225     if (isflagset(apreq->ap_options, AP_OPTS_USE_SESSION_KEY) ||  in kdc_process_tgs_req()
226 	isflagset(apreq->ap_options, AP_OPTS_MUTUAL_REQUIRED)) {  in kdc_process_tgs_req()
312     if (isflagset((*ticket)->enc_part2->flags, TKT_FLG_INVALID)  in kdc_process_tgs_req()
313 	&& !isflagset(request->kdc_options, KDC_OPT_VALIDATE)) {  in kdc_process_tgs_req()
866 	!isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) {  in validate_as_request()
895     if (isflagset(client.attributes, KRB5_KDB_REQUIRES_PWCHANGE) &&  in validate_as_request()
896 	!isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) {  in validate_as_request()
902     if ((isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) ||  in validate_as_request()
903 	 isflagset(request->kdc_options, KDC_OPT_POSTDATED)) &&   in validate_as_request()
904 	(isflagset(client.attributes, KRB5_KDB_DISALLOW_POSTDATED) ||  in validate_as_request()
905 	 isflagset(server.attributes, KRB5_KDB_DISALLOW_POSTDATED))) {  in validate_as_request()
911     if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE) &&  in validate_as_request()
912 	(isflagset(client.attributes, KRB5_KDB_DISALLOW_FORWARDABLE) ||  in validate_as_request()
913 	 isflagset(server.attributes, KRB5_KDB_DISALLOW_FORWARDABLE))) {  in validate_as_request()
919     if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE) &&  in validate_as_request()
920 	(isflagset(client.attributes, KRB5_KDB_DISALLOW_RENEWABLE) ||  in validate_as_request()
921 	 isflagset(server.attributes, KRB5_KDB_DISALLOW_RENEWABLE))) {  in validate_as_request()
927     if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE) &&  in validate_as_request()
928 	(isflagset(client.attributes, KRB5_KDB_DISALLOW_PROXIABLE) ||  in validate_as_request()
929 	 isflagset(server.attributes, KRB5_KDB_DISALLOW_PROXIABLE))) {  in validate_as_request()
935     if (isflagset(client.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {  in validate_as_request()
941     if (isflagset(server.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {  in validate_as_request()
947     if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) {  in validate_as_request()
1191 	if (isflagset(server.attributes, KRB5_KDB_DISALLOW_TGT_BASED)) {  in validate_tgs_request()
1198     if ((isflagset(request->kdc_options, KDC_OPT_FORWARDED) ||  in validate_tgs_request()
1199 	 isflagset(request->kdc_options, KDC_OPT_FORWARDABLE)) &&  in validate_tgs_request()
1200 	!isflagset(ticket->enc_part2->flags, TKT_FLG_FORWARDABLE)) {  in validate_tgs_request()
1207     if ((isflagset(request->kdc_options, KDC_OPT_PROXY) ||  in validate_tgs_request()
1208 	 isflagset(request->kdc_options, KDC_OPT_PROXIABLE)) &&  in validate_tgs_request()
1209 	!isflagset(ticket->enc_part2->flags, TKT_FLG_PROXIABLE)) {  in validate_tgs_request()
1215     if ((isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) ||  in validate_tgs_request()
1216 	  isflagset(request->kdc_options, KDC_OPT_POSTDATED)) &&  in validate_tgs_request()
1217 	!isflagset(ticket->enc_part2->flags, TKT_FLG_MAY_POSTDATE)) {  in validate_tgs_request()
1223     if (isflagset(request->kdc_options, KDC_OPT_VALIDATE) &&  in validate_tgs_request()
1224 	!isflagset(ticket->enc_part2->flags, TKT_FLG_INVALID)) {  in validate_tgs_request()
1230     if ((isflagset(request->kdc_options, KDC_OPT_RENEW) ||  in validate_tgs_request()
1231 	  isflagset(request->kdc_options, KDC_OPT_RENEWABLE)) &&  in validate_tgs_request()
1232 	!isflagset(ticket->enc_part2->flags, TKT_FLG_RENEWABLE)) {  in validate_tgs_request()
1238     if (isflagset(request->kdc_options, KDC_OPT_PROXY) &&  in validate_tgs_request()
1248     if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE) &&  in validate_tgs_request()
1249 	isflagset(server.attributes, KRB5_KDB_DISALLOW_FORWARDABLE)) {  in validate_tgs_request()
1255     if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE) &&  in validate_tgs_request()
1256 	isflagset(server.attributes, KRB5_KDB_DISALLOW_RENEWABLE)) {  in validate_tgs_request()
1262     if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE) &&  in validate_tgs_request()
1263 	isflagset(server.attributes, KRB5_KDB_DISALLOW_PROXIABLE)) {  in validate_tgs_request()
1269     if (isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) &&  in validate_tgs_request()
1270 	isflagset(server.attributes, KRB5_KDB_DISALLOW_POSTDATED)) {  in validate_tgs_request()
1276     if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY) &&  in validate_tgs_request()
1277 	isflagset(server.attributes, KRB5_KDB_DISALLOW_DUP_SKEY)) {  in validate_tgs_request()
1283     if (isflagset(server.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {  in validate_tgs_request()
1289     if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) {  in validate_tgs_request()
1301     if (isflagset(request->kdc_options, KDC_OPT_VALIDATE)) {  in validate_tgs_request()
1312     if (isflagset(request->kdc_options, KDC_OPT_RENEW) &&  in validate_tgs_request()
1324     if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) {  in validate_tgs_request()
1339     if (isflagset(server.attributes, KRB5_KDB_REQUIRES_HW_AUTH) &&  in validate_tgs_request()
1340 	!isflagset(ticket->enc_part2->flags,TKT_FLG_HW_AUTH)) {  in validate_tgs_request()
1346     if (isflagset(server.attributes, KRB5_KDB_REQUIRES_PRE_AUTH) &&  in validate_tgs_request()
1347 	!isflagset(ticket->enc_part2->flags, TKT_FLG_PRE_AUTH)) {  in validate_tgs_request()