diff options
| author | Greg Hudson <ghudson@mit.edu> | 2011-01-25 00:23:48 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2011-01-25 00:23:48 +0000 |
| commit | af11454d3adf02a0e6fe3156e37b7b06fd5a9d3b (patch) | |
| tree | 6c00d5860e8ba16deaa623949e5a40332f57c196 /src/lib/gssapi | |
| parent | a6eafba6148b91fda7c2b1544e968ae325ffc868 (diff) | |
| download | krb5-af11454d3adf02a0e6fe3156e37b7b06fd5a9d3b.zip krb5-af11454d3adf02a0e6fe3156e37b7b06fd5a9d3b.tar.gz krb5-af11454d3adf02a0e6fe3156e37b7b06fd5a9d3b.tar.bz2 | |
Make gss_krb5_set_allowable_enctypes work for the acceptor
With the addition of enctype negotiation in 1.7, a gss-krb5 acceptor
can choose an enctype for the acceptor subkey other than the one in
the keytab. If the resulting security context will be exported and
re-imported by another gss-krb5 implementation (such as one in the
kernel), the acceptor needs a way to restrict the set of negotiated
enctypes to those supported by the other implementation. We had that
functionality for the initiator already in the form of
gss_krb5_set_allowable_enctypes; this change makes it work for the
acceptor as well.
ticket: 6852
target_version: 1.9.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24603 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/gssapi')
| -rw-r--r-- | src/lib/gssapi/krb5/accept_sec_context.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c index 9d40f68..c3cb2f1 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -623,6 +623,15 @@ kg_accept_krb5(minor_status, context_handle, goto fail; } + /* Limit the encryption types negotiated (if requested). */ + if (cred->req_enctypes) { + if ((code = krb5_set_default_tgs_enctypes(context, + cred->req_enctypes))) { + major_status = GSS_S_FAILURE; + goto fail; + } + } + if ((code = krb5_rd_req(context, &auth_context, &ap_req, cred->default_identity ? NULL : cred->name->princ, cred->keytab, |