summaryrefslogtreecommitdiffstats
path: root/utils/gssd
Commit message (Collapse)AuthorAgeFilesLines
* svcgssd: use the actual context expiration for cacheKevin Coffman2008-12-111-7/+13
| | | | | | | | | | | | | | | Instead of sending down an infinite expiration value for the rsi(init) and rsc(context) cache entries, use a reasonable value for the rsi cache, and the actual context expiration value for the rsc cache. Prompted by a proposal from Neil Brown as a result of a complaint of a server running out of kernel memory when under heavy load of rpcsec_gss traffic. Neil's original patch used one minute for the init cache and one hour for the context cache. Using the actual expiration time prevents unnecessary context re-negotiation. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd/svcgssd: add support to retrieve actual context expirationKevin Coffman2008-12-118-17/+30
| | | | | | | | | Add some plumbing so that the context expiration can be returned while serializing the information. Later patch(es) will actually get the expiration and pass it down to the kernel. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: unblock DNOTIFY_SIGNAL in case it was blocked.Neil Brown2008-11-261-0/+6
| | | | | | | | | | | | | | | | | | | | I have a situation where rpc.gssd appears to not be working. Mount attempts which need to communicate with it block. I've narrowed down the problem to that fact that all realtime signals have been blocked. This means that DNOTIFY_SIGNAL (which is a realtime signal) is never delivered, so gssd never rescans the rpc_pipe/nfs directory. It seems start_kde (or whatever it is called) and all descendants have these signals blocked. xfce seems to do the same thing. gnome doesn't. So if you start rpc.gssd from a terminal window while logged in via KDE, it doesn't behave as expected. Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* The rpc.gssd scans for any suitable kerberos ticket. In cross-realmLukas Hejtmanek2008-07-155-15/+165
| | | | | | | | | | environment this may not be the desired behaviour. Therefore a new option, -R preferred realm, is presented so that the rpc.gssd prefers tickets from this realm. By default, the default realm is preferred. Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* The default expiration of kernel gss contexts is the expirationLukas Hejtmanek2008-07-154-4/+16
| | | | | | | | | | | | | | | | | of the Kerberos ticket used in its creation. (For contexts created using the Kerberos mechanism.) Thus kdestroy has no effect in nullifying the kernel context. This patch adds -t <timeout> option to rpc.gssd so that the client's administrator may specify a timeout for expiration of contexts in kernel. After this timeout, rpc.gssd is consulted to create a new context. By default, timeout is 0 (i.e., no timeout at all) which follows the previous behavior. Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd_setup_krb5_user_gss_ccache must return an error if no usable cache isLukas Hejtmanek2008-07-153-8/+8
| | | | | | | | found. Trying to use invalid default cache and continue is not good idea at all. Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Kerberos credentials may be stored in multiple places. Make itVince Busam2008-05-076-20/+43
| | | | | | | | | | possible to search several directories for valid credentials when making NFS requests. Original patch from Vince Busam <vbusam@google.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>. Signed-off-by: Steve Dickson <steved@redhat.com>
* Add a new function to retrieve the current verbosity levelKevin Coffman2008-05-072-0/+6
| | | | | | | | so that some messages that would otherwise always print may be silenced. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Add the other two DES encryption types to the default list ofKevin Coffman2008-05-071-1/+3
| | | | | | | Kerberos encryption types that may be negotiated. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Check the info file nfs/rpc_pipefs/nfs/clnt?/info toOlga Kornievskaia2008-05-072-2/+13
| | | | | | | | | see if a port number was supplied. If so, use it rather than the default port number. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Turn down gssd's syslog verbosityTimo Aaltonen2008-03-132-2/+5
| | | | | Modified-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Fixed typo in gssd manpageSteinar H. Gunderson2008-03-101-1/+1
| | | | | Signed-off-by: Steinar H. Gunderson <sgunderson@bigfoot.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Increase the number of concurrent krb5 mounts by increasingDrew Middlesworth2008-03-041-1/+1
| | | | | | | the size of the poll array Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Stop gssd from ignoring the machine credential cacheVince Busam2008-02-261-1/+1
| | | | | | | defined by the -d flag Signed-off-by: Steve Dickson <steved@redhat.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Remove old logging implementation for idmapd and rework gssd and idmapd to ↵Kevin Coffman2007-10-152-38/+8
| | | | | | | | | | | | | use the new xlog logging infrastructure. This patch removes all of the old idmap_* logging functions and replaced them with the corresponding xlog functions. In addition that that it also reworks the gssd logging wrappers to use the new xlog_backend. Finally it makes necessary changes to the build files to get the project compiling again. Signed-off-by: David P. Quigley <dpquigl@tycho.nsa.gov> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Remove svcgssd's private version of cacheio.cKevin Coffman2007-10-152-346/+0
| | | | | | | | Now that svcgssd is using the qword_* functions in the support library, remove the private version. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use nfslib versions of cacheio functionsKevin Coffman2007-10-152-3/+1
| | | | | | | | | | Now that the nfslib library has all the necessary functions and they all operate as needed, use them instead of the private versions in utils/gssd/cacheio.c. The obsolete private versions are removed in the next patch. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use printerr to print svcgssd downcall debugging infoKevin Coffman2007-10-152-12/+7
| | | | | | | | | | | Rather than depending on modified qword_* functions to print svcgssd debugging information, use printerr in the downcall function. And while we're at it, label things so we know what we're looking at! Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Make print_hexl function write to stdout rather than using printerrKevin Coffman2007-10-151-15/+18
