Re: [nfs-utils PATCH RFC 0/4] Rework the handling of encryption types in rpc.gssd

[Steve Dickson <steved@redhat.com>]

On 2/13/26 5:40 PM, Scott Mayhew wrote:
> These patches address the issue described in "nfs: ls input/output error
> ("NFS: readdir(/) returns -5") on krb5 NFSv4 client using SHA2"
> (https://bugs.debian.org/1120598).
> 
> The core issue is that when the krb5 library does a TGS request, it
> initially does so with referrals enabled, disregarding the enctypes list
> supplied by the requesting application.  It still checks the resulting
> ticket to ensure that it's using one of the requested enctypes, but it
> may not the highest priority enctype from our list.  See
> make_request_for_service(), step_referrals(), and wrong_enctype() in the
> krb5 code.
> 
> The problem arises if it does this when setting up the machine
> credential, but it doesn't do it when setting up a user's credential
> (which can happen in the case of constrained-delegation via gssproxy).
> 
> That can lead to the machine credential and the user credentials using
> different enctypes, leading to XDR decoding failures described in the
> above bug.
> 
> These patches aim to address that issue by making sure that the list we
> pass to limit_krb5_enctypes is in the same order as the default list
> in the krb5 library.
> 
> Scott Mayhew (4):
>    gssd: remove the limit-to-legacy-enctypes option
>    gssd: add enctypes_list_to_string()
>    gssd: get the permitted enctypes from the krb5 library on startup
>    gssd: add a helper to determine the set of encryption types to pass to
>      limit_krb5_enctypes()
> 
>   nfs.conf               |   1 -
>   systemd/nfs.conf.man   |   2 +-
>   utils/gssd/gssd.c      |  16 +--
>   utils/gssd/gssd.man    |  30 +---
>   utils/gssd/gssd_proc.c |  15 ++
>   utils/gssd/krb5_util.c | 311 +++++++++++++++++++++++++++++++++--------
>   utils/gssd/krb5_util.h |   5 +-
>   7 files changed, 284 insertions(+), 96 deletions(-)
> 
Committed... (tag: nfs-utils-2-8-6-rc3)

steved.