#
# Patch to make des-cbc-md5 equivalent to des-cbc-crc when the KDC is deciding
# to issue a des session key for a service princ.  This maintains existing
# Solaris behavior that MIT does not intend on adopting given that single des
# is on the way out.
# Patch source: in-house
#

--- a/src/kdc/kdc_util.c
+++ b/src/kdc/kdc_util.c
@@ -987,16 +987,11 @@ dbentry_supports_enctype(kdc_realm_t *kdc_active_realm, krb5_db_entry *server,
     free(etypes);
 
     /* If configured to, assume every server without a session_enctypes
-     * attribute supports DES_CBC_CRC. */
+     * attribute supports DES_CBC_CRC or DES_CBC_MD5. */
     if (kdc_active_realm->realm_assume_des_crc_sess &&
-        enctype == ENCTYPE_DES_CBC_CRC)
+        (enctype == ENCTYPE_DES_CBC_CRC || enctype == ENCTYPE_DES_CBC_MD5))
         return TRUE;
 
-    /* Due to an ancient interop problem, assume nothing supports des-cbc-md5
-     * unless there's a session_enctypes explicitly saying that it does. */
-    if (enctype == ENCTYPE_DES_CBC_MD5)
-        return FALSE;
-
     /* Assume the server supports any enctype it has a long-term key for. */
     return !krb5_dbe_find_enctype(kdc_context, server, enctype, -1, 0, &datap);
 }