KRB5_KTE_FLAG_ACCEPTOR_IGNORE_* in krb5_rd_req_ctx

[metze/samba/wip.git] / third_party / heimdal / lib / krb5 / rd_req.c

diff --git a/third_party/heimdal/lib/krb5/rd_req.c b/third_party/heimdal/lib/krb5/rd_req.c
index 738b4f44c3e6eaedcff4df5ff6c9f1f22f52dc41..192a2deed01964055d20516bf416472771f59ab4 100644 (file)
--- a/third_party/heimdal/lib/krb5/rd_req.c
+++ b/third_party/heimdal/lib/krb5/rd_req.c
@@ -830,7 +830,8 @@ get_key_from_keytab(krb5_context context,
                    krb5_ap_req *ap_req,
                    krb5_const_principal server,
                    krb5_keytab keytab,
-                   krb5_keyblock **out_key)
+                   krb5_keyblock **out_key,
+                   uint32_t *out_kte_flags)
 {
     krb5_keytab_entry entry;
     krb5_error_code ret;
@@ -855,6 +856,7 @@ get_key_from_keytab(krb5_context context,
                             &entry);
     if(ret == 0) {
         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
+        *out_kte_flags = entry.flags;
         krb5_kt_free_entry(context, &entry);
     }
     if(keytab == NULL)
@@ -960,6 +962,7 @@ krb5_rd_req_ctx(krb5_context context,
             */
            o->keyblock = NULL;
     } else {
+       uint32_t kte_flags = 0;
 
        if(id == NULL) {
            krb5_kt_default(context, &keytab);
@@ -982,7 +985,8 @@ krb5_rd_req_ctx(krb5_context context,
                                  &ap_req,
                                  server,
                                  id,
-                                 &o->keyblock);
+                                 &o->keyblock,
+                                 &kte_flags);
        if (ret) {
            /* If caller specified a server, fail. */
            if (service == NULL && (context->flags & KRB5_CTX_F_RD_REQ_IGNORE) == 0)
@@ -991,6 +995,11 @@ krb5_rd_req_ctx(krb5_context context,
             * have serious performace issues for larger keytab.
             */
            o->keyblock = NULL;
+       } else {
+           if (kte_flags & KRB5_KTE_FLAG_ACCEPTOR_IGNORE_VNO)
+               o->keyblock = NULL;
+           else if (kte_flags & KRB5_KTE_FLAG_ACCEPTOR_IGNORE_TRANSITED)
+               verify_ap_req_flags |= KRB5_VERIFY_AP_REQ_SKIP_TRANSITED_CHECK;
        }
     }
 
@@ -1032,6 +1041,7 @@ krb5_rd_req_ctx(krb5_context context,
 
        done = 0;
        while (!done) {
+           krb5_flags tmp_verify_ap_req_flags = verify_ap_req_flags;
            krb5_principal p;
 
            ret = krb5_kt_next_entry(context, id, &entry, &cursor);
@@ -1047,12 +1057,15 @@ krb5_rd_req_ctx(krb5_context context,
                continue;
            }
 
+           if (entry.flags & KRB5_KTE_FLAG_ACCEPTOR_IGNORE_TRANSITED)
+               tmp_verify_ap_req_flags |= KRB5_VERIFY_AP_REQ_SKIP_TRANSITED_CHECK;
+
            ret = krb5_verify_ap_req2(context,
                                      auth_context,
                                      &ap_req,
                                      server,
                                      &entry.keyblock,
-                                     verify_ap_req_flags,
+                                     tmp_verify_ap_req_flags,
                                      &o->ap_req_options,
                                      &o->ticket,
                                      KRB5_KU_AP_REQ_AUTH);