summaryrefslogtreecommitdiffstats
path: root/utils/gssd/krb5_util.c
Commit message (Collapse)AuthorAgeFilesLines
* gssd: Use /run/user/${UID} instead of /run/user/${USER}Nalin Dahyabhai2012-08-221-4/+26
| | | | | | | | | | Newer versions of systemd create a /run/user/${UID} directory instead of the /run/user/${USER} directory, so switch to scanning for that. To make the per-user directory bit a little less magical, change the default to incorporate a "%U", which gets dynamically expanded to the user's UID when needed. Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: scan for DIR: ccaches, tooNalin Dahyabhai2012-08-221-18/+32
| | | | | | | | | In addition to matching "FILE:krb5cc_*" in the specified directory or directories, also match "DIR:krb5cc*", if we find subdirectories with names that match the search pattern. Signed-off-by: Nalin Dahyabhai <nalin@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Add -l option to gssd to force legacy behaviourMichael Weiser2012-04-161-1/+5
| | | | | | | | | | Implement a new option -l to force gssd to ignore its kernel's crypto capabilities and use just the Single DES legacy encryption types to be compatible with old servers. This is only relevant if those servers have strong keys in their keytab. Signed-off-by: Steve Dickson <steved@redhat.com> Tested-by: Michael Weiser <weiser@science-computing.de>
* Support AD style kerberos automatically in rpc.gssJason Gunthorpe2011-02-091-18/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | An Active Directory KDC will only grant a TGT for UPNs, getting a TGT for SPNs is not possible: $ kinit -k host/ib5@ADS.ORCORP.CA kinit: Client not found in Kerberos database while getting initial credentials The correct thing to do for machine credentials is to get a TGT for the computer UPN <HOSTNAME>$@REALM: $ kinit -k IB5\$ $ klist 12/22/10 11:43:47 12/22/10 21:43:47 krbtgt/ADS.ORCORP.CA@ADS.ORCORP.CA Samba automatically creates /etc/krb5.keytab entry for the computer UPN, this patch makes gssd_refresh_krb5_machine_credential prefer it above the SPNs if it is present. The net result is that nfs client works automatically out of the box if samba has been used to setup kerberos via 'net ads join' 'net ads keytab create' Tested using Windows Server 2003 R2 as the AD server. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Removed warnings from krb5_util.cSteve Dickson2010-08-091-8/+21
| | | | | | | | | krb5_util.c: In function 'realm_and_service_match': krb5_util.c:617: warning: unused parameter 'context' krb5_util.c: In function 'limit_krb5_enctypes': krb5_util.c:1275: warning: unused parameter 'uid' Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: picking wrong credsDoug Nazar2010-07-191-0/+7
| | | | | | | | | When not using machine credentials for root, if the machine credential cache file is newer than the root credential file the wrong file will get picked. Ignore the machine file in this case. Signed-off-by: Steve Dickson <steved@redhat.com>
* Try to use kernel function to determine supported Kerberos enctypes.Kevin Coffman2010-04-161-2/+13
| | | | | | | | | This patch replaces a hard-coded list with a function to obtain the Kerberos encryption types that the kernel's rpcsec_gss code can support. Defaults to old behavior if kernel does not supply information. Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: move function limit_krb5_enctypes into the exported functions areaKevin Coffman2010-04-161-55/+54
| | | | | | | | cleanup: Move function limit_krb5_enctypes() from the section containing static functions into the section containing externally visible functions. Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: on krb5 upcall, have gssd send a more granular error codeJeff Layton2010-01-121-17/+18
| | | | | | | | | | | | | | | | | | | | | Currently if a krb5 context expires, GSSAPI authenticated RPC calls start returning error (-EACCES in particular). This is bad when someone has a long running job that's doing filesystem ops on a krb5 authenticated NFS mount and just happens to forget to redo a 'kinit' in time. The existing gssd always does a downcall with a '-1' error code if there are problems, and the kernel always ignores this error code. Begin to fix this by having gssd distinguish between someone that has no credcache at all, and someone who has an expired one. In the case where there is an existing credcache, have gssd downcall with an error code of -EKEYEXPIRED. If there's not a credcache, then downcall with an error of -EACCES. We can then have the kernel use this error code to handle these situations differently. