Ticket History #6768: GSSAPI forwarded credentials must be encrypted in session key

Ticket update.

Thanks to git-bisect and Luke Howard it appears the problem has been
identified.

The bug has been introduced with this commit:
https://github.com/krb5/krb5/commit/dc3ba26a2c9acde7ca4ed9260fdc01997511e478

The issu is in the reordering of the checksum check in
krb5_mk_req_extended()

The attached patch is a temporary workaround that shows the issue is
indeed in that reordering as I am able to pass the rpcclient test using it.
It is not final because apparently it breaks IAKRB.
A better patch should follow.

diff --git a/src/lib/krb5/krb/mk_req_ext.c b/src/lib/krb5/krb/mk_req_ext.c
index 3a4004d..4de3191 100644
--- a/src/lib/krb5/krb/mk_req_ext.c
+++ b/src/lib/krb5/krb/mk_req_ext.c
@@ -141,6 +141,15 @@ krb5_mk_req_extended(krb5_context context, krb5_auth_context *auth_context,
goto cleanup;
}

+ if (!in_data && (*auth_context)->checksum_func) {
+ retval = (*auth_context)->checksum_func( context,
+ *auth_context,
+ (*auth_context)->checksum_func_data,
+ &in_data);
+ if (retval)
+ goto cleanup;
+ }
+
/* generate subkey if needed */
if ((ap_req_options & AP_OPTS_USE_SUBKEY)&&(!(*auth_context)->send_subkey)) {
retval = krb5int_generate_and_save_subkey (context, *auth_context,
@@ -151,15 +160,6 @@ krb5_mk_req_extended(krb5_context context, krb5_auth_context *auth_context,
}


- if (!in_data && (*auth_context)->checksum_func) {
- retval = (*auth_context)->checksum_func( context,
- *auth_context,
- (*auth_context)->checksum_func_data,
- &in_data);
- if (retval)
- goto cleanup;
- }
-
if (in_data) {
if ((*auth_context)->req_cksumtype == 0x8003) {
/* XXX Special hack for GSSAPI */