|
 |
d738b9 |
From 75b375abcec69421c430a0241e5c72cafd96cb7f Mon Sep 17 00:00:00 2001
|
|
|
d738b9 |
From: Greg Hudson <ghudson@mit.edu>
|
|
|
d738b9 |
Date: Mon, 16 Jan 2017 15:09:32 -0500
|
|
|
d738b9 |
Subject: [PATCH] Continue after KDC_ERR_PREAUTH_FAILED
|
|
|
d738b9 |
|
|
|
d738b9 |
If the KDC sends KDC_ERR_PREAUTH_FAILED, try another mechanism, or
|
|
|
d738b9 |
send an unauthenticated request if optimistic preauth failed.
|
|
|
d738b9 |
|
|
|
d738b9 |
ticket: 8537
|
|
|
d738b9 |
(cherry picked from commit 52d2de31bc4728dbc2f59c6033dcdab86da919e9)
|
|
|
d738b9 |
---
|
|
|
d738b9 |
src/lib/krb5/krb/get_in_tkt.c | 45 ++++++++++++++++++++++++++++-------
|
|
|
d738b9 |
1 file changed, 36 insertions(+), 9 deletions(-)
|
|
|
d738b9 |
|
|
|
d738b9 |
diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
|
|
|
d738b9 |
index 8d0f964f9..c7d7bfe74 100644
|
|
|
d738b9 |
--- a/src/lib/krb5/krb/get_in_tkt.c
|
|
|
d738b9 |
+++ b/src/lib/krb5/krb/get_in_tkt.c
|
|
|
d738b9 |
@@ -1308,6 +1308,7 @@ init_creds_step_request(krb5_context context,
|
|
|
d738b9 |
krb5_error_code code;
|
|
|
d738b9 |
krb5_preauthtype pa_type;
|
|
|
d738b9 |
struct errinfo save = EMPTY_ERRINFO;
|
|
|
d738b9 |
+ uint32_t rcode = (ctx->err_reply == NULL) ? 0 : ctx->err_reply->error;
|
|
|
d738b9 |
|
|
|
d738b9 |
if (ctx->loopcount >= MAX_IN_TKT_LOOPS) {
|
|
|
d738b9 |
code = KRB5_GET_IN_TKT_LOOP;
|
|
|
d738b9 |
@@ -1358,8 +1359,10 @@ init_creds_step_request(krb5_context context,
|
|
|
d738b9 |
TRACE_INIT_CREDS_PREAUTH_MORE(context, ctx->selected_preauth_type);
|
|
|
d738b9 |
code = k5_preauth(context, ctx, ctx->more_padata, TRUE,
|
|
|
d738b9 |
&ctx->request->padata, &pa_type);
|
|
|
d738b9 |
- } else if (ctx->err_reply != NULL &&
|
|
|
d738b9 |
- ctx->err_reply->error != KDC_ERR_PREAUTH_REQUIRED) {
|
|
|
d738b9 |
+ } else if (rcode == KDC_ERR_PREAUTH_FAILED) {
|
|
|
d738b9 |
+ /* Report the KDC-side failure code if we can't try another mech. */
|
|
|
d738b9 |
+ code = KRB5KDC_ERR_PREAUTH_FAILED;
|
|
|
d738b9 |
+ } else if (rcode && rcode != KDC_ERR_PREAUTH_REQUIRED) {
|
|
|
d738b9 |
/* Retrying after an error (possibly mechanism-specific), using error
|
|
|
d738b9 |
* padata to figure out what to change. */
|
|
|
d738b9 |
TRACE_INIT_CREDS_PREAUTH_TRYAGAIN(context, ctx->err_reply->error,
|
|
|
d738b9 |
@@ -1380,7 +1383,7 @@ init_creds_step_request(krb5_context context,
|
|
|
d738b9 |
|
|
|
d738b9 |
if (ctx->request->padata == NULL && ctx->method_padata != NULL) {
|
|
|
d738b9 |
/* Retrying after KDC_ERR_PREAUTH_REQUIRED, or trying again with a
|
|
|
d738b9 |
- * different mechanism after a client-side failure. */
|
|
|
d738b9 |
+ * different mechanism after a failure. */
|
|
|
d738b9 |
TRACE_INIT_CREDS_PREAUTH(context);
|
|
|
d738b9 |
code = k5_preauth(context, ctx, ctx->method_padata, TRUE,
|
|
|
d738b9 |
