[nfs-utils PATCH RFC 3/4] gssd: get the permitted enctypes from the krb5 library on startup

[Scott Mayhew <smayhew@redhat.com>]

This will allow us to cross-reference the list of encryption types
sent in the upcall from the kernel as well as the list of encryption
types enabled via the allowed-enctypes option from nfs.conf with
the list permitted by the krb5 library.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
 utils/gssd/gssd.c      |  3 +++
 utils/gssd/krb5_util.c | 55 ++++++++++++++++++++++++++++++++++++++++++
 utils/gssd/krb5_util.h |  1 +
 3 files changed, 59 insertions(+)

diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c
index 8a894b2e..1c901991 100644
--- a/utils/gssd/gssd.c
+++ b/utils/gssd/gssd.c
@@ -1222,6 +1222,9 @@ main(int argc, char *argv[])
 	daemon_init(fg);
 
 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES
+	rc = get_krb5_library_permitted_enctypes();
+	if (rc)
+		exit(EXIT_FAILURE);
 	rc = get_allowed_enctypes();
 	if (rc)
 		exit(EXIT_FAILURE);
diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 2b2925fb..bc07f852 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -155,9 +155,15 @@ static struct gssd_k5_kt_princ *gssd_k5_kt_princ_list = NULL;
 static pthread_mutex_t ple_lock = PTHREAD_MUTEX_INITIALIZER;
 
 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES
+/* Encryption types specified in nfs.conf */
 krb5_enctype *allowed_enctypes = NULL;
 int num_allowed_enctypes = 0;
 char *allowed_enctypes_string = NULL;
+
+/* Encryption types permitted by the krb5 library */
+int num_lib_enctypes = 0;
+krb5_enctype *lib_enctypes = NULL;
+char *lib_enctypes_string = NULL;
 #endif
 
 /*==========================*/
@@ -1676,6 +1682,55 @@ out:
 	return ret;
 }
 
+int
+get_krb5_library_permitted_enctypes(void)
+{
+	krb5_error_code code = 0;
+	krb5_context context;
+	char *k5err = NULL;
+	int ret = 0;
+
+	code = krb5_init_context(&context);
+	if (code) {
+		k5err = gssd_k5_err_msg(NULL, code);
+		printerr(2, "ERROR: %s: %s while initializing krb5 context\n",
+			 __func__, k5err);
+		ret = code;
+		goto out;
+	}
+
+	code = krb5_get_permitted_enctypes(context, &lib_enctypes);
+	if (code) {
+		k5err = gssd_k5_err_msg(context, code);
+		printerr(2, "ERROR: %s: %s while getting permitted enctypes\n",
+			 __func__, k5err);
+		ret = code;
+		goto out_free_context;
+	}
+
+	if (lib_enctypes != NULL)
+		while (lib_enctypes[num_lib_enctypes] != 0)
+			num_lib_enctypes++;
+
+	if (num_lib_enctypes > 0) {
+		if (enctypes_list_to_string(lib_enctypes, num_lib_enctypes,
+					    &lib_enctypes_string) != 0) {
+			printerr(2, "%s: warning: enctypes_list_to_string() failed\n",
+				 __func__);
+			goto out_free_context;
+		}
+		printerr(2, "krb5 library permitted enctypes: %s\n",
+			 lib_enctypes_string);
+	}
+
+out_free_context:
+	krb5_free_context(context);
+
+out:
+	free(k5err);
+	return ret;
+}
+
 /*
  * this routine obtains a credentials handle via gss_acquire_cred()
  * then calls gss_krb5_set_allowable_enctypes() to limit the encryption
diff --git a/utils/gssd/krb5_util.h b/utils/gssd/krb5_util.h
index a8e17ea2..e9d08567 100644
--- a/utils/gssd/krb5_util.h
+++ b/utils/gssd/krb5_util.h
@@ -30,6 +30,7 @@ int enctypes_list_to_string(krb5_enctype *enctypes, int num_enctypes,
 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES
 int limit_krb5_enctypes(struct rpc_gss_sec *sec);
 int get_allowed_enctypes(void);
+int get_krb5_library_permitted_enctypes(void);
 #endif
 
 /*
-- 
2.52.0