From patchwork Tue Feb 25 21:46:06 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Olga Kornievskaia X-Patchwork-Id: 13991015 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DF383209 for ; Tue, 25 Feb 2025 21:46:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740519980; cv=none; b=a/y+DvcATOGyQGNlMlGgnE0wrqdfXgnpV9DQwpXiqSnA0soFiSRLRTO/XiSBZRiwOL9H1xNkbWfwSsWCu3r2v74XLDRLcr9B52R+ZX9uXUYqbVFCKUdKafU7yU1vFkGLvXbr4cYHJatyEKjrKIZbtOXZDTvc3pAKyAOBbRZ2xvY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740519980; c=relaxed/simple; bh=jjmJUedpe79OSqh9KVDnjthxbmNl9CGaunxmEKAIlw4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=dbgYlJ+5xWZytv7O2l3e03+1CRnU5cTUjJeA7cYubV54A/m2WiyG9pL1vd4k6kMbrGrOhHdLQO36iQ9DvTlV0U3RkIx/fwQisEzDziaAfnz98XXQpd7PEgFL22Z7y0mHSxmcV3t5LKDKmTuhigsob2iFENBw4+z5RSYiyjdrft4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=UMGxfJPH; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="UMGxfJPH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1740519976; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DFH8DhbpWHleEt+6Uu4bY4tFQ54LZ45dlCnksQcmETc=; b=UMGxfJPH7VaiXpZzXgVOlKzEP7nlMQX4pm9OXJjmxOCdoN+sD64VQEAWsn+mvkdGHPhuDD JvlUBisovvNnx6M4/na0eu/WQ0oHp1Tflnw+u/qBMqWFO264MNZquuqJU7p47EYTRlQAvI n3wkzl9DjCh3RpewZEtCWLzTz/9B0lM= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-653-m4TvyeZwPDyUv3w4Q_w3sQ-1; Tue, 25 Feb 2025 16:46:14 -0500 X-MC-Unique: m4TvyeZwPDyUv3w4Q_w3sQ-1 X-Mimecast-MFC-AGG-ID: m4TvyeZwPDyUv3w4Q_w3sQ_1740519973 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 463D61800874 for ; Tue, 25 Feb 2025 21:46:13 +0000 (UTC) Received: from okorniev-mac.redhat.com (unknown [10.22.82.53]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 57B181800357; Tue, 25 Feb 2025 21:46:12 +0000 (UTC) From: Olga Kornievskaia To: steved@redhat.com Cc: linux-nfs@vger.kernel.org, Olga Kornievskaia Subject: [PATCH 1/2] nfs-utils: gssd: unconditionally use krb5_get_init_creds_opt_alloc Date: Tue, 25 Feb 2025 16:46:06 -0500 Message-Id: <20250225214607.20449-2-okorniev@redhat.com> In-Reply-To: <20250225214607.20449-1-okorniev@redhat.com> References: <20250225214607.20449-1-okorniev@redhat.com> Precedence: bulk X-Mailing-List: linux-nfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Modern kerberos API uses krb5_get_init_creds_opt_alloc() for managing its options for credential data structure. Signed-off-by: Olga Kornievskaia --- utils/gssd/krb5_util.c | 37 ++++++++++--------------------------- 1 file changed, 10 insertions(+), 27 deletions(-) diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c index d7116d93..201585ed 100644 --- a/utils/gssd/krb5_util.c +++ b/utils/gssd/krb5_util.c @@ -397,12 +397,7 @@ gssd_get_single_krb5_cred(krb5_context context, struct gssd_k5_kt_princ *ple, int force_renew) { -#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS - krb5_get_init_creds_opt *init_opts = NULL; -#else - krb5_get_init_creds_opt options; -#endif - krb5_get_init_creds_opt *opts; + krb5_get_init_creds_opt *opts = NULL; krb5_creds my_creds; krb5_ccache ccache = NULL; char kt_name[BUFSIZ]; @@ -443,33 +438,23 @@ gssd_get_single_krb5_cred(krb5_context context, if ((krb5_unparse_name(context, ple->princ, &pname))) pname = NULL; -#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS - code = krb5_get_init_creds_opt_alloc(context, &init_opts); + code = krb5_get_init_creds_opt_alloc(context, &opts); if (code) { k5err = gssd_k5_err_msg(context, code); printerr(0, "ERROR: %s allocating gic options\n", k5err); goto out; } - if (krb5_get_init_creds_opt_set_addressless(context, init_opts, 1)) +#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS + if (krb5_get_init_creds_opt_set_addressless(context, opts, 1)) printerr(1, "WARNING: Unable to set option for addressless " "tickets. May have problems behind a NAT.\n"); -#ifdef TEST_SHORT_LIFETIME - /* set a short lifetime (for debugging only!) */ - printerr(1, "WARNING: Using (debug) short machine cred lifetime!