Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.427 (Entity 5.427) From: ghudson@mit.edu Subject: git commit X-RT-Original-Encoding: iso-8859-1 Content-Length: 1349 Try compatible keys in rd_req_dec "any" path When we go to decrypt a ticket using a keytab, we have two code paths. In the first (traditional) one, we try to read an entry that exactly matches the principal name, enctype, and kvno from the ticket, and then attempt to decrypt the ticket using the entry's key. The keytab routines helpfully return an entry so long as it's of a key type that's compatible with the ticket being decrypted, fixing up the enctype in the entry structure while doing so, allowing us to decrypt a DES-CBC-CRC ticket with a DES-CBC-MD5 key. In the second code path, we try the key of every entry which loosely matches the principal name from the ticket and which exactly matches its enctype, meaning that the ticket/keytab pair above won't work if the principal name is one which suggests we shouldn't be matching entries exactly. This change modifies the "any" path to also try to decrypt the ticket with compatible keys. [ghudson@mit.edu: avoid stuffing too much logic in one conditional] https://github.com/krb5/krb5/commit/4f99c75eb6b1a53d78b26648e39309261e37755c Author: Nalin Dahyabhai Committer: Greg Hudson Commit: 4f99c75eb6b1a53d78b26648e39309261e37755c Branch: master src/lib/krb5/krb/rd_req_dec.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-)