From: Tom Yu <tlyu@mit.edu>
Date: Tue, 6 Dec 2011 00:07:11 +0000 (+0000)
Subject: pull up r25504 from trunk
X-Git-Tag: krb5-1.10-alpha2~6
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=982264e339cc17b94db711c0926affd03a8b58da;p=krb5.git

pull up r25504 from trunk

 ------------------------------------------------------------------------
 r25504 | ghudson | 2011-12-04 17:38:36 -0500 (Sun, 04 Dec 2011) | 20 lines

 ticket: 7033
 target_version: 1.10
 tags: pullup

 Set a default enctype for optimistic preauth

 When the client application requests optimistic preauth for a preauth
 type which uses the password, we don't have an etype-info2 to
 interpret since we haven't talked to the KDC.  So we need to guess an
 enctype, salt, and s2k parameters.  In 1.9 and prior, encrypted
 timestamp contained code to use the first requested enctype in this
 case, but encrypted challenge did not.  In 1.10 prior to this change,
 neither mechanism uses a reasonable default.

 Set a default enctype in krb5_init_creds_init so that all
 password-based preauth mechanisms will use a reasonable default in the
 optimistic preauth case.  The default salt and s2k parameters for this
 case will be the principal-based default salt and the enctype-based
 default parameters.

ticket: 7033
version_fixed: 1.10
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25524 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index 8351dfd30..2dd39478a 100644
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -938,6 +938,14 @@ krb5_init_creds_init(krb5_context context,
         goto cleanup;
     }
 
+    /*
+     * Set a default enctype for optimistic preauth.  If we're not doing
+     * optimistic preauth, this should ordinarily get overwritten when we
+     * process the etype-info2 of the preauth-required error.
+     */
+    if (ctx->request->nktypes > 0)
+        ctx->etype = ctx->request->ktype[0];
+
     /* addresess */
     if (opte->flags & KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST) {
         code = krb5_copy_addresses(context, opte->address_list,