use ETYPE_DES3_CBC_SHA1 for the verify step in verify_mic_des3

This allows a strict link between checksum types and key types to be
enforced.

Andrew Bartlett

diff --git a/source4/heimdal/lib/gssapi/krb5/verify_mic.c b/source4/heimdal/lib/gssapi/krb5/verify_mic.c
index af06e0a1e3d55b29b18de9a64e8a277832242974..0f5612491ddbc1558df8a1b4ea86f1309c660951 100644 (file)
--- a/source4/heimdal/lib/gssapi/krb5/verify_mic.c
+++ b/source4/heimdal/lib/gssapi/krb5/verify_mic.c
@@ -251,6 +251,14 @@ retry:
   csum.checksum.length = 20;
   csum.checksum.data   = p + 8;
 
+  krb5_crypto_destroy (context, crypto);
+  ret = krb5_crypto_init(context, key,
+                        ETYPE_DES3_CBC_SHA1, &crypto);
+  if (ret){
+      *minor_status = ret;
+      return GSS_S_FAILURE;
+  }
+
   ret = krb5_verify_checksum (context, crypto,
                              KRB5_KU_USAGE_SIGN,
                              tmp, message_buffer->length + 8,