From bfeb18163ba1364d37c9179bcf5e9c042c268a8b Mon Sep 17 00:00:00 2001

From: Greg Hudson <ghudson@mit.edu>

Date: Fri, 13 Jan 2017 10:14:36 -0500

Subject: [PATCH] Adjust processing of pa_type ccache config

Read the allowed preauth type from the input ccache in

restart_init_creds_loop(); there is no need to reread it each time we

produce a request.  Move read_allowed_preauth_type() earlier in the

file to allow it to be called from restart_init_creds_loop() without a

prototype.

Clear the selected preauth type in restart_init_creds_loop(), not in

init_creds_step_request().  We want to make sure that it doesn't

survive a restart due to a realm referral or expiry, but we don't want

to forget about it when retrying after an error.

(cherry picked from commit 468c6eb7bb860f7ec0381086a22859f822b41c43)

---

 src/lib/krb5/krb/get_in_tkt.c | 61 ++++++++++++++++++-----------------

 1 file changed, 31 insertions(+), 30 deletions(-)

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c

index 52e07bb67..da12204ac 100644

--- a/src/lib/krb5/krb/get_in_tkt.c

+++ b/src/lib/krb5/krb/get_in_tkt.c

@@ -791,6 +791,31 @@ set_request_times(krb5_context context, krb5_init_creds_context ctx)

     return 0;

 }

+static void

+read_allowed_preauth_type(krb5_context context, krb5_init_creds_context ctx)

+{

+    krb5_error_code ret;

+    krb5_data config;

+    char *tmp, *p;

+    krb5_ccache in_ccache = k5_gic_opt_get_in_ccache(ctx->opt);

+

+    ctx->allowed_preauth_type = KRB5_PADATA_NONE;

+    if (in_ccache == NULL)

+        return;

+    memset(&config, 0, sizeof(config));

+    if (krb5_cc_get_config(context, in_ccache, ctx->request->server,

+                           KRB5_CC_CONF_PA_TYPE, &config) != 0)

+        return;

+    tmp = k5memdup0(config.data, config.length, &ret;;

+    krb5_free_data_contents(context, &config);

+    if (tmp == NULL)

+        return;

+    ctx->allowed_preauth_type = strtol(tmp, &p, 10);

+    if (p == NULL || *p != '\0')

+        ctx->allowed_preauth_type = KRB5_PADATA_NONE;

+    free(tmp);

+}

+

 /**

  * Throw away any pre-authentication realm state and begin with a

  * unauthenticated or optimistically authenticated request.  If fast_upgrade is

@@ -807,6 +832,7 @@ restart_init_creds_loop(krb5_context context, krb5_init_creds_context ctx,

     krb5_free_error(context, ctx->err_reply);

     ctx->preauth_to_use = ctx->err_padata = NULL;

     ctx->err_reply = NULL;

+    ctx->selected_preauth_type = KRB5_PADATA_NONE;

     krb5int_fast_free_state(context, ctx->fast_state);

     ctx->fast_state = NULL;

@@ -849,6 +875,11 @@ restart_init_creds_loop(krb5_context context, krb5_init_creds_context ctx,

                                       &ctx->outer_request_body);

     if (code != 0)

         goto cleanup;

+

+    /* Read the allowed preauth type for this server principal from the input

+     * ccache, if the application supplied one. */

+    read_allowed_preauth_type(context, ctx);

+

 cleanup:

     return code;

 }

@@ -1154,31 +1185,6 @@ init_creds_validate_reply(krb5_context context,

     return 0;

 }

-static void

-read_allowed_preauth_type(krb5_context context, krb5_init_creds_context ctx)

-{

-    krb5_error_code ret;

-    krb5_data config;

-    char *tmp, *p;

-    krb5_ccache in_ccache = k5_gic_opt_get_in_ccache(ctx->opt);

-

-    ctx->allowed_preauth_type = KRB5_PADATA_NONE;

-    if (in_ccache == NULL)

-        return;

-    memset(&config, 0, sizeof(config));

-    if (krb5_cc_get_config(context, in_ccache, ctx->request->server,

-                           KRB5_CC_CONF_PA_TYPE, &config) != 0)

-        return;

-    tmp = k5memdup0(config.data, config.length, &ret;;

-    krb5_free_data_contents(context, &config);

-    if (tmp == NULL)

-        return;

-    ctx->allowed_preauth_type = strtol(tmp, &p, 10);

-    if (p == NULL || *p != '\0')

-        ctx->allowed_preauth_type = KRB5_PADATA_NONE;

-    free(tmp);

-}

-

 static krb5_error_code

 save_selected_preauth_type(krb5_context context, krb5_ccache ccache,

                            krb5_init_creds_context ctx)

@@ -1317,11 +1323,6 @@ init_creds_step_request(krb5_context context,

     if (code)

         goto cleanup;

-    /* Read the allowed patype for this server principal from the in_ccache,

-     * if the application supplied one. */

-    read_allowed_preauth_type(context, ctx);

-    ctx->selected_preauth_type = KRB5_PADATA_NONE;

-

     /*

      * Read cached preauth configuration data for this server principal from

      * the in_ccache, if the application supplied one, and delete any that was