From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Wed, 5 Jul 2023 04:21:07 +0000 (+1200)
Subject: third_party/heimdal: Import lorikeet-heimdal-202307050413 (commit e0597fe1d01b109e64d... 
X-Git-Tag: talloc-2.4.1~19
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=81058c60136fba9af2dd7de8f15baef5e7e97bde;p=thirdparty%2Fsamba.git

third_party/heimdal: Import lorikeet-heimdal-202307050413 (commit e0597fe1d01b109e64d9c2a5bcada664ac199498)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9612

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 19 02:41:25 UTC 2023 on atb-devel-224
---

diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index ba225236c2e..8c4c7f73ff5 100644
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -67,7 +67,6 @@
 # PK-INIT tests
 #
 ^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_no_des3.ad_dc
-^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_revoked.ad_dc
 #
 # Windows 2000 PK-INIT tests
 #
diff --git a/third_party/heimdal/kdc/kerberos5.c b/third_party/heimdal/kdc/kerberos5.c
index 36db57cb36a..8a6add4d22c 100644
--- a/third_party/heimdal/kdc/kerberos5.c
+++ b/third_party/heimdal/kdc/kerberos5.c
@@ -579,7 +579,11 @@ pa_pkinit_validate(astgs_request_t r, const PA_DATA *pa)
 
     ret = _kdc_pk_rd_padata(r, pa, &pkp);
     if (ret || pkp == NULL) {
-	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	if (ret == HX509_CERT_REVOKED) {
+	    ret = KRB5_KDC_ERR_CLIENT_NOT_TRUSTED;	
+	} else {
+	    ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	}
 	_kdc_r_log(r, 4, "Failed to decode PKINIT PA-DATA -- %s",
 		   r->cname);
 	goto out;
diff --git a/third_party/heimdal/kdc/pkinit.c b/third_party/heimdal/kdc/pkinit.c
index b63f38e9aa9..080ead541b4 100644
--- a/third_party/heimdal/kdc/pkinit.c
+++ b/third_party/heimdal/kdc/pkinit.c
@@ -231,6 +231,7 @@ generate_dh_keyblock(krb5_context context,
 	    size -= dh_gen_keylen;
 	    memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
 	    memset(dh_gen_key, 0, size);
+	    dh_gen_keylen += size;
 	}
     } else if (client_params->keyex == USE_ECDH) {
 	if (client_params->u.ecdh.public_key == NULL) {
@@ -460,6 +461,8 @@ _kdc_pk_rd_padata(astgs_request_t priv,
     hx509_verify_attach_anchors(cp->verify_ctx, trust_anchors);
     hx509_certs_free(&trust_anchors);
 
+    hx509_verify_attach_revoke(cp->verify_ctx, kdc_identity->revokectx);
+
     if (config->pkinit_allow_proxy_certs)
 	hx509_verify_set_proxy_certificate(cp->verify_ctx, 1);
 
diff --git a/third_party/heimdal/lib/krb5/krb5.conf.5 b/third_party/heimdal/lib/krb5/krb5.conf.5
index 3258c116aab..fda55e3ed17 100644
--- a/third_party/heimdal/lib/krb5/krb5.conf.5
+++ b/third_party/heimdal/lib/krb5/krb5.conf.5
@@ -184,7 +184,8 @@ This is a multi-valued parameter naming one or more stores of
 anchors for PKINIT KDC certificates.
 .It Li pkinit_revoke = Va HX509-STORE ...
 This is a multi-valued parameter naming one or more stores of
-of CRLs for the issuers of PKINIT KDC certificates.
+CRLs for the issuers of PKINIT KDC certificates.
+Only the first valid CRL for a particular issuer will be checked.
 If no CRLs are configured, then CRLs will not be checked.
 This is because hx509 currently lacks support.
 .El
@@ -911,7 +912,8 @@ is also supported here.
 type stores are OpenSSL-style CA certificate hash directories.
 .It Li pkinit_revoke = Va HX509-STORE ...
 This is a multi-valued parameter naming one or more stores of
-of CRLs for the issuers of PKINIT client certificates.
+CRLs for the issuers of PKINIT client certificates.
+Only the first valid CRL for a particular issuer will be checked.
 If no CRLs are configured, then CRLs will not be checked.
 This is because the KDC will not dereference CRL distribution
 points nor request OCSP responses.
diff --git a/third_party/heimdal/lib/krb5/pkinit.c b/third_party/heimdal/lib/krb5/pkinit.c
index 2a0979b7e12..e3707e203a4 100644
--- a/third_party/heimdal/lib/krb5/pkinit.c
+++ b/third_party/heimdal/lib/krb5/pkinit.c
@@ -1493,6 +1493,7 @@ pk_rd_pa_reply_dh(krb5_context context,
 	    size -= dh_gen_keylen;
 	    memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
 	    memset(dh_gen_key, 0, size);
+	    dh_gen_keylen += size;
 	}
 
     } else {