diff options
| author | Kevin Coffman <kwc@citi.umich.edu> | 2010-04-15 08:32:20 -0400 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2010-04-16 13:23:04 -0400 |
| commit | 76be349d5dd07f55797cb9920cc275667258f10f (patch) | |
| tree | b9ce39bacb8c93b877268f23407de853b44a157d /utils/gssd/krb5_util.c | |
| parent | 48d13033dcb27eb3d9ea78c39692ff7c54095950 (diff) | |
| download | nfs-utils-76be349d5dd07f55797cb9920cc275667258f10f.tar.gz nfs-utils-76be349d5dd07f55797cb9920cc275667258f10f.tar.xz nfs-utils-76be349d5dd07f55797cb9920cc275667258f10f.zip | |
Try to use kernel function to determine supported Kerberos enctypes.
This patch replaces a hard-coded list with a function to obtain
the Kerberos encryption types that the kernel's rpcsec_gss code
can support. Defaults to old behavior if kernel does not supply
information.
Signed-off-by: Steve Dickson <steved@redhat.com>
Diffstat (limited to 'utils/gssd/krb5_util.c')
| -rw-r--r-- | utils/gssd/krb5_util.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c index 1c10bd4..dccbeb6 100644 --- a/utils/gssd/krb5_util.c +++ b/utils/gssd/krb5_util.c @@ -1274,6 +1274,8 @@ limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid) ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4 }; int num_enctypes = sizeof(enctypes) / sizeof(enctypes[0]); + extern int num_krb5_enctypes; + extern krb5_enctype *krb5_enctypes; /* We only care about getting a krb5 cred */ desired_mechs.count = 1; @@ -1290,8 +1292,17 @@ limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid) return -1; } - maj_stat = gss_set_allowable_enctypes(&min_stat, credh, &krb5oid, - num_enctypes, &enctypes); + /* + * If we failed for any reason to produce global + * list of supported enctypes, use local default here. + */ + if (krb5_enctypes == NULL) + maj_stat = gss_set_allowable_enctypes(&min_stat, credh, + &krb5oid, num_enctypes, enctypes); + else + maj_stat = gss_set_allowable_enctypes(&min_stat, credh, + &krb5oid, num_krb5_enctypes, krb5_enctypes); + if (maj_stat != GSS_S_COMPLETE) { pgsserr("gss_set_allowable_enctypes", maj_stat, min_stat, &krb5oid); |