Re: [nfs-utils PATCH RFC 0/4] Rework the handling of encryption types in rpc.gssd

Steve Dickson
2026-02-28T17:14:38Z

On 2/13/26 5:40 PM, Scott Mayhew wrote:
> These patches address the issue described in "nfs: ls input/output error
> ("NFS: readdir(/) returns -5") on krb5 NFSv4 client using SHA2"
> (https://bugs.debian.org/1120598).
>
> The core issue is that when the krb5 library does a TGS request, it
> initially does so with referrals enabled, disregarding the enctypes list
> supplied by the requesting application. It still checks the resulting
> ticket to ensure that it's using one of the requested enctypes, but it
> may not the highest priority enctype from our list. See
> make_request_for_service(), step_referrals(), and wrong_enctype() in the
> krb5 code.
>
> The problem arises if it does this when setting up the machine
> credential, but it doesn't do it when setting up a user's credential
> (which can happen in the case of constrained-delegation via gssproxy).
>
> That can lead to the machine credential and the user credentials using
> different enctypes, leading to XDR decoding failures described in the
> above bug.
>
> These patches aim to address that issue by making sure that the list we
> pass to limit_krb5_enctypes is in the same order as the default list
> in the krb5 library.
>
> Scott Mayhew (4):
> gssd: remove the limit-to-legacy-enctypes option
> gssd: add enctypes_list_to_string()
> gssd: get the permitted enctypes from the krb5 library on startup
> gssd: add a helper to determine the set of encryption types to pass to
> limit_krb5_enctypes()
>
> nfs.conf | 1 -
> systemd/nfs.conf.man | 2 +-
> utils/gssd/gssd.c | 16 +--
> utils/gssd/gssd.man | 30 +---
> utils/gssd/gssd_proc.c | 15 ++
> utils/gssd/krb5_util.c | 311 +++++++++++++++++++++++++++++++++--------
> utils/gssd/krb5_util.h | 5 +-
> 7 files changed, 284 insertions(+), 96 deletions(-)
>
Committed... (tag: nfs-utils-2-8-6-rc3)

steved.