*/
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif /* HAVE_CONFIG_H */
+
#include <sys/param.h>
#include <sys/stat.h>
#include <rpc/rpc.h>
#include <fcntl.h>
#include <errno.h>
#include <nfsidmap.h>
+#include <nfslib.h>
+#include <time.h>
#include "svcgssd.h"
#include "gss_util.h"
#include "err_util.h"
#include "context.h"
-#include "cacheio.h"
extern char * mech2file(gss_OID mech);
#define SVCGSSD_CONTEXT_CHANNEL "/proc/net/rpc/auth.rpcsec.context/channel"
static int
do_svc_downcall(gss_buffer_desc *out_handle, struct svc_cred *cred,
- gss_OID mech, gss_buffer_desc *context_token)
+ gss_OID mech, gss_buffer_desc *context_token,
+ int32_t endtime)
{
FILE *f;
int i;
char *fname = NULL;
+ int err;
printerr(1, "doing downcall\n");
if ((fname = mech2file(mech)) == NULL)
}
qword_printhex(f, out_handle->value, out_handle->length);
/* XXX are types OK for the rest of this? */
- qword_printint(f, 0x7fffffff); /*XXX need a better timeout */
+ /* For context cache, use the actual context endtime */
+ qword_printint(f, endtime);
qword_printint(f, cred->cr_uid);
qword_printint(f, cred->cr_gid);
qword_printint(f, cred->cr_ngroups);
- for (i=0; i < cred->cr_ngroups; i++)
+ printerr(2, "mech: %s, hndl len: %d, ctx len %d, timeout: %d (%d from now), "
+ "uid: %d, gid: %d, num aux grps: %d:\n",
+ fname, out_handle->length, context_token->length,
+ endtime, endtime - time(0),
+ cred->cr_uid, cred->cr_gid, cred->cr_ngroups);
+ for (i=0; i < cred->cr_ngroups; i++) {
qword_printint(f, cred->cr_groups[i]);
+ printerr(2, " (%4d) %d\n", i+1, cred->cr_groups[i]);
+ }
qword_print(f, fname);
qword_printhex(f, context_token->value, context_token->length);
- qword_eol(f);
+ err = qword_eol(f);
+ if (err) {
+ printerr(1, "WARNING: error writing to downcall channel "
+ "%s: %s\n", SVCGSSD_CONTEXT_CHANNEL, strerror(errno));
+ }
fclose(f);
- return 0;
+ return err;
out_err:
- printerr(0, "WARNING: downcall failed\n");
+ printerr(1, "WARNING: downcall failed\n");
return -1;
}
qword_addhex(&bp, &blen, in_handle->value, in_handle->length);
qword_addhex(&bp, &blen, in_token->value, in_token->length);
- qword_addint(&bp, &blen, 0x7fffffff); /*XXX need a better timeout */
- qword_addint(&bp, &blen, maj_stat);
- qword_addint(&bp, &blen, min_stat);
+ /* For init cache, only needed for a short time */
+ qword_addint(&bp, &blen, time(0) + 60);
+ qword_adduint(&bp, &blen, maj_stat);
+ qword_adduint(&bp, &blen, min_stat);
qword_addhex(&bp, &blen, out_handle->value, out_handle->length);
qword_addhex(&bp, &blen, out_token->value, out_token->length);
qword_addeol(&bp, &blen);
return -1;
}
*bp = '\0';
- printerr(1, "writing message: %s", buf);
+ printerr(3, "writing message: %s", buf);
if (write(g, buf, bp - buf) == -1) {
printerr(0, "WARNING: failed to write message\n");
close(g);
uid_t uid, gid;
gss_OID name_type = GSS_C_NO_OID;
char *secname;
- gid_t *groups;
maj_stat = gss_display_name(&min_stat, client_name, &name, &name_type);
if (maj_stat != GSS_S_COMPLETE) {
maj_stat, min_stat, mech);
goto out;
}
- if (!(sname = calloc(name.length + 1, 1))) {
+ if (name.length >= 0xffff || /* be certain name.length+1 doesn't overflow */
+ !(sname = calloc(name.length + 1, 1))) {
printerr(0, "WARNING: get_ids: error allocating %d bytes "
"for sname\n", name.length + 1);
+ gss_release_buffer(&min_stat, &name);
goto out;
}
memcpy(sname, name.value, name.length);
printerr(1, "sname = %s\n", sname);
+ gss_release_buffer(&min_stat, &name);
res = -EINVAL;
if ((secname = mech2file(mech)) == NULL) {
nfs4_init_name_mapping(NULL); /* XXX: should only do this once */
res = nfs4_gss_princ_to_ids(secname, sname, &uid, &gid);
if (res < 0) {
- printerr(0, "WARNING: get_ids: unable to map "
- "name '%s' to a uid\n", sname);
+ /*
+ * -ENOENT means there was no mapping, any other error
+ * value means there was an error trying to do the
+ * mapping.
+ * If there was no mapping, we send down the value -1
+ * to indicate that the anonuid/anongid for the export
+ * should be used.
