From af11454d3adf02a0e6fe3156e37b7b06fd5a9d3b Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Tue, 25 Jan 2011 00:23:48 +0000 Subject: [PATCH] Make gss_krb5_set_allowable_enctypes work for the acceptor With the addition of enctype negotiation in 1.7, a gss-krb5 acceptor can choose an enctype for the acceptor subkey other than the one in the keytab. If the resulting security context will be exported and re-imported by another gss-krb5 implementation (such as one in the kernel), the acceptor needs a way to restrict the set of negotiated enctypes to those supported by the other implementation. We had that functionality for the initiator already in the form of gss_krb5_set_allowable_enctypes; this change makes it work for the acceptor as well. ticket: 6852 target_version: 1.9.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24603 dc483132-0cff-0310-8789-dd5450dbe970 --- src/lib/gssapi/krb5/accept_sec_context.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c index 9d40f68c6..c3cb2f19e 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -623,6 +623,15 @@ kg_accept_krb5(minor_status, context_handle, goto fail; } + /* Limit the encryption types negotiated (if requested). */ + if (cred->req_enctypes) { + if ((code = krb5_set_default_tgs_enctypes(context, + cred->req_enctypes))) { + major_status = GSS_S_FAILURE; + goto fail; + } + } + if ((code = krb5_rd_req(context, &auth_context, &ap_req, cred->default_identity ? NULL : cred->name->princ, cred->keytab, -- 2.26.2