diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c index a5c318f00..864b8bf40 100644 --- a/kdc/kerberos5.c +++ b/kdc/kerberos5.c @@ -123,11 +123,11 @@ is_anon_as_request_p(kdc_request_t r) KDC_REQ_BODY *b = &r->req.req_body; /* - * Some versions of heimdal use bit 14 instead of 16 for - * request_anonymous, as indicated in the anonymous draft prior to - * version 11. Bit 14 is assigned to S4U2Proxy, but S4U2Proxy requests - * are only sent to the TGS and, in any case, would have an additional - * ticket present. + * Versions of Heimdal from 0.9rc1 through 1.50 use bit 14 instead + * of 16 for request_anonymous, as indicated in the anonymous draft + * prior to version 11. Bit 14 is assigned to S4U2Proxy, but S4U2Proxy + * requests are only sent to the TGS and, in any case, would have an + * additional ticket present. */ return b->kdc_options.request_anonymous || (b->kdc_options.cname_in_addl_tkt && !b->additional_tickets); diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c index 3ba242037..230f6a2c9 100644 --- a/kdc/krb5tgs.c +++ b/kdc/krb5tgs.c @@ -373,7 +373,7 @@ is_anon_tgs_request_p(const KDC_REQ_BODY *b, KDCOptions f = b->kdc_options; /* - * Earlier (pre-7.6) versions of Heimdal would send both the + * Versions of Heimdal from 1.0 to 7.6, inclusive, send both the * request-anonymous and cname-in-addl-tkt flags for constrained * delegation requests. A true anonymous TGS request will only * have the request-anonymous flag set. (A corollary of this is