gsskrb5: always return an acceptor subkey

For non cfx keys it's the same as the intiator subkey.
This matches windows behavior.

metze

diff --git a/source/heimdal/lib/gssapi/krb5/accept_sec_context.c b/source/heimdal/lib/gssapi/krb5/accept_sec_context.c
index 8dbd087da62669129a0c6896630c27544c78ffac..a6f0f31246c03b7772eb0fd42b1cbdbd4e8bea22 100644 (file)
--- a/source/heimdal/lib/gssapi/krb5/accept_sec_context.c
+++ b/source/heimdal/lib/gssapi/krb5/accept_sec_context.c
@@ -520,16 +520,30 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
     
     if(ctx->flags & GSS_C_MUTUAL_FLAG) {
        krb5_data outbuf;
+       int use_subkey = 0;
            
        _gsskrb5i_is_cfx(ctx, &is_cfx);
            
        if (is_cfx != 0 
            || (ap_options & AP_OPTS_USE_SUBKEY)) {
-           kret = krb5_auth_con_addflags(context,
-                                         ctx->auth_context,
-                                         KRB5_AUTH_CONTEXT_USE_SUBKEY,
-                                         NULL);
+           use_subkey = 1;
+       } else {
+           krb5_keyblock *rkey;
+           kret = krb5_auth_con_getremotesubkey(context, ctx->auth_context, &rkey);
+           if (kret == 0) {
+               kret = krb5_auth_con_setlocalsubkey(context, ctx->auth_context, rkey);
+               if (kret == 0) {
+                   use_subkey = 1;
+               }
+               krb5_free_keyblock(context, rkey);
+           }
+       }
+       if (use_subkey) {
            ctx->more_flags |= ACCEPTOR_SUBKEY;
+           krb5_auth_con_addflags(context,
+                                  ctx->auth_context,
+                                  KRB5_AUTH_CONTEXT_USE_SUBKEY,
+                                  NULL);
        }
            
        kret = krb5_mk_rep(context,