GSSD: Pass GSS_context lifetime to the kernel.

From: Andy Adamson <andros@netapp.com>

The kernel gss_cl_ctx stores the context lifetime in gc_expiry, set
by gssd in do_downcall() called by process_krb5_upcall(). The lifetime
value is currently not related at all to the Kerberos TGS lifetime.
It is either set to the value of gssd -t <timeout>, or to a kernel
default of 3600 seconds.

Most of the time the gssd -t command line is not set, and a timeout
value of zero was sent to the kernel triggering the use of the 3600
second kernel default timeout.

In order for the kernel to properly know when to renew a context, or to
stop buffering writes for a context about to expire, the gc_expiry value
needs to reflect the credential lifetime used to create the context.

Note that gss_inquire_cred returns the number of seconds for which the
context remains valid in the lifetime_rec parameter.

Send the actual TGS remaining lifetime to the kernel. It can still be
overwritten by the gssd -t command line option, or set to the kernel
default if the gss_inquire_cred call fails (which sets the lifetime_rec
to zero).

Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Steve Dickson <steved@redhat.com>

diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
index 336f3e9c1686e7bea708289206aebe96e753b221..b9a898efb2b6eb6b0e1e3eb4e07c03c15bd0fdd7 100644 (file)
--- a/utils/gssd/gssd_proc.c
+++ b/utils/gssd/gssd_proc.c
@@ -659,19 +659,22 @@ parse_enctypes(char *enctypes)
 
 static int
 do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,
 
 static int
 do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,

-           gss_buffer_desc *context_token)
+           gss_buffer_desc *context_token, OM_uint32 lifetime_rec)

 {
        char    *buf = NULL, *p = NULL, *end = NULL;
        unsigned int timeout = context_timeout;
        unsigned int buf_size = 0;
 
 {
        char    *buf = NULL, *p = NULL, *end = NULL;
        unsigned int timeout = context_timeout;
        unsigned int buf_size = 0;
 

-       printerr(1, "doing downcall\n");
+       printerr(1, "doing downcall lifetime_rec %u\n", lifetime_rec);

        buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) +
                sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length +
                sizeof(context_token->length) + context_token->length;
        p = buf = malloc(buf_size);
        end = buf + buf_size;
 
        buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) +
                sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length +
                sizeof(context_token->length) + context_token->length;
        p = buf = malloc(buf_size);
        end = buf + buf_size;
 

+       /* context_timeout set by -t option overrides context lifetime */
+       if (timeout == 0)
+               timeout = lifetime_rec;

        if (WRITE_BYTES(&p, end, uid)) goto out_err;
        if (WRITE_BYTES(&p, end, timeout)) goto out_err;
        if (WRITE_BYTES(&p, end, pd->pd_seq_win)) goto out_err;
        if (WRITE_BYTES(&p, end, uid)) goto out_err;
        if (WRITE_BYTES(&p, end, timeout)) goto out_err;
        if (WRITE_BYTES(&p, end, pd->pd_seq_win)) goto out_err;


@@ -954,6 +957,7 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
        char                    **dirname;
        int                     create_resp = -1;
        int                     err, downcall_err = -EACCES;
        char                    **dirname;
        int                     create_resp = -1;
        int                     err, downcall_err = -EACCES;

+       OM_uint32               maj_stat, min_stat, lifetime_rec;

 
        printerr(1, "handling krb5 upcall (%s)\n", clp->dirname);
 
 
        printerr(1, "handling krb5 upcall (%s)\n", clp->dirname);
 


@@ -1064,6 +1068,15 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
                goto out_return_error;
        }
 
                goto out_return_error;
        }
 

+       /* Grab the context lifetime to pass to the kernel. lifetime_rec
+        * is set to zero on error */
+       maj_stat = gss_inquire_context(&min_stat, pd.pd_ctx, NULL, NULL,
+                                      &lifetime_rec, NULL, NULL, NULL, NULL);
+
+       if (maj_stat)
+               printerr(1, "WARNING: Failed to inquire context for lifetme "
+                           "maj_stat %u\n", maj_stat);
+

        if (serialize_context_for_kernel(pd.pd_ctx, &token, &krb5oid, NULL)) {
                printerr(0, "WARNING: Failed to serialize krb5 context for "
                            "user with uid %d for server %s\n",
        if (serialize_context_for_kernel(pd.pd_ctx, &token, &krb5oid, NULL)) {
                printerr(0, "WARNING: Failed to serialize krb5 context for "
                            "user with uid %d for server %s\n",


@@ -1071,7 +1084,7 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
                goto out_return_error;
        }
 
                goto out_return_error;
        }
 

-       do_downcall(fd, uid, &pd, &token);
+       do_downcall(fd, uid, &pd, &token, lifetime_rec);

 
 out:
        if (token.value)
 
 out:
        if (token.value)