[krbdev.mit.edu #9137] kg_acceptor_princ behavior

Sat Aug 24 02:10:38 2024: Request 9137 was acted upon.
 Transaction: Ticket created by [email protected]
       Queue: krb5
     Subject: kg_acceptor_princ behavior
       Owner: Nobody
  Requestors: [email protected]
      Status: new
 Ticket <URL: http://kerborg-prod-app-1.mit.edu/rt/Ticket/Display.html?id=9137 >


In kg_acceptor_princ() [ found in lib/gssapi/krb5/naming_exts.c ]
exists the following:

    if (name->host != NULL && name->princ->length == 2) {
        /* If a host was given, we have to use the canonicalized form of it (as
         * given by krb5_sname_to_principal) for backward compatibility. */
        const krb5_data *d = &name->princ->data[1];
        tmp = k5memdup0(d->data, d->length, &code);
        if (tmp == NULL)
            return ENOMEM;
        host = tmp;
    } else ...

This is seriously annoying (esp as krb5_sname_to_principal() gives you the OPTION to canonicalize or not).
What exactly is it we are being backwards compatible with?

Grumpily yours,
John


John Hascall
Sr Security Architect
IT Services
Iowa State University
[email protected]