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: process service= attribute in new upcallOlga Kornievskaia2009-11-161-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add processing of the "service=" attribute in the new gssd upcall. If "service" is specified, then the kernel is indicating that we must use machine credentials for this request. (Regardless of the uid value or the setting of root_uses_machine_creds.) If the service value is "*", then any service name can be used. Otherwise, it specifies the service name that should be used. (For now, the values of service will only be "*" or "nfs".) Restricting gssd to use "nfs" service name is needed for when the NFS server is doing a callback to the NFS client. In this case, the NFS server has to authenticate itself as "nfs" -- even if there are other service keys such as "host" or "root" in the keytab. Another case when the kernel may specify the service attribute is when gssd is being asked to create the context for a SETCLIENT_ID operation. In this case, machine credentials must be used for the authentication. However, the service name used for this case is not important. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Gssd blindly caches machine credentialsLukas Hejtmanek2009-08-271-6/+7
| | | | | | | | | | | | | | We have a problem with rpc.gssd which blindly caches machine credentials. E.g., if someone deletes /tmp/krb5cc_machine_REALM, rpc.gss does not create new one until the old one expires. Also, it has problems with clock skew, if time goes back and gssd thinks that machine credentials are not expired yet. The following patch tries to use cache but in case of failure, it tries it again without cache. Any comments? Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Acked-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: free buffer allocated by gssd_k5_err_msgJeff Layton2009-03-231-42/+63
| | | | | | | | | | | | | There's no way for the caller of gssd_k5_err_msg to know whether to free the string it returns. It can call krb5_get_error_message which returns a string that must be freed via krb5_free_error_string. The other ways that it can return a string require that the memory not be freed. Deal with this by copying the string to a new buffer in all cases. Then we can properly free the string allocated by krb5_get_error_message. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: Include legacy or TI-RPC headers, not bothChuck Lever2009-03-161-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Data type incompatibilities between the legacy RPC headers and the TI-RPC headers mean we can't use libtirpc with code that was compiled against the legacy RPC headers. The definition of rpcprog_t for example is "unsigned long" in the legacy library, but it's "uint32_t" for TI-RPC. On 32-bit systems, these types happen to have the same width, but on 64-bit systems they don't, making more complex data structures that use these types in fields ABI incompatible. Adopt a new strategy to deal with this issue. When --enable-tirpc is set, append "-I/usr/include/tirpc" to the compilation steps. This should cause the compiler to grab the tirpc/ headers instead of the legacy headers. Now, for TI-RPC builds, the TI-RPC legacy functions and the TI-RPC headers will be used. On legacy systems, the legacy headers and legacy glibc RPC implementation will be used. A new ./configure option is introduced to allow system integrators to use TI-RPC headers in some other location than /usr/include/tirpc. /usr/include/tirpc remains the default setting for this new option. The gssd implementation presents a few challenges, but it turns out the gssglue library is similar to the auth_gss pieces of TI-RPC. To avoid similar header incompatibility issues, gssd now uses libtirpc instead of libgssglue if --enable-tirpc is specified. There may be other issues to tackle with gssd, but for now, we just make sure it builds with --enable-tirpc. Note also: svc_getcaller() is a macro in both cases that points to a sockaddr field in the svc_req structure. The legacy version points to a sockaddr_in type field, but the TI-RPC version points to a sockaddr_in6 type field. rpc.mountd unconditionally casts the result of svc_getcaller() to a sockaddr_in *. This should be OK for TI-RPC as well, since rpc.mountd still uses legacy RPC calls (provided by glibc, or emulated by TI-RPC) to set up its listeners, and therefore rpc.mountd callers will always be from AF_INET addresses for now. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: Use same style for including config.h that rest of nfs-utils usesChuck Lever2009-03-051-1/+5
| | | | | | | Clean up. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: By default, don't spam syslog when users' credentials expireKevin Coffman2009-01-051-3/+3
| | | | | | | | | | | | | | | | | | Change the priority of "common" log messages so that syslog doesn't get slammed/spammed when users' credentials expire, or there is another common problem which would cause error messages for all context creation requests. Note that this will now require that gssd or svcgssd option "-v" is used to debug these common cases. Original patch from Andrew Pollock <apollock@google.com>. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com> CC: Andrew Pollock <apollock@google.com>
