Possible bug in handling of a renewable ok ticket

[Greg Hudson]

On 9/30/26 02:34, William Brown wrote:
> The code in question compares that rtime is less than, not less than or 
> equal so a KDC that returns renew_till == request->till also has their 
> ticket rejected.
I don't believe this is true.  The code rejects if 
"ts_after(as_reply->enc_part2->times.renew_till, request->till)" which 
is an A > B test, so it accepts if A <= B.

I tested with:

   make testrealm
   kadmin.local modprinc -maxlife 1h user
   kadmin.local modprinc -maxrenewlife 2h user
   kadmin.local modprinc -maxrenewlife 2h krbtgt/KRBTEST.COM
   gdb --args kinit -l 2h user
   (gdb) break get_in_tkt.c:236
   (gdb) run

and verified that "request->kdc_options & KDC_OPT_RENEWABLE_OK" is 
non-zero, "request->kdc_options & KDC_OPT_RENEWABLE" is zero, 
"as_reply->enc_part2->flags & KDC_OPT_RENEWABLE" is non-zero, and 
as_reply->enc_part2->times.renew_till == request->till.

I also think the tests in t_renew.py would fail if the test behaved as 
you said.