236 lines
8.3 KiB
Diff
236 lines
8.3 KiB
Diff
|
commit 25cd5f9101b8969f9e1f9d7d486f11c215d0eeb4
|
||
|
Author: Vince Busam <vbusam@google.com>
|
||
|
Date: Wed May 7 15:24:53 2008 -0400
|
||
|
|
||
|
Kerberos credentials may be stored in multiple places. Make it
|
||
|
possible to search several directories for valid credentials when
|
||
|
making NFS requests.
|
||
|
|
||
|
Original patch from Vince Busam <vbusam@google.com>
|
||
|
|
||
|
Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>.
|
||
|
Signed-off-by: Steve Dickson <steved@redhat.com>
|
||
|
|
||
|
diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c
|
||
|
index bbcad20..e8612a5 100644
|
||
|
--- a/utils/gssd/gssd.c
|
||
|
+++ b/utils/gssd/gssd.c
|
||
|
@@ -57,6 +57,7 @@ char pipefs_dir[PATH_MAX] = GSSD_PIPEFS_DIR;
|
||
|
char pipefs_nfsdir[PATH_MAX] = GSSD_PIPEFS_DIR;
|
||
|
char keytabfile[PATH_MAX] = GSSD_DEFAULT_KEYTAB_FILE;
|
||
|
char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR;
|
||
|
+char *ccachesearch[GSSD_MAX_CCACHE_SEARCH + 1];
|
||
|
int use_memcache = 0;
|
||
|
int root_uses_machine_creds = 1;
|
||
|
|
||
|
@@ -93,9 +94,11 @@ main(int argc, char *argv[])
|
||
|
int verbosity = 0;
|
||
|
int rpc_verbosity = 0;
|
||
|
int opt;
|
||
|
+ int i;
|
||
|
extern char *optarg;
|
||
|
char *progname;
|
||
|
|
||
|
+ memset(ccachesearch, 0, sizeof(ccachesearch));
|
||
|
while ((opt = getopt(argc, argv, "fvrmnMp:k:d:")) != -1) {
|
||
|
switch (opt) {
|
||
|
case 'f':
|
||
|
@@ -136,6 +139,13 @@ main(int argc, char *argv[])
|
||
|
break;
|
||
|
}
|
||
|
}
|
||
|
+
|
||
|
+ i = 0;
|
||
|
+ ccachesearch[i++] = strtok(ccachedir, ":");
|
||
|
+ do {
|
||
|
+ ccachesearch[i++] = strtok(NULL, ":");
|
||
|
+ } while (ccachesearch[i-1] != NULL && i < GSSD_MAX_CCACHE_SEARCH);
|
||
|
+
|
||
|
snprintf(pipefs_nfsdir, sizeof(pipefs_nfsdir), "%s/%s",
|
||
|
pipefs_dir, GSSD_SERVICE_NAME);
|
||
|
if (pipefs_nfsdir[sizeof(pipefs_nfsdir)-1] != '\0')
|
||
|
diff --git a/utils/gssd/gssd.h b/utils/gssd/gssd.h
|
||
|
index 6f14c34..0f9f428 100644
|
||
|
--- a/utils/gssd/gssd.h
|
||
|
+++ b/utils/gssd/gssd.h
|
||
|
@@ -50,6 +50,7 @@
|
||
|
#define GSSD_DEFAULT_KEYTAB_FILE "/etc/krb5.keytab"
|
||
|
#define GSSD_SERVICE_NAME "nfs"
|
||
|
#define GSSD_SERVICE_NAME_LEN 3
|
||
|
+#define GSSD_MAX_CCACHE_SEARCH 16
|
||
|
|
||
|
/*
|
||
|
* The gss mechanisms that we can handle
|
||
|
@@ -61,7 +62,7 @@ enum {AUTHTYPE_KRB5, AUTHTYPE_SPKM3, AUTHTYPE_LIPKEY};
|
||
|
extern char pipefs_dir[PATH_MAX];
|
||
|
extern char pipefs_nfsdir[PATH_MAX];
|
||
|
extern char keytabfile[PATH_MAX];
|
||
|
-extern char ccachedir[PATH_MAX];
|
||
|
+extern char *ccachesearch[];
|
||
|
extern int use_memcache;
|
||
|
extern int root_uses_machine_creds;
|
||
|
|
||
|
diff --git a/utils/gssd/gssd.man b/utils/gssd/gssd.man
|
||
|
index 2fa749e..8fa4f4a 100644
|
||
|
--- a/utils/gssd/gssd.man
|
||
|
+++ b/utils/gssd/gssd.man
|
||
|
@@ -74,7 +74,11 @@ where to look for the rpc_pipefs filesystem. The default value is
|
||
|
.B -d directory
|
||
|
Tells
|
||
|
.B rpc.gssd
|
||
|
-where to look for kerberos credential files. The default value is "/tmp".
