krb5 commit: Don't change realm in find_alternate_tgs

[Greg Hudson]

https://github.com/krb5/krb5/commit/ba31a9317bdef13d73e98afe493695601f91d134
commit ba31a9317bdef13d73e98afe493695601f91d134
Author: Greg Hudson <ghudson at mit.edu>
Date:   Thu Aug 29 09:07:57 2013 -0400

    Don't change realm in find_alternate_tgs
    
    If a client makes a TGS request for a cross-realm TGS within a
    different realm from the one we normally serve (e.g. the KDC realm is
    X, and a client makes a TGS request for the server krbtgt/Y at Z), look
    for alternate TGS principals within the requested server realm, not
    the realm we normally serve.
    
    This change shouldn't break any working well-formed TGS requests,
    because changing the realm would trigger a failure in check_tgs_tgt.
    It may fix some corner cases when multiple realms are served out of
    the same KDB.  But primarily, this change makes referrals and aliases
    easier to reason about, by eliminating a case where server->princ has
    a different realm from request->server after the call to
    search_sprinc().

 src/kdc/do_tgs_req.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 6415e28..e66badb 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -1027,7 +1027,7 @@ find_alternate_tgs(kdc_realm_t *kdc_active_realm, krb5_principal princ,
     while (--pl2 > plist) {
         tmp = *krb5_princ_realm(kdc_context, *pl2);
         krb5_princ_set_realm(kdc_context, *pl2,
-                             krb5_princ_realm(kdc_context, tgs_server));
+                             krb5_princ_realm(kdc_context, princ));
         retval = db_get_svc_princ(kdc_context, *pl2, 0, &server, status);
         krb5_princ_set_realm(kdc_context, *pl2, &tmp);
         if (retval == KRB5_KDB_NOENTRY)