_PVNO, "Unsupported protocol version",

plugin/krb5/krb5.h

+1 −0
Changes for plugin/krb5/krb5.h: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -770,6 +770,7 @@ namespace fenrirds { 
    private:

        /* Resolve the realm from a request and return the RealmInfo, or nullptr */

        RealmInfo *resolveRealm(const std::string &realm);

        void canonicalizeRealms(Krb5KdcReq &req);



        /* Standard Kerberos protocol (ASN.1 DER / RFC 4120) handlers */

        std::vector<uint8_t> handleStandardRequest(const uint8_t *data, size_t len);