From patchwork Thu Apr 10 20:31:03 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Layton X-Patchwork-Id: 3964771 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id CB4899F3D5 for ; Thu, 10 Apr 2014 20:31:26 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E5C0A20826 for ; Thu, 10 Apr 2014 20:31:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E411C2081D for ; Thu, 10 Apr 2014 20:31:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935777AbaDJUbT (ORCPT ); Thu, 10 Apr 2014 16:31:19 -0400 Received: from mail-qa0-f51.google.com ([209.85.216.51]:37356 "EHLO mail-qa0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965191AbaDJUbQ (ORCPT ); Thu, 10 Apr 2014 16:31:16 -0400 Received: by mail-qa0-f51.google.com with SMTP id j7so4373201qaq.24 for ; Thu, 10 Apr 2014 13:31:15 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=tEeLwMhPaxanKa3P53IbYDRDWH+K8+2IKXEnlJ0mR+8=; b=aqKJrJbkTIRNu9WcPU12+uVJefRgHbeFc+pfQI33SCNjfUR/1MO5Bb+aEa2JMzqMg7 5y445CUnBqR1AWLuPU12sVhakUhLAno9nra5Ne+YLNgOFsnrt835eEG5eyZPlgnVPPq2 wEC3Bfcg70i8hYlR0jVYMSCgx2r8HzVyf+sBGcR5r4moA0ZhY8uGy0UM/sm0rqDDjujx et3uLcqCCugwDRrpieAqSU44kVFvRoFjV98Bt28Gsw1qLcj4Iem/cGfMmoF7ifswvHEf QuwCw4IiOAvgsnjZ+nd3U6p4eYzGr9fz2n0e2oh1R4d3FYygL28xzWIegoeO7UtHlZiY YGPQ== X-Gm-Message-State: ALoCoQlAPkAxE3h9IXbELJnCEh5+TbyuuF7kOpXt6GSaszBpXHGon9HtBPktWz6uep/XQGNvOxAm X-Received: by 10.140.34.46 with SMTP id k43mr22293255qgk.63.1397161875358; Thu, 10 Apr 2014 13:31:15 -0700 (PDT) Received: from tlielax.poochiereds.net ([2001:470:8:d63:3a60:77ff:fe93:a95d]) by mx.google.com with ESMTPSA id o16sm9497995qax.30.2014.04.10.13.31.14 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Apr 2014 13:31:14 -0700 (PDT) From: Jeff Layton To: steved@redhat.com Cc: trond.myklebust@primarydata.com, linux-nfs@vger.kernel.org Subject: [PATCH 5/5] gssd: scrape the acceptor name out of the context Date: Thu, 10 Apr 2014 16:31:03 -0400 Message-Id: <1397161863-29266-6-git-send-email-jlayton@redhat.com> X-Mailer: git-send-email 1.9.0 In-Reply-To: <1397161863-29266-1-git-send-email-jlayton@redhat.com> References: <1397161863-29266-1-git-send-email-jlayton@redhat.com> Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP ...and pass it to the kernel in the downcall. Legacy kernels will just ignore the extra data, but with a proposed kernel patch the kernel will grab this info and use it to verify requests on the v4.0 callback channel. Signed-off-by: Jeff Layton --- utils/gssd/gssd_proc.c | 39 ++++++++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 11 deletions(-) diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c index 7387cce010cf..d95e39416c28 100644 --- a/utils/gssd/gssd_proc.c +++ b/utils/gssd/gssd_proc.c @@ -77,6 +77,7 @@ #include "context.h" #include "nfsrpc.h" #include "nfslib.h" +#include "gss_names.h" /* * pollarray: @@ -683,16 +684,19 @@ parse_enctypes(char *enctypes) static void do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd, - gss_buffer_desc *context_token, OM_uint32 lifetime_rec) + gss_buffer_desc *context_token, OM_uint32 lifetime_rec, + gss_buffer_desc *acceptor) { char *buf = NULL, *p = NULL, *end = NULL; unsigned int timeout = context_timeout; unsigned int buf_size = 0; - printerr(1, "doing downcall lifetime_rec %u\n", lifetime_rec); + printerr(1, "doing downcall: lifetime_rec=%u acceptor=%.*s\n", + lifetime_rec, acceptor->length, acceptor->value); buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) + sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length + - sizeof(context_token->length) + context_token->length; + sizeof(context_token->length) + context_token->length + + acceptor->length; p = buf = malloc(buf_size); if (!buf) goto out_err; @@ -707,6 +711,8 @@ do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd, if (WRITE_BYTES(&p, end, pd->pd_seq_win)) goto out_err; if (write_buffer(&p, end, &pd->pd_ctx_hndl)) goto out_err; if (write_buffer(&p, end, context_token)) goto out_err; + if (acceptor->length > 0 && + write_buffer(&p, end, acceptor)) goto out_err; if (write(k5_fd, buf, p - buf) < p - buf) goto out_err; free(buf); @@ -1034,6 +1040,9 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname, gss_cred_id_t gss_cred; OM_uint32 maj_stat, min_stat, lifetime_rec; pid_t pid; + gss_name_t gacceptor; + gss_OID mech; + gss_buffer_desc acceptor = {0}; pid = fork(); switch(pid) { @@ -1174,15 +1183,22 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname, goto out_return_error; } - /* Grab the context lifetime to pass to the kernel. lifetime_rec - * is set to zero on error */ - maj_stat = gss_inquire_context(&min_stat, pd.pd_ctx, NULL, NULL, - &lifetime_rec, NULL, NULL, NULL, NULL); + maj_stat = gss_inquire_context(&min_stat, pd.pd_ctx, NULL, &gacceptor, + &lifetime_rec, &mech, NULL, NULL, NULL); - if (maj_stat) - printerr(1, "WARNING: Failed to inquire context for lifetme " - "maj_stat %u\n", maj_stat); + if (maj_stat != GSS_S_COMPLETE) { + printerr(1, "WARNING: Failed to inquire context " + "maj_stat (0x%x)\n", maj_stat); + } else { + get_hostbased_client_buffer(gacceptor, mech, &acceptor); + gss_release_name(&min_stat, &gacceptor); + } + /* + * The serialization can mean turning the ctx into a lucid context. If + * that happens then the original ctx is no longer valid, so we mustn't + * try to use if after this point. + */ if (serialize_context_for_kernel(&pd.pd_ctx, &token, &krb5oid, NULL)) { printerr(0, "WARNING: Failed to serialize krb5 context for " "user with uid %d for server %s\n", @@ -1190,9 +1206,10 @@ process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname, goto out_return_error; } - do_downcall(fd, uid, &pd, &token, lifetime_rec); + do_downcall(fd, uid, &pd, &token, lifetime_rec, &acceptor); out: + gss_release_buffer(&min_stat, &acceptor); if (token.value) free(token.value); #ifdef HAVE_AUTHGSS_FREE_PRIVATE_DATA