Possible bug in handling of a renewable ok ticket

[William Brown]

> On 30 Sep 2026, at 16:33, Greg Hudson <ghudson at mit.edu> wrote:
> 
> On 9/30/26 00:57, William Brown wrote:
>> I think its' not correct that this is rejected, since the KDC did respect the "till" time, and opted that renewable tickets are valid, and it's up to the KDC to determine the renewable lifetime given that the client did not request a bound on this value.
> RFC 4120 section 2.9.1 says:
> 
>   The RENEWABLE-OK option indicates that the client will accept a
>   renewable ticket if a ticket with the requested life cannot otherwise
>   be provided.  If a ticket with the requested life cannot be provided,
>   then the KDC MAY issue a renewable ticket with a renew-till equal to
>   the requested endtime.  The value of the renew-till field MAY still
>   be adjusted by site-determined limits or limits imposed by the
>   individual principal or server.
> 
> This could probably be clearer, but my reading agrees with the current code: the KDC may respond with renew-till equal to the requested endtime, or with renew-till less than the requested endtime because of an applicable policy restriction, but it should not make up a longer renewable time than the requested endtime.  The missing rtime field is not relevant; rtime only applies to RENEWABLE, not RENEWABLE-OK.
> 


The code in question compares that rtime is less than, not less than or equal so a KDC that returns renew_till == request->till also has their ticket rejected. 


-- 
Sincerely,

William