From 64c15ad2b8f4af57ffd998fc27f3781cc02bff29 Mon Sep 17 00:00:00 2001
From: Greg Hudson <ghudson@mit.edu>
Date: Mon, 16 Jan 2017 15:09:32 -0500
Subject: [PATCH] Continue after KDC_ERR_PREAUTH_FAILED

If the KDC sends KDC_ERR_PREAUTH_FAILED, try another mechanism, or
send an unauthenticated request if optimistic preauth failed.

ticket: 8537
(cherry picked from commit 52d2de31bc4728dbc2f59c6033dcdab86da919e9)
---
 src/lib/krb5/krb/get_in_tkt.c | 45 ++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 9 deletions(-)

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index 8d0f964f9..c7d7bfe74 100644
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -1308,6 +1308,7 @@ init_creds_step_request(krb5_context context,
     krb5_error_code code;
     krb5_preauthtype pa_type;
     struct errinfo save = EMPTY_ERRINFO;
+    uint32_t rcode = (ctx->err_reply == NULL) ? 0 : ctx->err_reply->error;
 
     if (ctx->loopcount >= MAX_IN_TKT_LOOPS) {
         code = KRB5_GET_IN_TKT_LOOP;
@@ -1358,8 +1359,10 @@ init_creds_step_request(krb5_context context,
         TRACE_INIT_CREDS_PREAUTH_MORE(context, ctx->selected_preauth_type);
         code = k5_preauth(context, ctx, ctx->more_padata, TRUE,
                           &ctx->request->padata, &pa_type);
-    } else if (ctx->err_reply != NULL &&
-               ctx->err_reply->error != KDC_ERR_PREAUTH_REQUIRED) {
+    } else if (rcode == KDC_ERR_PREAUTH_FAILED) {
+        /* Report the KDC-side failure code if we can't try another mech. */
+        code = KRB5KDC_ERR_PREAUTH_FAILED;
+    } else if (rcode && rcode != KDC_ERR_PREAUTH_REQUIRED) {
         /* Retrying after an error (possibly mechanism-specific), using error
          * padata to figure out what to change. */
         TRACE_INIT_CREDS_PREAUTH_TRYAGAIN(context, ctx->err_reply->error,
@@ -1380,7 +1383,7 @@ init_creds_step_request(krb5_context context,
 
     if (ctx->request->padata == NULL && ctx->method_padata != NULL) {
         /* Retrying after KDC_ERR_PREAUTH_REQUIRED, or trying again with a
-         * different mechanism after a client-side failure. */
+         * different mechanism after a failure. */
         TRACE_INIT_CREDS_PREAUTH(context);
         code = k5_preauth(context, ctx, ctx->method_padata, TRUE,
                           &ctx->request->padata, &ctx->selected_preauth_type);
@@ -1480,6 +1483,18 @@ is_referral(krb5_context context, krb5_error *err, krb5_principal client)
     return !krb5_realm_compare(context, err->client, client);
 }
 
+/* Transfer error padata to method data in ctx and sort it according to
+ * configuration. */
+static krb5_error_code
+accept_method_data(krb5_context context, krb5_init_creds_context ctx)
+{
+    krb5_free_pa_data(context, ctx->method_padata);
+    ctx->method_padata = ctx->err_padata;
+    ctx->err_padata = NULL;
+    return sort_krb5_padata_sequence(context, &ctx->request->client->realm,
+                                     ctx->method_padata);
+}
+
 static krb5_error_code
 init_creds_step_reply(krb5_context context,
                       krb5_init_creds_context ctx,
@@ -1538,14 +1553,26 @@ init_creds_step_reply(krb5_context context,
             ctx->restarted = FALSE;
             code = restart_init_creds_loop(context, ctx, FALSE);
         } else if (reply_code == KDC_ERR_PREAUTH_REQUIRED && retry) {
-            krb5_free_pa_data(context, ctx->method_padata);
-            ctx->method_padata = ctx->err_padata;
-            ctx->err_padata = NULL;
             note_req_timestamp(context, ctx, ctx->err_reply->stime,
                                ctx->err_reply->susec);
-            code = sort_krb5_padata_sequence(context,
-                                             &ctx->request->client->realm,
-                                             ctx->method_padata);
+            code = accept_method_data(context, ctx);
+        } else if (reply_code == KDC_ERR_PREAUTH_FAILED && retry) {
+            note_req_timestamp(context, ctx, ctx->err_reply->stime,
+                               ctx->err_reply->susec);
+            if (ctx->method_padata == NULL) {
+                /* Optimistic preauth failed on the KDC.  Allow all mechanisms
+                 * to be tried again using method data. */
+                k5_reset_preauth_types_tried(ctx);
+            } else {
+                /* Don't try again with the mechanism that failed. */
+                code = k5_preauth_note_failed(ctx, ctx->selected_preauth_type);
+                if (code)
+                    goto cleanup;
+            }
+            ctx->selected_preauth_type = KRB5_PADATA_NONE;
+            /* Accept or update method data if the KDC sent it. */
+            if (ctx->err_padata != NULL)
+                code = accept_method_data(context, ctx);
         } else if (reply_code == KDC_ERR_MORE_PREAUTH_DATA_REQUIRED && retry) {
             ctx->more_padata = ctx->err_padata;
             ctx->err_padata = NULL;