Possible bug in handling of a renewable ok ticket

[William Brown]

Hi there,

I believe I may have encountered a bug in the handling of a renewable ticket with mit krb5 kinit.

https://github.com/krb5/krb5/blob/master/src/lib/krb5/krb/get_in_tkt.c#L255

Here this check is asserting:

The request DOES contain RENEWABLE_OK
The request does NOT contain RENEWABLE
The reply DOES contain RENEWABLE
The request till (end time) was not zero.
And the reply renew_till (rtime) is less than request till (end time). 

Given a AS_REQ that contains:

flags = RENEWABLE_OK
from = null
till = now + 8hours
rtime = null

And the AS_REP that contains:

flags = RENEWABLE
from = now
till = now + 15 minutes
rtime = now + 24 hours

Then this will be rejected by the client. I think its' not correct that this is rejected, since the KDC did respect the "till" time, and opted that renewable tickets are valid, and it's up to the KDC to determine the renewable lifetime given that the client did not request a bound on this value. 

Should this check therefore be altered or removed to prevent rejection of tickets like this? 

-- 
Sincerely,

William