In-Reply-To: <rt-4.4.3-2-2098325-1627412453-1373.9018-0-0@kerborg-prod-app-1.mit.edu>
X-RT-Original-Encoding: utf-8
References: <RT-Ticket-9018@kerborg-prod-app-1.mit.edu>
 <CAEZzL1Aj9gnC9FRiD5-rAr6CSPkDesN=A56qGL84-skLsQiW=w@mail.gmail.com>
 <rt-4.4.3-2-1906245-1627325601-39.9018-6-0@kerborg-prod-app-1.mit.edu>
 <CAEZzL1CrdGN8mp0iZzaKtcJ5rW0c3rb_4bdq6Wyo2g71uA_zCw@mail.gmail.com>
 <CAEZzL1CwYV9V2S+8PU4jULy3CcWBRhYBOfiP9KyQUveGm7X1rw@mail.gmail.com>
 <rt-4.4.3-2-2098325-1627412453-1373.9018-0-0@kerborg-prod-app-1.mit.edu>
Content-Disposition: inline
Content-Transfer-Encoding: binary
X-RT-Interface: Web
Message-ID: <rt-4.4.3-2-2538501-1627586172-797.9018-0-0@kerborg-prod-app-1.mit.edu>
MIME-Version: 1.0
X-Mailer: MIME-tools 5.509 (Entity 5.509)
Content-Type: text/html; charset="utf-8"
RT-Send-CC:
Content-Length: 1479

<div>On Tue Jul 27 15:00:53 2021, amandeepgautam5@gmail.com wrote:
<blockquote>
<div>
<div>Sending my response to wider audience as I forgot to add the main mailing list initially.</div>
</div>
</blockquote>
Although that&#39;s a good instinct for most public lists, it isn&#39;t necessary for this one.&nbsp; krb5-bugs@mit.edu is fed from the bug tracker and doesn&#39;t accept mail directly.

<blockquote>If you can add more details on (2), I will be happy to make the change and test it.</blockquote>
</div>

<div>If&nbsp;mech_requires_mechlistMIC() returns true, we want to send a MIC (because some Windows servers erroneously require one)&nbsp;but not require receiving one (because apparently some Windows servers erroneously don&#39;t send one if they receive one).&nbsp; Unfortunately, this will require some pretty close attention to detail, as the code currently assumes symmetric MIC requirements.&nbsp; One option is to split the mec_reqd flag into separate send and receive flags, but then each piece of code that uses it has to be analyzed for which half to pay attention to.&nbsp; The other is to move the mech_requires_mechlistMIC() check to the code that decides whether to send a MIC; that, too requires, some pretty close attention to the state machine.<br />
<br />
I can&#39;t really provide more guidance without doing the work myself.&nbsp; SPNEGO as specified is very complicated, and SPNEGO as badly implemented by other endpoints&nbsp;is more so.</div>