third_party/heimdal: Import lorikeet-heimdal-202307050413 (commit e0597fe1d01b109e64d...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9612

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 19 02:41:25 UTC 2023 on atb-devel-224

diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index ba225236c2ef2f6917dd88b98969b94b7b821a71..8c4c7f73ff5a7e3018069936e36f339d6aadaa4e 100644 (file)
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -67,7 +67,6 @@
 # PK-INIT tests
 #
 ^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_no_des3.ad_dc
-^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_revoked.ad_dc
 #
 # Windows 2000 PK-INIT tests
 #

diff --git a/third_party/heimdal/kdc/kerberos5.c b/third_party/heimdal/kdc/kerberos5.c
index 36db57cb36a5790487487654349bbfbff3de6b35..8a6add4d22c38ee90ab735cc7cd62dc35fb85227 100644 (file)
--- a/third_party/heimdal/kdc/kerberos5.c
+++ b/third_party/heimdal/kdc/kerberos5.c
@@ -579,7 +579,11 @@ pa_pkinit_validate(astgs_request_t r, const PA_DATA *pa)
 
     ret = _kdc_pk_rd_padata(r, pa, &pkp);
     if (ret || pkp == NULL) {
-       ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+       if (ret == HX509_CERT_REVOKED) {
+           ret = KRB5_KDC_ERR_CLIENT_NOT_TRUSTED;      
+       } else {
+           ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+       }
        _kdc_r_log(r, 4, "Failed to decode PKINIT PA-DATA -- %s",
                   r->cname);
        goto out;

diff --git a/third_party/heimdal/kdc/pkinit.c b/third_party/heimdal/kdc/pkinit.c
index b63f38e9aa9282ab433432b41bbf7faddb72cbc8..080ead541b4eacb8c73d1f11088c8cab3ee3f1ce 100644 (file)
--- a/third_party/heimdal/kdc/pkinit.c
+++ b/third_party/heimdal/kdc/pkinit.c
@@ -231,6 +231,7 @@ generate_dh_keyblock(krb5_context context,
            size -= dh_gen_keylen;
            memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
            memset(dh_gen_key, 0, size);
+           dh_gen_keylen += size;
        }
     } else if (client_params->keyex == USE_ECDH) {
        if (client_params->u.ecdh.public_key == NULL) {
@@ -460,6 +461,8 @@ _kdc_pk_rd_padata(astgs_request_t priv,
     hx509_verify_attach_anchors(cp->verify_ctx, trust_anchors);
     hx509_certs_free(&trust_anchors);
 
+    hx509_verify_attach_revoke(cp->verify_ctx, kdc_identity->revokectx);
+
     if (config->pkinit_allow_proxy_certs)
        hx509_verify_set_proxy_certificate(cp->verify_ctx, 1);
 

diff --git a/third_party/heimdal/lib/krb5/krb5.conf.5 b/third_party/heimdal/lib/krb5/krb5.conf.5
index 3258c116aabd8180f999caef300a4ecb2722f649..fda55e3ed17b6b81fb1b6b4138e4b98bf95b18ee 100644 (file)
--- a/third_party/heimdal/lib/krb5/krb5.conf.5
+++ b/third_party/heimdal/lib/krb5/krb5.conf.5
@@ -184,7 +184,8 @@ This is a multi-valued parameter naming one or more stores of
 anchors for PKINIT KDC certificates.
 .It Li pkinit_revoke = Va HX509-STORE ...
 This is a multi-valued parameter naming one or more stores of
-of CRLs for the issuers of PKINIT KDC certificates.
+CRLs for the issuers of PKINIT KDC certificates.
+Only the first valid CRL for a particular issuer will be checked.
 If no CRLs are configured, then CRLs will not be checked.
 This is because hx509 currently lacks support.
 .El
@@ -911,7 +912,8 @@ is also supported here.
 type stores are OpenSSL-style CA certificate hash directories.
 .It Li pkinit_revoke = Va HX509-STORE ...
 This is a multi-valued parameter naming one or more stores of
-of CRLs for the issuers of PKINIT client certificates.
+CRLs for the issuers of PKINIT client certificates.
+Only the first valid CRL for a particular issuer will be checked.
 If no CRLs are configured, then CRLs will not be checked.
 This is because the KDC will not dereference CRL distribution
 points nor request OCSP responses.

diff --git a/third_party/heimdal/lib/krb5/pkinit.c b/third_party/heimdal/lib/krb5/pkinit.c
index 2a0979b7e127eca918e146f57d9ff66fae9e7c30..e3707e203a44c4788784d0f0022c24be84255b78 100644 (file)
--- a/third_party/heimdal/lib/krb5/pkinit.c
+++ b/third_party/heimdal/lib/krb5/pkinit.c
@@ -1493,6 +1493,7 @@ pk_rd_pa_reply_dh(krb5_context context,
            size -= dh_gen_keylen;
            memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
            memset(dh_gen_key, 0, size);
+           dh_gen_keylen += size;
        }
 
     } else {