third_party/heimdal: Import lorikeet-heimdal-202407041740 (commit 42ba2a6e5dd1bc14a8b...

Fix clock skew error message and memory cache clock skew recovery

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15676

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul  5 10:02:26 UTC 2024 on atb-devel-224

(cherry picked from commit e4d6a19e49260af22bffd2a417119489719ba364)

Autobuild-User(v4-19-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-19-test): Wed Jul 10 13:29:02 UTC 2024 on atb-devel-224

diff --git a/third_party/heimdal/lib/krb5/fast.c b/third_party/heimdal/lib/krb5/fast.c
index 90133a7abc0e774d70d39a9546a958bc8038c1a1..4026ed6232769de914f2d552181463689307cf22 100644 (file)
--- a/third_party/heimdal/lib/krb5/fast.c
+++ b/third_party/heimdal/lib/krb5/fast.c
@@ -691,10 +691,14 @@ _krb5_fast_unwrap_error(krb5_context context,
     idx = 0;
     pa = krb5_find_padata(md->val, md->len, KRB5_PADATA_FX_FAST, &idx);
     if (pa == NULL) {
-       ret = KRB5_KDCREP_MODIFIED;
-       krb5_set_error_message(context, ret,
-                              N_("FAST fast response is missing FX-FAST", ""));
-       goto out;
+       /*
+        * Typically _krb5_fast_wrap_req() has set KRB5_FAST_EXPECTED, which
+        * means check_fast() will complain and return KRB5KRB_AP_ERR_MODIFIED.
+        *
+        * But for TGS-REP init_tgs_req() clears KRB5_FAST_EXPECTED and we'll
+        * ignore a missing KRB5_PADATA_FX_FAST.
+        */
+       return check_fast(context, state);
     }
 
     ret = unwrap_fast_rep(context, state, pa, &fastrep);

diff --git a/third_party/heimdal/lib/krb5/mcache.c b/third_party/heimdal/lib/krb5/mcache.c
index fdd5674c3b87f980f5f35c8af579557f42d67a1f..e916bf4e6be3b7a8b7af540ca35dd067e69b964d 100644 (file)
--- a/third_party/heimdal/lib/krb5/mcache.c
+++ b/third_party/heimdal/lib/krb5/mcache.c
@@ -225,7 +225,7 @@ mcc_initialize(krb5_context context,
      */
     mcc_destroy_internal(context, m);
     m->dead = 0;
-    m->kdc_offset = 0;
+    m->kdc_offset = context->kdc_sec_offset;
     m->mtime = time(NULL);
     ret = krb5_copy_principal (context,
                               primary_principal,