From: Greg Hudson <ghudson@mit.edu>
Date: Thu, 3 Sep 2015 16:38:44 +0000 (-0400)
Subject: Fix KDC client referrals
X-Git-Tag: krb5-1.12.5-final~20
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=437fbad4bfb7176d304eed7cdc4b877afa6d9a7d;p=thirdparty%2Fkrb5.git

Fix KDC client referrals

Although our built-in KDB modules do not support client referrals for
AS requests, the KDC is supposed to return one if a third-party module
returns a DB entry containing a principal in a foreign realm.
Unfortunately, this code has never worked; in prepare_error_as(), we
erroneously compare the protocol code errcode against the com_err code
KRB5KDC_ERR_WRONG_REALM; as a result, we never supply the canonical
client principal.  Fix this by comparing errcode against the protocol
code KDC_ERR_WRONG_REALM instead.

Discovered by Alexander Bokovoy and Simo Sorce.

(cherry picked from commit 4e036ef4127a9b09d1a567472da1df24c55cdb89)

ticket: 8312 (new)
version_fixed: 1.12.5
status: resolved
---

diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index 95c3e23620..fa54c5daae 100644
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -805,7 +805,7 @@ prepare_error_as (struct kdc_request_state *rstate, krb5_kdc_req *request,
         return retval;
     errpkt.error = error;
     errpkt.server = request->server;
-    errpkt.client = (error == KRB5KDC_ERR_WRONG_REALM) ? canon_client :
+    errpkt.client = (error == KDC_ERR_WRONG_REALM) ? canon_client :
         request->client;
     errpkt.text = string2data((char *)status);