Return-Path: Received: from mx1.redhat.com ([209.132.183.28]:31094 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752770Ab1GUTYd (ORCPT ); Thu, 21 Jul 2011 15:24:33 -0400 Message-ID: <4E287CEE.7010706@RedHat.com> Date: Thu, 21 Jul 2011 15:24:30 -0400 From: Steve Dickson To: Kevin Coffman CC: bfields@redhat.com, linux-nfs@vger.kernel.org Subject: Re: [PATCH] svcgssd: use correct defaults in call to gss_set_allowable_enctypes References: <20110713165425.7469.23269.stgit@jazz.citi.umich.edu> In-Reply-To: <20110713165425.7469.23269.stgit@jazz.citi.umich.edu> Content-Type: text/plain; charset=UTF-8 Sender: linux-nfs-owner@vger.kernel.org List-ID: MIME-Version: 1.0 On 07/13/2011 12:54 PM, Kevin Coffman wrote: > For the window of kernels between 2.6.35 (when the support > for newer encryption was added) and 2.6.39 (when the ability > to read the supported enctypes from the kernel was added), > use a default of all enctypes when the kernel supported > enctypes file cannot be read. > > For kernels before 2.6.35, continue to use a default of > only DES enctypes. > > Note that the version of Kerberos must also support the use of > gss_set_allowable_enctypes for service-side negotiations. > > See also: http://bugzilla.redhat.com/show_bug.cgi?id=719776 > > Signed-off-by: Kevin Coffman Committed.. steved. > --- > > utils/gssd/svcgssd_krb5.c | 37 ++++++++++++++++++++++++++++++------- > 1 files changed, 30 insertions(+), 7 deletions(-) > > diff --git a/utils/gssd/svcgssd_krb5.c b/utils/gssd/svcgssd_krb5.c > index fc67a6f..6c34faf 100644 > --- a/utils/gssd/svcgssd_krb5.c > +++ b/utils/gssd/svcgssd_krb5.c > @@ -45,6 +45,7 @@ > #include "gss_oids.h" > #include "err_util.h" > #include "svcgssd_krb5.h" > +#include "../mount/version.h" > > #define MYBUFLEN 1024 > > @@ -169,22 +170,44 @@ svcgssd_limit_krb5_enctypes(void) > { > #ifdef HAVE_SET_ALLOWABLE_ENCTYPES > u_int maj_stat, min_stat; > - krb5_enctype default_enctypes[] = { ENCTYPE_DES_CBC_CRC, > - ENCTYPE_DES_CBC_MD5, > - ENCTYPE_DES_CBC_MD4 }; > - int default_num_enctypes = > - sizeof(default_enctypes) / sizeof(default_enctypes[0]); > - krb5_enctype *enctypes; > - int num_enctypes; > + krb5_enctype old_kernel_enctypes[] = { > + ENCTYPE_DES_CBC_CRC, > + ENCTYPE_DES_CBC_MD5, > + ENCTYPE_DES_CBC_MD4 }; > + krb5_enctype new_kernel_enctypes[] = { > + ENCTYPE_AES256_CTS_HMAC_SHA1_96, > + ENCTYPE_AES128_CTS_HMAC_SHA1_96, > + ENCTYPE_DES3_CBC_SHA1, > + ENCTYPE_ARCFOUR_HMAC, > + ENCTYPE_DES_CBC_CRC, > + ENCTYPE_DES_CBC_MD5, > + ENCTYPE_DES_CBC_MD4 }; > + krb5_enctype *default_enctypes, *enctypes; > + int default_num_enctypes, num_enctypes; > + > + > + if (linux_version_code() < MAKE_VERSION(2, 6, 35)) { > + default_enctypes = old_kernel_enctypes; > + default_num_enctypes = > + sizeof(old_kernel_enctypes) / sizeof(old_kernel_enctypes[0]); > + } else { > + default_enctypes = new_kernel_enctypes; > + default_num_enctypes = > + sizeof(new_kernel_enctypes) / sizeof(new_kernel_enctypes[0]); > + } > > get_kernel_supported_enctypes(); > > if (parsed_enctypes != NULL) { > enctypes = parsed_enctypes; > num_enctypes = parsed_num_enctypes; > + printerr(2, "%s: Calling gss_set_allowable_enctypes with %d " > + "enctypes from the kernel\n", __func__, num_enctypes); > } else { > enctypes = default_enctypes; > num_enctypes = default_num_enctypes; > + printerr(2, "%s: Calling gss_set_allowable_enctypes with %d " > + "enctypes from defaults\n", __func__, num_enctypes); > } > > maj_stat = gss_set_allowable_enctypes(&min_stat, gssd_creds, >