X-Git-Url: https://git.decadent.org.uk/gitweb/?a=blobdiff_plain;f=utils%2Fgssd%2Fkrb5_util.c;h=6275dd8717c64c69939481444bc4b115a2a93a13;hb=188e5ae9789bf0a7f8033f6aae40e65e652c7b08;hp=4befa72a5b1f6fb9c496a705602e57a0e30e1f00;hpb=5b9108f73a5f15372f9be9238070cf8d62956a49;p=nfs-utils.git diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c index 4befa72..6275dd8 100644 --- a/utils/gssd/krb5_util.c +++ b/utils/gssd/krb5_util.c @@ -169,13 +169,13 @@ select_krb5_ccache(const struct dirent *d) /* * Look in directory "dirname" for files that look like they - * are Kerberos Credential Cache files for a given UID. Return - * non-zero and the dirent pointer for the entry most likely to be - * what we want. Otherwise, return zero and no dirent pointer. - * The caller is responsible for freeing the dirent if one is returned. + * are Kerberos Credential Cache files for a given UID. * - * Returns 0 if a valid-looking entry was found and a non-zero error - * code otherwise. + * Returns 0 if a valid-looking entry is found. "*cctype" is + * set to the name of the cache type. A pointer to the dirent + * is planted in "*d". Caller must free "*d" with free(3). + * + * Otherwise, a negative errno is returned. */ static int gssd_find_existing_krb5_ccache(uid_t uid, char *dirname, @@ -350,6 +350,11 @@ gssd_get_single_krb5_cred(krb5_context context, memset(&my_creds, 0, sizeof(my_creds)); + /* + * Workaround for clock skew among NFS server, NFS client and KDC + * 300 because clock skew must be within 300sec for kerberos + */ + now += 300; if (ple->ccname && ple->endtime > now && !nocache) { printerr(2, "INFO: Credentials in CC '%s' are good until %d\n", ple->ccname, ple->endtime); @@ -805,8 +810,8 @@ find_keytab_entry(krb5_context context, krb5_keytab kt, const char *tgtname, goto out; /* Get full local hostname */ - retval = gethostname(myhostname, sizeof(myhostname)); - if (retval) { + if (gethostname(myhostname, sizeof(myhostname)) == -1) { + retval = errno; k5err = gssd_k5_err_msg(context, retval); printerr(1, "%s while getting local hostname\n", k5err); goto out; @@ -1037,7 +1042,7 @@ err_cache: * given only a UID. We really need more information, but we * do the best we can. * - * Returns 0 if a ccache was found, and a non-zero error code otherwise. + * Returns 0 if a ccache was found, or a negative errno otherwise. */ int gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirpattern) @@ -1082,7 +1087,7 @@ gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirpattern) printerr(2, "using %s as credentials cache for client with " "uid %u for server %s\n", buf, uid, servername); gssd_set_krb5_ccache_name(buf); - return err; + return 0; } /* @@ -1345,6 +1350,57 @@ gssd_k5_get_default_realm(char **def_realm) krb5_free_context(context); } +static int +gssd_acquire_krb5_cred(gss_name_t name, gss_cred_id_t *gss_cred) +{ + OM_uint32 maj_stat, min_stat; + gss_OID_set_desc desired_mechs = { 1, &krb5oid }; + + maj_stat = gss_acquire_cred(&min_stat, name, GSS_C_INDEFINITE, + &desired_mechs, GSS_C_INITIATE, + gss_cred, NULL, NULL); + + if (maj_stat != GSS_S_COMPLETE) { + if (get_verbosity() > 0) + pgsserr("gss_acquire_cred", + maj_stat, min_stat, &krb5oid); + return -1; + } + + return 0; +} + +int +gssd_acquire_user_cred(uid_t uid, gss_cred_id_t *gss_cred) +{ + OM_uint32 maj_stat, min_stat; + gss_buffer_desc name_buf; + gss_name_t name; + char buf[11]; + int ret; + + ret = snprintf(buf, 11, "%u", uid); + if (ret < 1 || ret > 10) { + return -1; + } + name_buf.value = buf; + name_buf.length = ret + 1; + + maj_stat = gss_import_name(&min_stat, &name_buf, + GSS_C_NT_STRING_UID_NAME, &name); + if (maj_stat != GSS_S_COMPLETE) { + if (get_verbosity() > 0) + pgsserr("gss_import_name", + maj_stat, min_stat, &krb5oid); + return -1; + } + + ret = gssd_acquire_krb5_cred(name, gss_cred); + + maj_stat = gss_release_name(&min_stat, &name); + return ret; +} + #ifdef HAVE_SET_ALLOWABLE_ENCTYPES /* * this routine obtains a credentials handle via gss_acquire_cred() @@ -1363,28 +1419,18 @@ int limit_krb5_enctypes(struct rpc_gss_sec *sec) { u_int maj_stat, min_stat; - gss_cred_id_t credh; - gss_OID_set_desc desired_mechs; krb5_enctype enctypes[] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4 }; int num_enctypes = sizeof(enctypes) / sizeof(enctypes[0]); extern int num_krb5_enctypes; extern krb5_enctype *krb5_enctypes; + int err = -1; - /* We only care about getting a krb5 cred */ - desired_mechs.count = 1; - desired_mechs.elements = &krb5oid; - - maj_stat = gss_acquire_cred(&min_stat, NULL, 0, - &desired_mechs, GSS_C_INITIATE, - &credh, NULL, NULL); - - if (maj_stat != GSS_S_COMPLETE) { - if (get_verbosity() > 0) - pgsserr("gss_acquire_cred", - maj_stat, min_stat, &krb5oid); - return -1; + if (sec->cred == GSS_C_NO_CREDENTIAL) { + err = gssd_acquire_krb5_cred(GSS_C_NO_NAME, &sec->cred); + if (err) + return -1; } /* @@ -1392,19 +1438,17 @@ limit_krb5_enctypes(struct rpc_gss_sec *sec) * list of supported enctypes, use local default here. */ if (krb5_enctypes == NULL || limit_to_legacy_enctypes) - maj_stat = gss_set_allowable_enctypes(&min_stat, credh, + maj_stat = gss_set_allowable_enctypes(&min_stat, sec->cred, &krb5oid, num_enctypes, enctypes); else - maj_stat = gss_set_allowable_enctypes(&min_stat, credh, + maj_stat = gss_set_allowable_enctypes(&min_stat, sec->cred, &krb5oid, num_krb5_enctypes, krb5_enctypes); if (maj_stat != GSS_S_COMPLETE) { pgsserr("gss_set_allowable_enctypes", maj_stat, min_stat, &krb5oid); - gss_release_cred(&min_stat, &credh); return -1; } - sec->cred = credh; return 0; }