From: Andreas Schneider <asn@cryptomilk.org>
Date: Fri, 23 Jan 2026 15:32:57 +0000 (+0100)
Subject: Fix IAKERB realm discovery state machine logic
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5de16db5935c5a23f5548de1004cb4d7896c716b;p=thirdparty%2Fkrb5.git

Fix IAKERB realm discovery state machine logic

In iakerb_initiator_step(), when realm discovery completes, set the
state to IAKERB_AS_REQ so we don't repeat the overwrite of
cred->name->princ->realm on the next token.

ticket: 9194 (new)
tags: pullup
target_version: 1.22-next
---

diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
index 90a9bce11a..7cc4710e25 100644
--- a/src/lib/gssapi/krb5/iakerb.c
+++ b/src/lib/gssapi/krb5/iakerb.c
@@ -631,6 +631,7 @@ iakerb_initiator_step(iakerb_ctx_id_t ctx,
         cred->name->princ->realm = server_realm;
         server_realm = empty_data();
 
+        ctx->state = IAKERB_AS_REQ;
         /* Done with realm discovery; fall through to AS request. */
     case IAKERB_AS_REQ:
         if (ctx->icc == NULL) {