+ */
+ if (res == -ENOENT) {
+ cred->cr_uid = -1;
+ cred->cr_gid = -1;
+ cred->cr_ngroups = 0;
+ res = 0;
+ goto out_free;
+ }
+ printerr(1, "WARNING: get_ids: failed to map name '%s' "
+ "to uid/gid: %s\n", sname, strerror(-res));
goto out_free;
}
cred->cr_uid = uid;
return res;
}
+#ifdef DEBUG
void
-print_hexl(int pri, unsigned char *cp, int length)
+print_hexl(const char *description, unsigned char *cp, int length)
{
int i, j, jm;
unsigned char c;
- printerr(pri, "length %d\n",length);
- printerr(pri, "\n");
+ printf("%s (length %d)\n", description, length);
for (i = 0; i < length; i += 0x10) {
- printerr(pri, " %04x: ", (u_int)i);
+ printf(" %04x: ", (u_int)i);
jm = length - i;
jm = jm > 16 ? 16 : jm;
for (j = 0; j < jm; j++) {
if ((j % 2) == 1)
- printerr(pri,"%02x ", (u_int)cp[i+j]);
+ printf("%02x ", (u_int)cp[i+j]);
else
- printerr(pri,"%02x", (u_int)cp[i+j]);
+ printf("%02x", (u_int)cp[i+j]);
}
for (; j < 16; j++) {
if ((j % 2) == 1)
- printerr(pri," ");
+ printf(" ");
else
- printerr(pri," ");
+ printf(" ");
}
- printerr(pri," ");
+ printf(" ");
for (j = 0; j < jm; j++) {
c = cp[i+j];
c = isprint(c) ? c : '.';
- printerr(pri,"%c", c);
+ printf("%c", c);
}
- printerr(pri,"\n");
+ printf("\n");
}
}
+#endif
void
handle_nullreq(FILE *f) {
in_handle = {.value = in_handle_buf},
out_handle = {.value = out_handle_buf},
ctx_token = {.value = NULL},
+ ignore_out_tok = {.value = NULL},
/* XXX isn't there a define for this?: */
null_token = {.value = NULL};
u_int32_t ret_flags;
gss_name_t client_name;
gss_OID mech = GSS_C_NO_OID;
u_int32_t maj_stat = GSS_S_FAILURE, min_stat = 0;
+ u_int32_t ignore_min_stat;
struct svc_cred cred;
static char *lbuf = NULL;
static int lbuflen = 0;
static char *cp;
+ int32_t ctx_endtime;
printerr(1, "handling null request\n");
in_handle.length = (size_t) qword_get(&cp, in_handle.value,
sizeof(in_handle_buf));
- printerr(2, "in_handle: \n");
- print_hexl(2, in_handle.value, in_handle.length);
+#ifdef DEBUG
+ print_hexl("in_handle", in_handle.value, in_handle.length);
+#endif
in_tok.length = (size_t) qword_get(&cp, in_tok.value,
sizeof(in_tok_buf));
- printerr(2, "in_tok: \n");
- print_hexl(2, in_tok.value, in_tok.length);
+#ifdef DEBUG
+ print_hexl("in_tok", in_tok.value, in_tok.length);
+#endif
if (in_tok.length < 0) {
printerr(0, "WARNING: handle_nullreq: "
goto continue_needed;
}
else if (maj_stat != GSS_S_COMPLETE) {
- printerr(0, "WARNING: gss_accept_sec_context failed\n");
+ printerr(1, "WARNING: gss_accept_sec_context failed\n");
pgsserr("handle_nullreq: gss_accept_sec_context",
maj_stat, min_stat, mech);
goto out_err;
if (get_ids(client_name, mech, &cred)) {
/* get_ids() prints error msg */
maj_stat = GSS_S_BAD_NAME; /* XXX ? */
+ gss_release_name(&ignore_min_stat, &client_name);
goto out_err;
}
+ gss_release_name(&ignore_min_stat, &client_name);
/* Context complete. Pass handle_seq in out_handle to use
/* kernel needs ctx to calculate verifier on null response, so
* must give it context before doing null call: */
- if (serialize_context_for_kernel(ctx, &ctx_token, mech)) {
+ if (serialize_context_for_kernel(ctx, &ctx_token, mech, &ctx_endtime)) {
printerr(0, "WARNING: handle_nullreq: "
"serialize_context_for_kernel failed\n");
maj_stat = GSS_S_FAILURE;
goto out_err;
}
- do_svc_downcall(&out_handle, &cred, mech, &ctx_token);
+ /* We no longer need the gss context */
+ gss_delete_sec_context(&ignore_min_stat, &ctx, &ignore_out_tok);
+
+ do_svc_downcall(&out_handle, &cred, mech, &ctx_token, ctx_endtime);
continue_needed:
send_response(f, &in_handle, &in_tok, maj_stat, min_stat,
&out_handle, &out_tok);
out:
if (ctx_token.value != NULL)
free(ctx_token.value);
+ if (out_tok.value != NULL)
+ gss_release_buffer(&ignore_min_stat, &out_tok);
printerr(1, "finished handling null request\n");
return;
out_err:
+ if (ctx != GSS_C_NO_CONTEXT)
+ gss_delete_sec_context(&ignore_min_stat, &ctx, &ignore_out_tok);
send_response(f, &in_handle, &in_tok, maj_stat, min_stat,
&null_token, &null_token);
goto out;
projects / nfs-utils.git / blobdiff