gssd: Update description of "-l" option

[nfs-utils.git] / utils / gssd / krb5_util.c

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 238927622f614c284970b2e5d2360f21046c8f51..8178ae7ec04e0853b1f7dac32ed2adb91e72bb1e 100644 (file)
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -350,6 +350,11 @@ gssd_get_single_krb5_cred(krb5_context context,
 
        memset(&my_creds, 0, sizeof(my_creds));
 
+       /*
+        * Workaround for clock skew among NFS server, NFS client and KDC
+        * 300 because clock skew must be within 300sec for kerberos
+        */
+       now += 300;
        if (ple->ccname && ple->endtime > now && !nocache) {
                printerr(2, "INFO: Credentials in CC '%s' are good until %d\n",
                         ple->ccname, ple->endtime);
@@ -774,12 +779,16 @@ gssd_search_krb5_keytab(krb5_context context, krb5_keytab kt,
 }
 
 /*
- * Find a keytab entry to use for a given target hostname.
+ * Find a keytab entry to use for a given target realm.
  * Tries to find the most appropriate keytab to use given the
  * name of the host we are trying to connect with.
+ *
+ * Note: the tgtname contains a hostname in the realm that we
+ * are authenticating to. It may, or may not be the same as
+ * the server hostname.
  */
 static int
-find_keytab_entry(krb5_context context, krb5_keytab kt, const char *hostname,
+find_keytab_entry(krb5_context context, krb5_keytab kt, const char *tgtname,
                  krb5_keytab_entry *kte, const char **svcnames)
 {
        krb5_error_code code;
@@ -795,7 +804,7 @@ find_keytab_entry(krb5_context context, krb5_keytab kt, const char *hostname,
 
 
        /* Get full target hostname */
-       retval = get_full_hostname(hostname, targethostname,
+       retval = get_full_hostname(tgtname, targethostname,
                                   sizeof(targethostname));
        if (retval)
                goto out;
@@ -1036,16 +1045,38 @@ err_cache:
  * Returns 0 if a ccache was found, and a non-zero error code otherwise.
  */
 int
-gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirname)
+gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername, char *dirpattern)
 {
-       char                    buf[MAX_NETOBJ_SZ];
+       char                    buf[MAX_NETOBJ_SZ], dirname[PATH_MAX];
        const char              *cctype;
        struct dirent           *d;
-       int                     err;
+       int                     err, i, j;
 
        printerr(2, "getting credentials for client with uid %u for "
                    "server %s\n", uid, servername);
-       memset(buf, 0, sizeof(buf));
+
+       for (i = 0, j = 0; dirpattern[i] != '\0'; i++) {
+               switch (dirpattern[i]) {
+               case '%':
+                       switch (dirpattern[i + 1]) {
+                       case '%':
+                               dirname[j++] = dirpattern[i];
+                               i++;
+                               break;
+                       case 'U':
+                               j += sprintf(dirname + j, "%lu",
+                                            (unsigned long) uid);
+                               i++;
+                               break;
+                       }
+                       break;
+               default:
+                       dirname[j++] = dirpattern[i];
+                       break;
+               }
+       }
+       dirname[j] = '\0';
+
        err = gssd_find_existing_krb5_ccache(uid, dirname, &cctype, &d);
        if (err)
                return err;
@@ -1106,7 +1137,7 @@ gssd_get_krb5_machine_cred_list(char ***list)
                if (ple->ccname) {
                        /* Make sure cred is up-to-date before returning it */
                        retval = gssd_refresh_krb5_machine_credential(NULL, ple,
-                               NULL);
+                               NULL, NULL);
                        if (retval)
                                continue;
                        if (i + 1 > listsize) {
@@ -1186,9 +1217,9 @@ gssd_destroy_krb5_machine_creds(void)
                                    "cache '%s'\n", k5err, ple->ccname);
                }
        }
+       krb5_free_context(context);
   out:
        free(k5err);
-       krb5_free_context(context);
 }
 
 /*
@@ -1197,7 +1228,8 @@ gssd_destroy_krb5_machine_creds(void)
 int
 gssd_refresh_krb5_machine_credential(char *hostname,
                                     struct gssd_k5_kt_princ *ple, 
-                                        char *service)
+                                        char *service,
+                                        char *tgtname)
 {
        krb5_error_code code = 0;
        krb5_context context;
@@ -1230,19 +1262,22 @@ gssd_refresh_krb5_machine_credential(char *hostname,
                k5err = gssd_k5_err_msg(context, code);
                printerr(0, "ERROR: %s: %s while resolving keytab '%s'\n",
                         __func__, k5err, keytabfile);
-               goto out;
+               goto out_free_context;
        }
 
        if (ple == NULL) {
                krb5_keytab_entry kte;
 
-               code = find_keytab_entry(context, kt, hostname, &kte, svcnames);
+               if (tgtname == NULL)
+                       tgtname = hostname;
+
+               code = find_keytab_entry(context, kt, tgtname, &kte, svcnames);
                if (code) {
                        printerr(0, "ERROR: %s: no usable keytab entry found "
                                 "in keytab %s for connection with host %s\n",
                                 __FUNCTION__, keytabfile, hostname);
                        retval = code;
-                       goto out;
+                       goto out_free_kt;
                }
 
                ple = get_ple_by_princ(context, kte.principal);
@@ -1258,14 +1293,15 @@ gssd_refresh_krb5_machine_credential(char *hostname,
                                 __FUNCTION__, pname ? pname : "<unparsable>",
                                 hostname);
                        if (pname) k5_free_unparsed_name(context, pname);
-                       goto out;
+                       goto out_free_kt;
                }
        }
        retval = gssd_get_single_krb5_cred(context, kt, ple, 0);
-out:
-       if (kt)
-               krb5_kt_close(context, kt);
+out_free_kt:
+       krb5_kt_close(context, kt);
+out_free_context:
        krb5_free_context(context);
+out:
        free(k5err);
        return retval;
 }