Skip Menu |
 

History Show all quoted text — Show full headers
# Tue Feb 07 11:51:16 2017 ghudson@mit.edu (Greg Hudson) - Ticket #8547: - Ticket created
Subject: Allow client principal canonicalization for non-TGT AS requests
Download (untitled) / with headers
text/plain 538B
get_in_tkt.c:verify_as_reply() allows changes to the client and server
principals in the reply under certain conditions. We only allow changes
to the server principal if the requested and received server principal
are krbtgt principals, in order to mitigate some of the attacks
described in the security considerations of RFC 6806. However, we also
disallow changes to the client principal for non-krbtgt requests, which
does not seem to have any rationale. See:

http://mailman.mit.edu/pipermail/krbdev/2017-February/012721.html
# Sun Nov 03 13:56:46 2019 ghudson@mit.edu (Greg Hudson) - Ticket created
From: ghudson@mit.edu
Subject: git commit
Download (untitled) / with headers
text/plain 1KiB

Allow client canonicalization in non-krbtgt AS-REP

If a caller makes an AS-REQ with the canonicalize flag set (or with an
enterprise client principal or the anonymous flag), always allow the
KDC to change the client principal. Continue to restrict server name
changes to requests for TGS principals.

Also remove the conditional for setting canon_ok for fully anonymous
requests. Both kinds of anonymous requests change the client
principal or realm, but neither kind changes the server principal or
realm, so this logic is no longer needed now that canon_ok only
applies to server name changes.

[ghudson@mit.edu: clarified commit message; removed anonymous PKINIT
clause]

https://github.com/krb5/krb5/commit/c6c19b1d35c6523cb7ed220c1f2e97e12e039293
Author: Isaac Boukris <iboukris@gmail.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: c6c19b1d35c6523cb7ed220c1f2e97e12e039293
Branch: master
src/lib/krb5/krb/get_in_tkt.c | 9 ++-------
src/tests/t_kdb.py | 3 +++
2 files changed, 5 insertions(+), 7 deletions(-)
# Sun Nov 03 13:56:46 2019 ghudson@mit.edu (Greg Hudson) - Requestor ghudson@mit.edu (Greg Hudson) added
# Sun Nov 03 13:56:46 2019 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'resolved'
# Tue Jan 07 20:03:18 2020 ghudson@mit.edu (Greg Hudson) - Version_Fixed 1.18 added
# Mon Aug 24 18:38:32 2020 ghudson@mit.edu (Greg Hudson) - Ticket #8547: - Merged into #8843: Allow client canonicalization in non-krbtgt AS-REP
# Mon Aug 24 18:38:32 2020 ghudson@mit.edu (Greg Hudson) - Merged into #8843: Allow client canonicalization in non-krbtgt AS-REP