According to https://krbdev.mit.edu/rt/Ticket/Display.html?id=9181,
The function verify_mic_v3() in src/lib/gssapi/krb5/verify_mic.c
calls kg_verify_checksum_v3() as it returns an OM_uint32 status
but kg_verify_checksum_v3() returns a krb5_boolean which has
the opposite interpretation:
- OM_uint32 0 is GSS_S_COMPLETE so no error
- krb5_boolean 0 is false so failure
There are at least two ways to fix this:
- modify verify_mic_v3() body
- kg_verify_checksum_v3() to return an OM_uint32 and update the other call in unwrap_v3() in src/lib/gssapi/krb5/unwap.c
Obtained from: Greg Hudson <rt@krbdev.mit.edu> on krbdev.mit.edu ML.