|
||
|
+where to look for Kerberos credential files. The default value is "/tmp".
|
||
|
+This can also be a colon separated list of directories to be searched
|
||
|
+for Kerberos credential files. Note that if machine credentials are being
|
||
|
+stored in files, then the first directory on this list is where the
|
||
|
+machine credentials are stored.
|
||
|
.TP
|
||
|
.B -v
|
||
|
Increases the verbosity of the output (can be specified multiple times).
|
||
|
diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
|
||
|
index bac7295..be6f440 100644
|
||
|
--- a/utils/gssd/gssd_proc.c
|
||
|
+++ b/utils/gssd/gssd_proc.c
|
||
|
@@ -685,6 +685,7 @@ handle_krb5_upcall(struct clnt_info *clp)
|
||
|
gss_buffer_desc token;
|
||
|
char **credlist = NULL;
|
||
|
char **ccname;
|
||
|
+ char **dirname;
|
||
|
int create_resp = -1;
|
||
|
|
||
|
printerr(1, "handling krb5 upcall\n");
|
||
|
@@ -701,10 +702,14 @@ handle_krb5_upcall(struct clnt_info *clp)
|
||
|
|
||
|
if (uid != 0 || (uid == 0 && root_uses_machine_creds == 0)) {
|
||
|
/* Tell krb5 gss which credentials cache to use */
|
||
|
- gssd_setup_krb5_user_gss_ccache(uid, clp->servername);
|
||
|
+ for (dirname = ccachesearch; *dirname != NULL; dirname++) {
|
||
|
+ gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
|
||
|
|
||
|
- create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,
|
||
|
- AUTHTYPE_KRB5);
|
||
|
+ create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,
|
||
|
+ AUTHTYPE_KRB5);
|
||
|
+ if (create_resp == 0)
|
||
|
+ break;
|
||
|
+ }
|
||
|
}
|
||
|
if (create_resp != 0) {
|
||
|
if (uid == 0 && root_uses_machine_creds == 1) {
|
||
|
diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
|
||
|
index 0589cd8..512c1cf 100644
|
||
|
--- a/utils/gssd/krb5_util.c
|
||
|
+++ b/utils/gssd/krb5_util.c
|
||
|
@@ -131,7 +131,8 @@ struct gssd_k5_kt_princ *gssd_k5_kt_princ_list = NULL;
|
||
|
/*==========================*/
|
||
|
|
||
|
static int select_krb5_ccache(const struct dirent *d);
|
||
|
-static int gssd_find_existing_krb5_ccache(uid_t uid, struct dirent **d);
|
||
|
+static int gssd_find_existing_krb5_ccache(uid_t uid, char *dirname,
|
||
|
+ struct dirent **d);
|
||
|
static int gssd_get_single_krb5_cred(krb5_context context,
|
||
|
krb5_keytab kt, struct gssd_k5_kt_princ *ple);
|
||
|
|
||
|
@@ -159,7 +160,7 @@ select_krb5_ccache(const struct dirent *d)
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
- * Look in the ccachedir for files that look like they
|
||
|
+ * Look in directory "dirname" for files that look like they
|
||
|
* are Kerberos Credential Cache files for a given UID. Return
|
||
|
* non-zero and the dirent pointer for the entry most likely to be
|
||
|
* what we want. Otherwise, return zero and no dirent pointer.