* The rpc.gssd scans for any suitable kerberos ticket. In cross-realmLukas Hejtmanek2008-07-151-13/+147
| | | | | | | | | | environment this may not be the desired behaviour. Therefore a new option, -R preferred realm, is presented so that the rpc.gssd prefers tickets from this realm. By default, the default realm is preferred. Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd_setup_krb5_user_gss_ccache must return an error if no usable cache isLukas Hejtmanek2008-07-151-4/+5
| | | | | | | | found. Trying to use invalid default cache and continue is not good idea at all. Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Kerberos credentials may be stored in multiple places. Make itVince Busam2008-05-071-14/+16
| | | | | | | | | | possible to search several directories for valid credentials when making NFS requests. Original patch from Vince Busam <vbusam@google.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>. Signed-off-by: Steve Dickson <steved@redhat.com>
* Add the other two DES encryption types to the default list ofKevin Coffman2008-05-071-1/+3
| | | | | | | Kerberos encryption types that may be negotiated. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Stop gssd from ignoring the machine credential cacheVince Busam2008-02-261-1/+1
| | | | | | | defined by the -d flag Signed-off-by: Steve Dickson <steved@redhat.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Always get addressless ticketsKevin Coffman2007-05-031-2/+32
| | | | | | | | Make sure we get addressless tickets so we can function behind a NAT. (Must use a different function to accomplish this with Heimdal.) Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Factor out error message printing differences between MIT and HeimdalKevin Coffman2007-04-201-18/+44
| | | | | | | | | | Use a common function that factors out differences between MIT and Heimdal in getting the right error message printed. Add an autoconf check to see if the newer error message function is available. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Remove the now unused functionsKevin Coffman2007-03-311-234/+0
| | | | | | | | Remove functions that are no longer used when when obtaining machine credentials. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Clean up gssd_get_single_krb5_cred and its debugging messagesKevin Coffman2007-03-311-8/+12
| | | | | | | Clean up gssd_get_single_krb5_cred and its debugging messages Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use newly added keytab functionsKevin Coffman2007-03-311-7/+8
| | | | | | | | | | | | | | | | | | | | | | | Use the new functions added in the previous patch. Obtain machine credentials in a pre-determined order Look for appropriate machine credentials in the following order: root/<fqdn>@REALM nfs/<fqdn>@REALM host/<fqdn>@REALM root/<any-name>@REALM nfs/<any-name>@REALM host/<any-name>@REALM The first matching credential will be used. Also, the machine credentials to be used are now determined "on-demand" rather than at gssd startup. This allows keytab additions to be noticed and used without requiring a restart of gssd. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add new keytab handling functions for dealing with machine credentialsKevin Coffman2007-03-311-0/+466
| | | | | | | | | | | | | | | Add new functions that will be used in the next patch. The new behavior is to search for particular keytab entries in a specified order: root/<fqdn>@<REALM> nfs/<fqdn>@<REALM> host/<fqdn>@<REALM> root/<any-name>@<REALM> nfs/<any-name>@<REALM> host/<any-name>@<REALM> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Hide differences between MIT and Heimdal in macrosKevin Coffman2007-03-311-25/+5
| | | | | | | | | Clean up a lot of #ifdef'd code using macros, masking the differences between MIT and Heimdal implementations. The currently unused macros will be used in later patches. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix memory leak on error path of limit_krb5_enctypes()Kevin Coffman2007-03-311-0/+1
| | | | | | | Return credential on error path of limit_krb5_enctypes() Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Allow any credential to be used for machine credentialsKevin Coffman2007-03-191-16/+6
| | | | | | | | | | Don't restrict machine credentials to be "nfs/<machine.name>". Use any usable credentials contained in the keytab file. [We actually attempt to use the first entry found for each realm, not every entry, in the keytab.] Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Don't leak keytab entriesKevin Coffman2007-03-191-0/+5
| | | | | | | Free keytab entries while processing keytab file. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use lstat rather than stat in gssd_find_existing_krb5_ccacheNeil Brown2007-03-161-1/+1
| | | | | As this is a file in /tmp, a symlink could take us anywhere... If it was a NFS filesystem with a dead server, we could block for a long time..
