HEIMDAL: allow optional q in DH DomainParameters

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12986

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from heimdal commit e8317b955f5a390c4f296871ba6987ad05478c95)

(cherry picked from commit 9f245aafdca8397df7dc050e25cfd858aeb1cc7f)

diff --git a/source4/heimdal/kdc/pkinit.c b/source4/heimdal/kdc/pkinit.c
index d85b15650073d2b282fb7ce65e63c13867c710dc..3a9e8f266cefb012e58925e3213a54ab9bd5ce5f 100644 (file)
--- a/source4/heimdal/kdc/pkinit.c
+++ b/source4/heimdal/kdc/pkinit.c
@@ -361,7 +361,7 @@ get_dh_param(krb5_context context,
     }
 
     ret = _krb5_dh_group_ok(context, config->pkinit_dh_min_bits,
-                           &dhparam.p, &dhparam.g, &dhparam.q, moduli,
+                           &dhparam.p, &dhparam.g, dhparam.q, moduli,
                            &client_params->dh_group_name);
     if (ret) {
        /* XXX send back proposal of better group */

diff --git a/source4/heimdal/lib/asn1/rfc2459.asn1 b/source4/heimdal/lib/asn1/rfc2459.asn1
index 5df9e41fffd2f92362e520d598193a4c5f21aa09..d6c273d0ec57445eb6432dc12a79b836c8f80c61 100644 (file)
--- a/source4/heimdal/lib/asn1/rfc2459.asn1
+++ b/source4/heimdal/lib/asn1/rfc2459.asn1
@@ -239,7 +239,7 @@ ValidationParms ::= SEQUENCE {
 DomainParameters ::= SEQUENCE {
        p               INTEGER, -- odd prime, p=jq +1
        g               INTEGER, -- generator, g
-       q               INTEGER, -- factor of p-1
+       q               INTEGER OPTIONAL, -- factor of p-1
        j               INTEGER OPTIONAL, -- subgroup factor
        validationParms ValidationParms OPTIONAL -- ValidationParms
 }

diff --git a/source4/heimdal/lib/krb5/pkinit.c b/source4/heimdal/lib/krb5/pkinit.c
index 1103a17807be9e1240339580775c203073669244..c30a298a15c992a64a072fcd9424d660602b8996 100644 (file)
--- a/source4/heimdal/lib/krb5/pkinit.c
+++ b/source4/heimdal/lib/krb5/pkinit.c
@@ -497,7 +497,12 @@ build_auth_pack(krb5_context context,
                free_DomainParameters(&dp);
                return ret;
            }
-           ret = BN_to_integer(context, dh->q, &dp.q);
+           dp.q = calloc(1, sizeof(*dp.q));
+           if (dp.q == NULL) {
+               free_DomainParameters(&dp);
+               return ENOMEM;
+           }
+           ret = BN_to_integer(context, dh->q, dp.q);
            if (ret) {
                free_DomainParameters(&dp);
                return ret;