&ctx->request->padata, &ctx->selected_preauth_type);
|
|
|
d738b9 |
@@ -1480,6 +1483,18 @@ is_referral(krb5_context context, krb5_error *err, krb5_principal client)
|
|
|
d738b9 |
return !krb5_realm_compare(context, err->client, client);
|
|
|
d738b9 |
}
|
|
|
d738b9 |
|
|
|
d738b9 |
+/* Transfer error padata to method data in ctx and sort it according to
|
|
|
d738b9 |
+ * configuration. */
|
|
|
d738b9 |
+static krb5_error_code
|
|
|
d738b9 |
+accept_method_data(krb5_context context, krb5_init_creds_context ctx)
|
|
|
d738b9 |
+{
|
|
|
d738b9 |
+ krb5_free_pa_data(context, ctx->method_padata);
|
|
|
d738b9 |
+ ctx->method_padata = ctx->err_padata;
|
|
|
d738b9 |
+ ctx->err_padata = NULL;
|
|
|
d738b9 |
+ return sort_krb5_padata_sequence(context, &ctx->request->client->realm,
|
|
|
d738b9 |
+ ctx->method_padata);
|
|
|
d738b9 |
+}
|
|
|
d738b9 |
+
|
|
|
d738b9 |
static krb5_error_code
|
|
|
d738b9 |
init_creds_step_reply(krb5_context context,
|
|
|
d738b9 |
krb5_init_creds_context ctx,
|
|
|
d738b9 |
@@ -1538,14 +1553,26 @@ init_creds_step_reply(krb5_context context,
|
|
|
d738b9 |
ctx->restarted = FALSE;
|
|
|
d738b9 |
code = restart_init_creds_loop(context, ctx, FALSE);
|
|
|
d738b9 |
} else if (reply_code == KDC_ERR_PREAUTH_REQUIRED && retry) {
|
|
|
d738b9 |
- krb5_free_pa_data(context, ctx->method_padata);
|
|
|
d738b9 |
- ctx->method_padata = ctx->err_padata;
|
|
|
d738b9 |
- ctx->err_padata = NULL;
|
|
|
d738b9 |
note_req_timestamp(context, ctx, ctx->err_reply->stime,
|
|
|
d738b9 |
ctx->err_reply->susec);
|
|
|
d738b9 |
- code = sort_krb5_padata_sequence(context,
|
|
|
d738b9 |
- &ctx->request->client->realm,
|
|
|
d738b9 |
- ctx->method_padata);
|
|
|
d738b9 |
+ code = accept_method_data(context, ctx);
|
|
|
d738b9 |
+ } else if (reply_code == KDC_ERR_PREAUTH_FAILED && retry) {
|
|
|
d738b9 |
+ note_req_timestamp(context, ctx, ctx->err_reply->stime,
|
|
|
d738b9 |
+ ctx->err_reply->susec);
|
|
|
d738b9 |
+ if (ctx->method_padata == NULL) {
|
|
|
d738b9 |
+ /* Optimistic preauth failed on the KDC. Allow all mechanisms
|
|
|
d738b9 |
+ * to be tried again using method data. */
|
|
|
d738b9 |
+ k5_reset_preauth_types_tried(ctx);
|
|
|
d738b9 |
+ } else {
|
|
|
d738b9 |
+ /* Don't try again with the mechanism that failed. */
|
|
|
d738b9 |
+ code = k5_preauth_note_failed(ctx, ctx->selected_preauth_type);
|
|
|
d738b9 |
+ if (code)
|
|
|
d738b9 |
+ goto cleanup;
|
|
|
d738b9 |
+ }
|
|
|
d738b9 |
+ ctx->selected_preauth_type = KRB5_PADATA_NONE;
|
|
|
d738b9 |
+ /* Accept or update method data if the KDC sent it. */
|
|
|
d738b9 |
+ if (ctx->err_padata != NULL)
|
|
|
d738b9 |
+ code = accept_method_data(context, ctx);
|
|
|
d738b9 |
} else if (reply_code == KDC_ERR_MORE_PREAUTH_DATA_REQUIRED && retry) {
|
|
|
d738b9 |
ctx->more_padata = ctx->err_padata;
|
|
|
d738b9 |
ctx->err_padata = NULL;
|