|
||
|
@@ -170,7 +171,7 @@ select_krb5_ccache(const struct dirent *d)
|
||
|
* 1 => found an existing entry
|
||
|
*/
|
||
|
static int
|
||
|
-gssd_find_existing_krb5_ccache(uid_t uid, struct dirent **d)
|
||
|
+gssd_find_existing_krb5_ccache(uid_t uid, char *dirname, struct dirent **d)
|
||
|
{
|
||
|
struct dirent **namelist;
|
||
|
int n;
|
||
|
@@ -181,9 +182,10 @@ gssd_find_existing_krb5_ccache(uid_t uid, struct dirent **d)
|
||
|
|
||
|
memset(&best_match_stat, 0, sizeof(best_match_stat));
|
||
|
*d = NULL;
|
||
|
- n = scandir(ccachedir, &namelist, select_krb5_ccache, 0);
|
||
|
+ n = scandir(dirname, &namelist, select_krb5_ccache, 0);
|
||
|
if (n < 0) {
|
||
|
- perror("scandir looking for krb5 credentials caches");
|
||
|
+ printerr(1, "Error doing scandir on directory '%s': %s\n",
|
||
|
+ dirname, strerror(errno));
|
||
|
}
|
||
|
else if (n > 0) {
|
||
|
char statname[1024];
|
||
|
@@ -191,7 +193,7 @@ gssd_find_existing_krb5_ccache(uid_t uid, struct dirent **d)
|
||
|
printerr(3, "CC file '%s' being considered\n",
|
||
|
namelist[i]->d_name);
|
||
|
snprintf(statname, sizeof(statname),
|
||
|
- "%s/%s", ccachedir, namelist[i]->d_name);
|
||
|
+ "%s/%s", dirname, namelist[i]->d_name);
|
||
|
if (lstat(statname, &tmp_stat)) {
|
||
|
printerr(0, "Error doing stat on file '%s'\n",
|
||
|
statname);
|
||
|
@@ -291,8 +293,9 @@ limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid)
|
||
|
&credh, NULL, NULL);
|
||
|
|
||
|
if (maj_stat != GSS_S_COMPLETE) {
|
||
|
- pgsserr("gss_acquire_cred",
|
||
|
- maj_stat, min_stat, &krb5oid);
|
||
|
+ if (get_verbosity() > 0)
|
||
|
+ pgsserr("gss_acquire_cred",
|
||
|
+ maj_stat, min_stat, &krb5oid);
|
||
|
return -1;
|
||
|
}
|
||
|
|
||
|
@@ -406,7 +409,7 @@ gssd_get_single_krb5_cred(krb5_context context,
|
||
|
cache_type = "FILE";
|
||
|
snprintf(cc_name, sizeof(cc_name), "%s:%s/%s%s_%s",
|
||
|
cache_type,
|
||
|
- ccachedir, GSSD_DEFAULT_CRED_PREFIX,
|
||
|
+ ccachesearch[0], GSSD_DEFAULT_CRED_PREFIX,
|
||
|
GSSD_DEFAULT_MACHINE_CRED_SUFFIX, ple->realm);
|
||
|
ple->endtime = my_creds.times.endtime;
|
||
|
if (ple->ccname != NULL)
|
||
|
@@ -894,7 +897,7 @@ out:
|
||
|
* void
|
||
|
*/
|
||
|
void
|
||
|
-gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername)
|
||
|
+gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirname)
|
||
|
{
|
||
|
char buf[MAX_NETOBJ_SZ];
|
||
|
struct dirent *d;
|
||
|
@@ -902,14 +905,13 @@ gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername)
|
||
|
printerr(2, "getting credentials for client with uid %u for "
|
||
|
"server %s\n", uid, servername);
|
||
|
memset(buf, 0, sizeof(buf));
|
||
|
- if (gssd_find_existing_krb5_ccache(uid, &d)) {
|
||
|
- snprintf(buf, sizeof(buf), "FILE:%s/%s",
|
||
|
- ccachedir, d->d_name);
|
||
|
+ if (gssd_find_existing_krb5_ccache(uid, dirname, &d)) {
|
||
|
+ snprintf(buf, sizeof(buf), "FILE:%s/%s", dirname, d->d_name);
|
||
|
free(d);
|
||
|
}
|
||
|
else
|
||
|
snprintf(buf, sizeof(buf), "FILE:%s/%s%u",
|
||
|
- ccachedir, GSSD_DEFAULT_CRED_PREFIX, uid);
|
||
|
+ dirname, GSSD_DEFAULT_CRED_PREFIX, uid);
|
||
|
printerr(2, "using %s as credentials cache for client with "
|
||
|
"uid %u for server %s\n", buf, uid, servername);
|
||
|
gssd_set_krb5_ccache_name(buf);
|
||
|
diff --git a/utils/gssd/krb5_util.h b/utils/gssd/krb5_util.h
|
||
|
index 78ad45c..431fdaf 100644
|
||
|
--- a/utils/gssd/krb5_util.h
|
||
|
+++ b/utils/gssd/krb5_util.h
|
||
|
@@ -17,7 +17,8 @@ struct gssd_k5_kt_princ {
|
||
|
};
|
||
|
|
||
|
|
||
|
-void gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername);
|
||
|
+void gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername,
|
||
|
+ char *dirname);
|
||
|
int gssd_get_krb5_machine_cred_list(char ***list);
|
||
|
void gssd_free_krb5_machine_cred_list(char **list);
|
||
|
void gssd_setup_krb5_machine_gss_ccache(char *servername);
|