* Use owner rather than filename format in choosing cred cache filesKevin Coffman2007-02-091-56/+50
| | | | | | | | | | | Signed-off-by: Glenn Machin <gmachin@sandia.gov> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Some installations use different name formats for their credentials caches. Instead of checking that the uid is part of the name, just make sure that uid is the owner of the file. This is a modification of the original patch from Glenn. Signed-off-by: Neil Brown <neilb@suse.de>
* Allow gssd ccaches in MEMORY: rather than FILE:Kevin Coffman2006-10-171-1/+7
| | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Add option to store gssd ccaches in a MEMORY: cache rather than the default FILE: cache. In response to suggestion from Steve Dickson <steved@redhat.com> and Nalin Dahyabhai <nalin@redhat.com>.
* Fix misc warning messagesKevin Coffman2006-10-171-0/+1
| | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Clean up a few warning messages.
* Limit acquire_cred call to to Kerberos onlykwc@citi.umich.edu2006-07-041-1/+6
| | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Specify that the acquire_cred call should only be concerned with returning Kerberos credentials since this is Kerberos-only functionality.
* Add option to specify directory to search for credentials cache filesneilbrown2006-03-281-6/+5
| | | | | | | | | From: Vince Busam <vbusam@google.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Add command line option to specify which directory should be searched to find credentials caches. (really this time)
* Updates from Kevin Coffman at UMichneilbrown2005-12-161-6/+4
|
* Add option to set rpcsec_gss debugging level (if available)neilbrown2005-08-261-4/+44
| | | | | | | Changes to allow gssd/svcgssd to build when using Hiemdal Kerberos libraries. Note that there are still run-time issues preventing this from working when shared libraries for libgssapi and librpcsecgss are used.
* 2005-08-26 Kevin Coffman <kwc@citi.umich.edu>neilbrown2005-08-261-39/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * utils/exportfs/exports.man: Document the "crossmnt" export export option * utils/gssd/krb5_util.c: Add better debugging and partially revert the function check for gss_krb5_ccache_name. For MIT Kerberos releases up to and including 1.3.1, we *must* use the routine gss_krb5_ccache_name to get the K5 gssapi code to use a different credentials cache. For releases 1.3.2 and on, we want to use the KRB5CCNAME environment variable to tell it what to use. (A problem was reported where 1.3.5 was being used, our code was using gss_krb5_ccache_name, but the underlying code continued to use the first (or default?) credentials cache. Switching to using the env variable fixed the problem. I cannot recreate this problem. *utils/gssd/krb5_util.c: Andrew Mahone <andrew.mahone@gmail.com> reported that reiser4 always has DT_UNKNOWN. He supplied patch to move the check for regular files after the stat() call to correctly find ccache files in reiser4 filesystem. Also change the name comparison so that the wrong file is not selected when the substring comparison is done. *utils/gssd/krb5_util.c: Limit the set of encryption types that can be negotiated by the Kerberos library to those that the kernel code currently supports. This should eventually query the kernel for the list of supported enctypes. *utils/gssd/gss_util.c, utils/svcgssd/svcgssd_main_loop.c: Print more information in error messages to help debugging failures. *utils/svcgssd/svcgssd_proc.c: Increase token buffer size and update error handling so that a response is always sent. *utils/svcgssd/svcgssd_proc.c: Add support to retrieve supplementary groups.
* Add gss support from citi @ umichneilbrown2004-10-191-0/+809
generated by cgit (git 2.34.1) at 2024-05-26 11:59:27 +0000