From e3bf239e6ca7884aa84eb70262ded6bcc106c153 Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Wed, 9 Feb 2011 22:19:02 +0000 Subject: [PATCH] pull up r24603 from trunk ------------------------------------------------------------------------ r24603 | ghudson | 2011-01-24 19:23:48 -0500 (Mon, 24 Jan 2011) | 15 lines ticket: 6852 subject: Make gss_krb5_set_allowable_enctypes work for the acceptor target_version: 1.9.1 tags: pullup With the addition of enctype negotiation in 1.7, a gss-krb5 acceptor can choose an enctype for the acceptor subkey other than the one in the keytab. If the resulting security context will be exported and re-imported by another gss-krb5 implementation (such as one in the kernel), the acceptor needs a way to restrict the set of negotiated enctypes to those supported by the other implementation. We had that functionality for the initiator already in the form of gss_krb5_set_allowable_enctypes; this change makes it work for the acceptor as well. ticket: 6853 version_fixed: 1.8.4 status: resolved git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24630 dc483132-0cff-0310-8789-dd5450dbe970 --- src/lib/gssapi/krb5/accept_sec_context.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c index 624105533..48307a220 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -583,6 +583,15 @@ kg_accept_krb5(minor_status, context_handle, goto fail; } + /* Limit the encryption types negotiated (if requested). */ + if (cred->req_enctypes) { + if ((code = krb5_set_default_tgs_enctypes(context, + cred->req_enctypes))) { + major_status = GSS_S_FAILURE; + goto fail; + } + } + if ((code = krb5_rd_req(context, &auth_context, &ap_req, cred->default_identity ? NULL : cred->name->princ, cred->keytab, -- 2.26.2