| | | | | | | | | | print_hexl() currently uses printerr, but is really only necessary for local debugging and should simply write to stdout. Also change it to print the description internally. Wrap it and its use in #ifdef DEBUG. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix new warning after strict prototype checking enabledKevin Coffman2007-10-151-1/+1
| | | | | | | | Fix function declaration to eliminate compiler warning about it not being a prototype after -Wstrict-prototypes was added. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix the usage message for gssd to reflect new optionKevin Coffman2007-09-111-1/+1
| | | | | | | Fix the usage message for gssd to reflect new -M option added in 1.1.0 Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* gitignore updatesJ. Bruce Fields2007-07-101-0/+3
| | | | | | | Update gitignore to ignore some generated files. Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Always get addressless ticketsKevin Coffman2007-05-031-2/+32
| | | | | | | | Make sure we get addressless tickets so we can function behind a NAT. (Must use a different function to accomplish this with Heimdal.) Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Factor out error message printing differences between MIT and HeimdalKevin Coffman2007-04-203-23/+51
| | | | | | | | | | Use a common function that factors out differences between MIT and Heimdal in getting the right error message printed. Add an autoconf check to see if the newer error message function is available. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Tell Heimdal gss code the correct credential to useKevin Coffman2007-04-201-0/+2
| | | | | Always use the gss_krb5_ccache_name() function to tell Heimdal which credentials to use.
* Add a debug message indicating that gssd is ready to process requestsKevin Coffman2007-03-311-0/+1
| | | | | | | Add a debug message indicating that gssd is ready to process requests Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Remove the now unused functionsKevin Coffman2007-03-312-235/+0
| | | | | | | | Remove functions that are no longer used when when obtaining machine credentials. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Clean up gssd_get_single_krb5_cred and its debugging messagesKevin Coffman2007-03-311-8/+12
| | | | | | | Clean up gssd_get_single_krb5_cred and its debugging messages Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use newly added keytab functionsKevin Coffman2007-03-315-20/+31
| | | | | | | | | | | | | | | | | | | | | | | Use the new functions added in the previous patch. Obtain machine credentials in a pre-determined order Look for appropriate machine credentials in the following order: root/<fqdn>@REALM nfs/<fqdn>@REALM host/<fqdn>@REALM root/<any-name>@REALM nfs/<any-name>@REALM host/<any-name>@REALM The first matching credential will be used. Also, the machine credentials to be used are now determined "on-demand" rather than at gssd startup. This allows keytab additions to be noticed and used without requiring a restart of gssd. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add new keytab handling functions for dealing with machine credentialsKevin Coffman2007-03-312-0/+468
| | | | | | | | | | | | | | | Add new functions that will be used in the next patch. The new behavior is to search for particular keytab entries in a specified order: root/<fqdn>@<REALM> nfs/<fqdn>@<REALM> host/<fqdn>@<REALM> root/<any-name>@<REALM> nfs/<any-name>@<REALM> host/<any-name>@<REALM> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Hide differences between MIT and Heimdal in macrosKevin Coffman2007-03-312-25/+20
| | | | | | | | | Clean up a lot of #ifdef'd code using macros, masking the differences between MIT and Heimdal implementations. The currently unused macros will be used in later patches. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix memory leak on error path of limit_krb5_enctypes()Kevin Coffman2007-03-311-0/+1
| | | | | | | Return credential on error path of limit_krb5_enctypes() Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add missing newlinesKevin Coffman2007-03-311-6/+6
| | | | | | | Add missing newlines to error messages. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Create two separate paths for pipefs_dir and pipefs_nfsdir.Kevin Coffman2007-03-194-21/+23
| | | | | | | | | Future work needs access to the base pipefs directory rather than the nfs subdirectory. Create two separate paths called pipefs_dir and pipefs_nfsdir with the name of each. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Allow any credential to be used for machine credentialsKevin Coffman2007-03-192-18/+16
| | | | | | | | | | Don't restrict machine credentials to be "nfs/<machine.name>". Use any usable credentials contained in the keytab file. [We actually attempt to use the first entry found for each realm, not every entry, in the keytab.] Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add option to allow root to use credentials other than machine credentialsKevin Coffman2007-03-194-54/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | Add a new option ("-n") to rpc.gssd to indicate that accesses as root (uid 0) should not use machine credentials, but should instead use "normal" Kerberos credentials obtained by root. This change was prompted by a suggestion and patch from Daniel Muntz <Dan.Muntz@netapp.com>. That patch suggested trying "normal" credentials first and falling back to using machine creds for uid 0 if normal creds failed. This opens up the case where root may have credentials as "foo@REALM" and begins accessing files. Then the context using those credentials expires and must be renewed. If the credentials are now expired, then root's new context would fall back and be created with the machine credentials. Instead, this patch insists that the administrator choose to use either machine credentials for accesses by uid 0 (the default behavior, as it was before) or "normal" credentials. In the latter case, arrangements must be made to obtain credentials before attempting a mount. There should be no doubts which credentials are used for uid 0. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Don't leak keytab entriesKevin Coffman2007-03-191-0/+5
| | | | | | | Free keytab entries while processing keytab file. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use lstat rather than stat in gssd_find_existing_krb5_ccacheNeil Brown2007-03-161-1/+1
| | | | | As this is a file in /tmp, a symlink could take us anywhere... If it was a NFS filesystem with a dead server, we could block for a long time..
