Always get addressless tickets

Make sure we get addressless tickets so we can function behind a NAT.
(Must use a different function to accomplish this with Heimdal.)

Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
Signed-off-by: Neil Brown <neilb@suse.de>

diff --git a/aclocal/kerberos5.m4 b/aclocal/kerberos5.m4
index 2475f506a25fa4d8d76444e45c953fecba951f01..dfa5738c468989ea62bb5909730e83ab5bf059bf 100644 (file)
--- a/aclocal/kerberos5.m4
+++ b/aclocal/kerberos5.m4
@@ -97,6 +97,10 @@ AC_DEFUN([AC_KERBEROS_V5],[
   AC_CHECK_LIB($gssapi_lib, krb5_get_error_message,
     AC_DEFINE(HAVE_KRB5_GET_ERROR_MESSAGE, 1, [Define this if the function krb5_get_error_message is available]), ,$KRBLIBS)
 
   AC_CHECK_LIB($gssapi_lib, krb5_get_error_message,
     AC_DEFINE(HAVE_KRB5_GET_ERROR_MESSAGE, 1, [Define this if the function krb5_get_error_message is available]), ,$KRBLIBS)
 

+  dnl Check for function to specify addressless tickets
+  AC_CHECK_LIB($gssapi_lib, krb5_get_init_creds_opt_set_addressless,
+    AC_DEFINE(HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS, 1, [Define this if the function krb5_get_init_creds_opt_set_addressless is available]), ,$KRBLIBS)
+

   dnl If they specified a directory and it didn't work, give them a warning
   if test "x$krb5_with" != "x" -a "$krb5_with" != "$KRBDIR"; then
     AC_MSG_WARN(Using $KRBDIR instead of requested value of $krb5_with for Kerberos!)
   dnl If they specified a directory and it didn't work, give them a warning
   if test "x$krb5_with" != "x" -a "$krb5_with" != "$KRBDIR"; then
     AC_MSG_WARN(Using $KRBDIR instead of requested value of $krb5_with for Kerberos!)

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 87bd7e41cc563d89527c7b56b4c50c98fc7edbbd..bf8690e3fbd325ca12ac6e7c608d82f91f197a62 100644 (file)
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -323,7 +323,12 @@ gssd_get_single_krb5_cred(krb5_context context,
                          krb5_keytab kt,
                          struct gssd_k5_kt_princ *ple)
 {
                          krb5_keytab kt,
                          struct gssd_k5_kt_princ *ple)
 {

+#if HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS
+       krb5_get_init_creds_opt *init_opts = NULL;
+#else

        krb5_get_init_creds_opt options;
        krb5_get_init_creds_opt options;

+#endif
+       krb5_get_init_creds_opt *opts;

        krb5_creds my_creds;
        krb5_ccache ccache = NULL;
        char kt_name[BUFSIZ];
        krb5_creds my_creds;
        krb5_ccache ccache = NULL;
        char kt_name[BUFSIZ];


@@ -351,16 +356,37 @@ gssd_get_single_krb5_cred(krb5_context context,
        if ((krb5_unparse_name(context, ple->princ, &pname)))
                pname = NULL;
 
        if ((krb5_unparse_name(context, ple->princ, &pname)))
                pname = NULL;
 

+#if HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS
+       code = krb5_get_init_creds_opt_alloc(context, &init_opts);
+       if (code) {
+               printerr(0, "ERROR: %s allocating gic options\n",
+                        gssd_k5_err_msg(context, code));
+               goto out;
+       }
+       if (krb5_get_init_creds_opt_set_addressless(context, init_opts, 1))
+               printerr(0, "WARNING: Unable to set option for addressless "
+                        "tickets.  May have problems behind a NAT.\n");
+#ifdef TEST_SHORT_LIFETIME
+       /* set a short lifetime (for debugging only!) */
+       printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n");
+       krb5_get_init_creds_opt_set_tkt_life(init_opts, 5*60);
+#endif
+       opts = init_opts;
+
+#else  /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS */
+

        krb5_get_init_creds_opt_init(&options);
        krb5_get_init_creds_opt_set_address_list(&options, NULL);
        krb5_get_init_creds_opt_init(&options);
        krb5_get_init_creds_opt_set_address_list(&options, NULL);

-

 #ifdef TEST_SHORT_LIFETIME
        /* set a short lifetime (for debugging only!) */
        printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n");
        krb5_get_init_creds_opt_set_tkt_life(&options, 5*60);
 #endif
 #ifdef TEST_SHORT_LIFETIME
        /* set a short lifetime (for debugging only!) */
        printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n");
        krb5_get_init_creds_opt_set_tkt_life(&options, 5*60);
 #endif

+       opts = &options;
+#endif
+

        if ((code = krb5_get_init_creds_keytab(context, &my_creds, ple->princ,
        if ((code = krb5_get_init_creds_keytab(context, &my_creds, ple->princ,

-                                              kt, 0, NULL, &options))) {
+                                              kt, 0, NULL, opts))) {

                printerr(0, "WARNING: %s while getting initial ticket for "
                         "principal '%s' using keytab '%s'\n",
                         gssd_k5_err_msg(context, code),
                printerr(0, "WARNING: %s while getting initial ticket for "
                         "principal '%s' using keytab '%s'\n",
                         gssd_k5_err_msg(context, code),


@@ -411,6 +437,10 @@ gssd_get_single_krb5_cred(krb5_context context,
        printerr(2, "Successfully obtained machine credentials for "
                 "principal '%s' stored in ccache '%s'\n", pname, cc_name);
   out:
        printerr(2, "Successfully obtained machine credentials for "
                 "principal '%s' stored in ccache '%s'\n", pname, cc_name);
   out:

+#if HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS
+       if (init_opts)
+               krb5_get_init_creds_opt_free(context, init_opts);
+#endif

        if (pname)
                k5_free_unparsed_name(context, pname);
        if (ccache)
        if (pname)
                k5_free_unparsed_name(context, pname);
        if (ccache)