krb5 commit: Relax gss_init_sec_context() proxy self check

https://github.com/krb5/krb5/commit/473b51b640bef2e97c490d6f2985658befa89c16
commit 473b51b640bef2e97c490d6f2985658befa89c16
Author: Alexander Bokovoy <[email protected]>
Date:   Fri Mar 27 13:48:59 2026 +0200

    Relax gss_init_sec_context() proxy self check
    
    If the krb5 gss_init_sec_context() detects a proxy ccache, we check in
    get_credentials() whether the requested server principal matches the
    cache's impersonator principal.  For a host-based server name, this
    match will fail if krb5_sname_to_principal() yielded an empty realm,
    as it does in most configurations.
    
    As host-based principals generally only exist in one realm for a given
    FQDN, we can ignore the realm for this comparison when the server name
    is host-based.
    
    [[email protected]: rewrote comment and commit message; adjusted code to
    use krb5_principal_compare_flags()]
    
    ticket: 9225 (new)

 src/lib/gssapi/krb5/init_sec_context.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c
index 27011d0c9..208d4eefd 100644
--- a/src/lib/gssapi/krb5/init_sec_context.c
+++ b/src/lib/gssapi/krb5/init_sec_context.c
@@ -124,7 +124,7 @@ get_credentials(krb5_context context, krb5_gss_cred_id_t cred,
 {
     krb5_error_code     code;
     krb5_creds          in_creds, evidence_creds, mcreds, *result_creds = NULL;
-    krb5_flags          flags = 0;
+    krb5_flags          flags = 0, cmpflag = 0;
     krb5_principal_data server_data;
 
     *out_creds = NULL;
@@ -163,10 +163,17 @@ get_credentials(krb5_context context, krb5_gss_cred_id_t cred,
 
     /* Try constrained delegation if we have proxy credentials. */
     if (cred->impersonator != NULL) {
-        /* If we are trying to get a ticket to ourselves, we should use the
-         * the evidence ticket directly from cache. */
-        if (krb5_principal_compare(context, cred->impersonator,
-                                   server->princ)) {
+        /*
+         * If we are trying to get a ticket to the impersonator, we should use
+         * the the evidence ticket directly from the cache.  If the server name
+         * is host-based, ignore the realm for this comparison;
+         * krb5_sname_to_principal() probably yielded an empty realm, and
+         * host-based principals generally only exist in one realm.
+         */
+        if (server->princ->type == KRB5_NT_SRV_HST)
+            cmpflag = KRB5_PRINCIPAL_COMPARE_IGNORE_REALM;
+        if (krb5_principal_compare_flags(context, cred->impersonator,
+                                         server->princ, cmpflag)) {
             flags |= KRB5_GC_CACHED;
         } else {
             memset(&mcreds, 0, sizeof(mcreds));