* Add option to svcgssd to enable libnfsidmap debugging.Kevin Coffman2007-02-092-4/+20
| | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> As suggested by Glenn Machin <GMachin@sandia.gov>. Allow svcgssd to turn on libnfsidmap debugging. This uses a new command-line parameter so that it can be enabled independently from other debugging. Signed-off-by: Neil Brown <neilb@suse.de>
* Share handling of lucid_sec_context for Heimdal and MITKevin Coffman2007-02-095-170/+234
| | | | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> The 0.8 release of Heimdal has (will have) support for the lucid context. The handling of lucid_sec_context can be shared between builds with MIT or Heimdal Kerberos. Split out the lucid_sec_context code from context_mit.c and make a new common file, context_lucid.c. Signed-off-by: Neil Brown <neilb@suse.de>
* Use owner rather than filename format in choosing cred cache filesKevin Coffman2007-02-091-56/+50
| | | | | | | | | | | Signed-off-by: Glenn Machin <gmachin@sandia.gov> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Some installations use different name formats for their credentials caches. Instead of checking that the uid is part of the name, just make sure that uid is the owner of the file. This is a modification of the original patch from Glenn. Signed-off-by: Neil Brown <neilb@suse.de>
* Use the gssglue version of gssapi.h for svcgssd_mech2file.cKevin Coffman2007-02-091-5/+1
| | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Remove Kerberos implementation dependency from svcgssd_mech2file.c Signed-off-by: Neil Brown <neilb@suse.de>
* Treat GSSAPI error codes as unsigned.Kevin Coffman2007-02-093-2/+14
| | | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> GSSAPI error codes (major and minor) are defined as unsigned values. However, we treat them as signed while passing them down to the kernel where conversion fails if they include the minus sign. Convert them as unsigned. Signed-off-by: Neil Brown <neilb@suse.de>
* Fix an off-by-one in the handling of the -d option to rpc.gssdSteinar H. Gunderson2007-02-051-1/+1
| | | | https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/76409
* Error check messages sent to the kernel.Neil Brown2007-01-113-5/+8
| | | | | | And make sure that if we fail to export a filesystem in mountd, then we don't try to get a filehandle on it, or a deadlock might occur.
* Allow gssd ccaches in MEMORY: rather than FILE:Kevin Coffman2006-10-173-2/+13
| | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Add option to store gssd ccaches in a MEMORY: cache rather than the default FILE: cache. In response to suggestion from Steve Dickson <steved@redhat.com> and Nalin Dahyabhai <nalin@redhat.com>.
* Implement a new version of lucid spkm3 context.Olga Kornievskaia2006-10-171-20/+19
| | | | | | | | Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Implement a new version of lucid spkm3 context which is passed down to the kernel.
* Fix misc warning messagesKevin Coffman2006-10-173-1/+3
| | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Clean up a few warning messages.
* Fix compilation problem - write_oid not definedKevin Coffman2006-07-211-0/+13
|
* Use uid/gid of -1 to indicate the export's anonuid/anongid should be usedKevin Coffman2006-07-081-2/+5
| | | | | | | | | | | Kernel routine nfsd_setuser() in fs/nfsd/auth.c checks for the value -1 and defaults the credential's fsuid/fsgid to the correct anonuid/anongid values for the given export. We should be passing this value (-1) down when a name mapping cannot be found. Thanks to J. Bruce Fields <bfields@fieldses.org> for the reference. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Acked-by: J. Bruce Fields <bfields@fieldses.org>
generated by cgit (git 2.34.1) at 2025-09-22 09:51:10 +0000