[nfs-utils PATCH RFC 0/4] Rework the handling of encryption types in rpc.gssd

[Scott Mayhew <smayhew@redhat.com>]

These patches address the issue described in "nfs: ls input/output error
("NFS: readdir(/) returns -5") on krb5 NFSv4 client using SHA2"
(https://bugs.debian.org/1120598).

The core issue is that when the krb5 library does a TGS request, it
initially does so with referrals enabled, disregarding the enctypes list
supplied by the requesting application.  It still checks the resulting
ticket to ensure that it's using one of the requested enctypes, but it
may not the highest priority enctype from our list.  See 
make_request_for_service(), step_referrals(), and wrong_enctype() in the
krb5 code.

The problem arises if it does this when setting up the machine
credential, but it doesn't do it when setting up a user's credential
(which can happen in the case of constrained-delegation via gssproxy).

That can lead to the machine credential and the user credentials using
different enctypes, leading to XDR decoding failures described in the
above bug.

These patches aim to address that issue by making sure that the list we
pass to limit_krb5_enctypes is in the same order as the default list
in the krb5 library.

Scott Mayhew (4):
  gssd: remove the limit-to-legacy-enctypes option
  gssd: add enctypes_list_to_string()
  gssd: get the permitted enctypes from the krb5 library on startup
  gssd: add a helper to determine the set of encryption types to pass to
    limit_krb5_enctypes()

 nfs.conf               |   1 -
 systemd/nfs.conf.man   |   2 +-
 utils/gssd/gssd.c      |  16 +--
 utils/gssd/gssd.man    |  30 +---
 utils/gssd/gssd_proc.c |  15 ++
 utils/gssd/krb5_util.c | 311 +++++++++++++++++++++++++++++++++--------
 utils/gssd/krb5_util.h |   5 +-
 7 files changed, 284 insertions(+), 96 deletions(-)

-- 
2.52.0