gss-proxy.git/proxy/src, branch master-impersonation

Add "impersonate" configuration option. No implementation yet.

2013-06-25T13:22:12+00:00

Further improve debugging, mention servicename, socket and euid.

2013-06-24T15:51:39+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Properly check socket for connection matching.

2013-06-21T15:04:45+00:00

We always need to chekc if the socket matches otherwise the worng service may
be selected if a specific socket is being used but a service allowing the same
euid is confgured to use the deault socket as well.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Use verbose ding-libs error reporting when config parsing failed.

2013-06-05T12:15:18+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

gssproxy: report an error message on event loop failure.

2013-06-03T10:40:05+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Fix realloc size in gp_get_cred_environment().

2013-05-22T15:37:52+00:00

This fixes a segfault when no client_keytab is passed in via cred_store api.
See https://fedorahosted.org/gss-proxy/ticket/85 for details.

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Overwrite existing GSS_USE_PROXY variable in the server.

2013-05-16T10:11:43+00:00

This is required to make sure we never recurse into ourselves.

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Fix socket error handling.

2013-05-16T10:11:43+00:00

1. Grab the socket lock for the whole conversation.

We need to keep the lock until the whole conversation is over.
Otherwise we may have concurrency issues where communication gets intermixed
and errors in one thread can cause a thread to hang.

Here is what we observed:

thread 1: grabs lock and send a request.
thread 2: grabs lock and sends a request
server: thread 2 request causes a fatal error and the server close the
connection
thread 2: grabs the lock and waits for a reply.
thread 2: gets the error and returns to caller with it (connection is closed).
thread 1: grabs the lock (which reopens the closed channel) and reads ...
... forever as the server has already killed all the previous state.

2. Fail immediately on short reads for the initial 4 byte length header.

If the first 4 bytes do not come at once don't bother retrying. In 99.9% of the
cases what we are witnessing here is a fatal error from the proxy that closed
the socket. Reopening the scket cannot accomplish anything as the request sent
down the channel is tied to the specific socket, so once the socket is closed
there is no hope to ever get back a reply.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Fix secondary socket detection at runtime.

2013-05-16T10:11:42+00:00

We were failing to find the right service as the test was reversed.
It works with the default socket as it is not stored per service.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Disable gss_export_name_composite() for now.

2013-05-16T10:11:42+00:00

We first need to fix our tests and implementation.

Temporary workaround for:
https://fedorahosted.org/gss-proxy/ticket/81

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce