Ticket History #7688: Fix gss_krb5_set_allowable_enctypes for acceptor

Fix gss_krb5_set_allowable_enctypes for acceptor

The acceptor implementation of gss_krb5_set_allowable_enctypes (added
in 1.9.1) is intended to restrict the acceptor subkey negotiated by
krb5_rd_req(). It uses the same approach as the initiator, calling
krb5_set_default_tgs_enctypes on the context. This has the unwanted
side effect of restricting the encryption key of the ticket, because
krb5_decrypt_tkt_part has checked krb5_is_permitted_enctype on the
ticket encryption key since 1.8.

Instead, use krb5_auth_con_setpermetypes on the auth context. This
list is only used for session key enctype negotiation. Also add
automated tests to verify that gss_krb5_set_allowable_enctypes works
as desired.

https://github.com/krb5/krb5/commit/2e956074b228ff4df3b7462037ab69e4e88ffffe
Author: Greg Hudson <ghudson@mit.edu>
Commit: 2e956074b228ff4df3b7462037ab69e4e88ffffe
Branch: master
src/lib/gssapi/krb5/accept_sec_context.c | 4 +-
src/tests/gssapi/Makefile.in | 3 +
src/tests/gssapi/t_enctypes.c | 229 ++++++++++++++++++++++++++++++
src/tests/gssapi/t_enctypes.py | 149 +++++++++++++++++++
4 files changed, 383 insertions(+), 2 deletions(-)

The test script won't backport directly because of the run_as_client ->
run change in k5test.py in master. It will probably work if we change
"run" to "run_as_client" in the 1.11 backport of the script.
Alternatively, we could omit the tests when backporting.