[20579] in Kerberos_V5_Development
Re: Possible bug in handling of a renewable ok ticket
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Sep 30 03:03:36 2026
Message-ID: <60e5aea9-f305-4cb0-9fbb-091b0e19fee9@mit.edu>
Date: Wed, 30 Sep 2026 03:03:03 -0400
MIME-Version: 1.0
To: William Brown <william@firstyear.id.au>
Cc: krbdev@mit.edu
Content-Language: en-US
From: "Greg Hudson" <ghudson@mit.edu>
In-Reply-To: <71BD4329-9C51-4C6D-9984-057810BD85E8@firstyear.id.au>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: krbdev-bounces@mit.edu
On 9/30/26 02:34, William Brown wrote:
> The code in question compares that rtime is less than, not less than or
> equal so a KDC that returns renew_till == request->till also has their
> ticket rejected.
I don't believe this is true. The code rejects if
"ts_after(as_reply->enc_part2->times.renew_till, request->till)" which
is an A > B test, so it accepts if A <= B.
I tested with:
make testrealm
kadmin.local modprinc -maxlife 1h user
kadmin.local modprinc -maxrenewlife 2h user
kadmin.local modprinc -maxrenewlife 2h krbtgt/KRBTEST.COM
gdb --args kinit -l 2h user
(gdb) break get_in_tkt.c:236
(gdb) run
and verified that "request->kdc_options & KDC_OPT_RENEWABLE_OK" is
non-zero, "request->kdc_options & KDC_OPT_RENEWABLE" is zero,
"as_reply->enc_part2->flags & KDC_OPT_RENEWABLE" is non-zero, and
as_reply->enc_part2->times.renew_till == request->till.
I also think the tests in t_renew.py would fail if the test behaved as
you said.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
