X-Git-Url: https://git.decadent.org.uk/gitweb/?a=blobdiff_plain;f=utils%2Fgssd%2Fkrb5_util.c;h=0589cd87e8c3237a76c7ca14fcafc4e3e1b78fa9;hb=73f9b4402ec6625618967f947c99e6e417322d36;hp=87bd7e41cc563d89527c7b56b4c50c98fc7edbbd;hpb=5995fb8081f92acf39e5126e09d7db8fe6a02364;p=nfs-utils.git

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 87bd7e4..0589cd8 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -277,7 +277,9 @@ limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid)
 	u_int maj_stat, min_stat;
 	gss_cred_id_t credh;
 	gss_OID_set_desc  desired_mechs;
-	krb5_enctype enctypes[] = { ENCTYPE_DES_CBC_CRC };
+	krb5_enctype enctypes[] = { ENCTYPE_DES_CBC_CRC,
+				    ENCTYPE_DES_CBC_MD5,
+				    ENCTYPE_DES_CBC_MD4 };
 	int num_enctypes = sizeof(enctypes) / sizeof(enctypes[0]);
 
 	/* We only care about getting a krb5 cred */
@@ -323,7 +325,12 @@ gssd_get_single_krb5_cred(krb5_context context,
 			  krb5_keytab kt,
 			  struct gssd_k5_kt_princ *ple)
 {
+#if HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS
+	krb5_get_init_creds_opt *init_opts = NULL;
+#else
 	krb5_get_init_creds_opt options;
+#endif
+	krb5_get_init_creds_opt *opts;
 	krb5_creds my_creds;
 	krb5_ccache ccache = NULL;
 	char kt_name[BUFSIZ];
@@ -351,16 +358,37 @@ gssd_get_single_krb5_cred(krb5_context context,
 	if ((krb5_unparse_name(context, ple->princ, &pname)))
 		pname = NULL;
 
+#if HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS
+	code = krb5_get_init_creds_opt_alloc(context, &init_opts);
+	if (code) {
+		printerr(0, "ERROR: %s allocating gic options\n",
+			 gssd_k5_err_msg(context, code));
+		goto out;
+	}
+	if (krb5_get_init_creds_opt_set_addressless(context, init_opts, 1))
+		printerr(0, "WARNING: Unable to set option for addressless "
+			 "tickets.  May have problems behind a NAT.\n");
+#ifdef TEST_SHORT_LIFETIME
+	/* set a short lifetime (for debugging only!) */
+	printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n");
+	krb5_get_init_creds_opt_set_tkt_life(init_opts, 5*60);
+#endif
+	opts = init_opts;
+
+#else	/* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS */
+
 	krb5_get_init_creds_opt_init(&options);
 	krb5_get_init_creds_opt_set_address_list(&options, NULL);
-
 #ifdef TEST_SHORT_LIFETIME
 	/* set a short lifetime (for debugging only!) */
 	printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n");
 	krb5_get_init_creds_opt_set_tkt_life(&options, 5*60);
 #endif
+	opts = &options;
+#endif
+
 	if ((code = krb5_get_init_creds_keytab(context, &my_creds, ple->princ,
-					       kt, 0, NULL, &options))) {
+					       kt, 0, NULL, opts))) {
 		printerr(0, "WARNING: %s while getting initial ticket for "
 			 "principal '%s' using keytab '%s'\n",
 			 gssd_k5_err_msg(context, code),
@@ -378,7 +406,7 @@ gssd_get_single_krb5_cred(krb5_context context,
 	    cache_type = "FILE";
 	snprintf(cc_name, sizeof(cc_name), "%s:%s/%s%s_%s",
 		cache_type,
-		GSSD_DEFAULT_CRED_DIR, GSSD_DEFAULT_CRED_PREFIX,
+		ccachedir, GSSD_DEFAULT_CRED_PREFIX,
 		GSSD_DEFAULT_MACHINE_CRED_SUFFIX, ple->realm);
 	ple->endtime = my_creds.times.endtime;
 	if (ple->ccname != NULL)
@@ -411,6 +439,10 @@ gssd_get_single_krb5_cred(krb5_context context,
 	printerr(2, "Successfully obtained machine credentials for "
 		 "principal '%s' stored in ccache '%s'\n", pname, cc_name);
   out:
+#if HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS
+	if (init_opts)
+		krb5_get_init_creds_opt_free(context, init_opts);
+#endif
 	if (pname)
 		k5_free_unparsed_name(context, pname);
 	if (ccache)