From: Greg Hudson <ghudson@mit.edu>
Date: Thu, 29 Aug 2013 13:07:57 +0000 (-0400)
Subject: Don't change realm in find_alternate_tgs
X-Git-Tag: krb5-1.12-alpha1~42
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ba31a9317bdef13d73e98afe493695601f91d134;p=thirdparty%2Fkrb5.git

Don't change realm in find_alternate_tgs

If a client makes a TGS request for a cross-realm TGS within a
different realm from the one we normally serve (e.g. the KDC realm is
X, and a client makes a TGS request for the server krbtgt/Y@Z), look
for alternate TGS principals within the requested server realm, not
the realm we normally serve.

This change shouldn't break any working well-formed TGS requests,
because changing the realm would trigger a failure in check_tgs_tgt.
It may fix some corner cases when multiple realms are served out of
the same KDB.  But primarily, this change makes referrals and aliases
easier to reason about, by eliminating a case where server->princ has
a different realm from request->server after the call to
search_sprinc().
---

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 6415e28801..e66badbbad 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -1027,7 +1027,7 @@ find_alternate_tgs(kdc_realm_t *kdc_active_realm, krb5_principal princ,
     while (--pl2 > plist) {
         tmp = *krb5_princ_realm(kdc_context, *pl2);
         krb5_princ_set_realm(kdc_context, *pl2,
-                             krb5_princ_realm(kdc_context, tgs_server));
+                             krb5_princ_realm(kdc_context, princ));
         retval = db_get_svc_princ(kdc_context, *pl2, 0, &server, status);
         krb5_princ_set_realm(kdc_context, *pl2, &tmp);
         if (retval == KRB5_KDB_NOENTRY)