[20574] in Kerberos_V5_Development
Possible bug in handling of a renewable ok ticket
daemon@ATHENA.MIT.EDU (William Brown)
Wed Sep 30 00:58:23 2026
From: William Brown <william@firstyear.id.au>
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.700.81.1.10\))
Message-Id: <4E6DF881-D10A-4B36-A19B-569DE7CC19BA@firstyear.id.au>
Date: Wed, 30 Sep 2026 14:57:38 +1000
To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi there,
I believe I may have encountered a bug in the handling of a renewable ticket with mit krb5 kinit.
https://github.com/krb5/krb5/blob/master/src/lib/krb5/krb/get_in_tkt.c#L255
Here this check is asserting:
The request DOES contain RENEWABLE_OK
The request does NOT contain RENEWABLE
The reply DOES contain RENEWABLE
The request till (end time) was not zero.
And the reply renew_till (rtime) is less than request till (end time).
Given a AS_REQ that contains:
flags = RENEWABLE_OK
from = null
till = now + 8hours
rtime = null
And the AS_REP that contains:
flags = RENEWABLE
from = now
till = now + 15 minutes
rtime = now + 24 hours
Then this will be rejected by the client. I think its' not correct that this is rejected, since the KDC did respect the "till" time, and opted that renewable tickets are valid, and it's up to the KDC to determine the renewable lifetime given that the client did not request a bound on this value.
Should this check therefore be altered or removed to prevent rejection of tickets like this?
--
Sincerely,
William
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