\n"); - krb5_get_init_creds_opt_set_tkt_life(init_opts, 5*60); +#else + krb5_get_init_creds_opt_set_address_list(opts, NULL); #endif - opts = init_opts; - -#else /* HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS */ - - krb5_get_init_creds_opt_init(&options); - krb5_get_init_creds_opt_set_address_list(&options, NULL); #ifdef TEST_SHORT_LIFETIME /* set a short lifetime (for debugging only!) */ - printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n"); - krb5_get_init_creds_opt_set_tkt_life(&options, 5*60); -#endif - opts = &options; + printerr(1, "WARNING: Using (debug) short machine cred lifetime!\n"); + krb5_get_init_creds_opt_set_tkt_life(opts, 5*60); #endif if ((code = krb5_get_init_creds_keytab(context, &my_creds, ple->princ, @@ -530,10 +515,8 @@ gssd_get_single_krb5_cred(krb5_context context, printerr(2, "%s(0x%lx): principal '%s' ccache:'%s'\n", __func__, tid, pname, cc_name); out: -#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS - if (init_opts) - krb5_get_init_creds_opt_free(context, init_opts); -#endif + if (opts) + krb5_get_init_creds_opt_free(context, opts); if (pname) k5_free_unparsed_name(context, pname); if (ccache) From patchwork Tue Feb 25 21:46:07 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Olga Kornievskaia X-Patchwork-Id: 13991016 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB5791C860C for ; Tue, 25 Feb 2025 21:46:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740519980; cv=none; b=al386zJqqGRmsAdX3+BOu35mCA0+OYuYRCoX1x8g33I/pC1OI+I3oJpOdcEbJeyYCRH3LyrP8kgKufyc3iRZr5ZNkDSV6D1ULDw+MDBSt896r2m7FbUwjDhISvQg6yOmQiDnKCLIWumyVMFRaICs1Ql87/5wZkflYZ1qpSixuLM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740519980; c=relaxed/simple; bh=O7PkOBq5ogC5mVzTjoZU+cByussiFO7S9FKfPJy+Qlg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=sa2j/dlnWWLE4QZrXg8r7iKAQlYWZgrQd64FLGBbV84BBsGb2ENBuBWQCIXJmIl948Ixj5/kBFO9Wz38XLaxyEdyIu6kyilhM/woSUhuOwbl7oafCD3Wjkws66p1otjQVqmAulscLO8UkM6DoCG/IccRgtV4jj+SQ/8A2xkSr6g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=B15WYxMR; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="B15WYxMR" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1740519977; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aK8edOGSBnvm+xwGhXSX/X0+bvFvkck0MCMhl1Rkq28=; b=B15WYxMR95FGCDTeXxlHaZEs89XB2JtwDLmELkSF1EpbX+7BFzquP/KmKwenbkfoe4u+UD YMI+5TDu8XM2VJ6WUDZyTlxTgkJCjYVxhuOiUD9jTuc7mutfR/0QcB1xfwpFXJLXlBNjvr uihiuUBIZcdaavF09/fH0FsOWaXW/mw= Received: from mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-627-slFeUiXEOzevjZrPutRTFw-1; Tue, 25 Feb 2025 16:46:15 -0500 X-MC-Unique: slFeUiXEOzevjZrPutRTFw-1 X-Mimecast-MFC-AGG-ID: slFeUiXEOzevjZrPutRTFw_1740519975 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2AEA8193578F for ; Tue, 25 Feb 2025 21:46:15 +0000 (UTC) Received: from okorniev-mac.redhat.com (unknown [10.22.82.53]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 54B101800357; Tue, 25 Feb 2025 21:46:14 +0000 (UTC) From: Olga Kornievskaia To: steved@redhat.com Cc: linux-nfs@vger.kernel.org, Olga Kornievskaia Subject: [PATCH 2/2] nfs-utils: gssd: do not use krb5_cc_initialize Date: Tue, 25 Feb 2025 16:46:07 -0500 Message-Id: <20250225214607.20449-3-okorniev@redhat.com> In-Reply-To: <20250225214607.20449-1-okorniev@redhat.com> References: <20250225214607.20449-1-okorniev@redhat.com> Precedence: bulk X-Mailing-List: linux-nfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 When gssd refreshes machine credentials, it uses the krb5_get_init_creds_keytab() and then to save the received credentials in a ticket cache, it proceeds to initialize the credential cache via a krb5_cc_initialize() before storing the received credentials into it. krb5_cc_initialize() is not concurrency safe. two gssd upcalls by uid=0, one for krb5i auth flavor and another for krb5p, would enter into krb5_cc_initialize() and one of them would fail, leading to an upcall failure and NFS operation error. Instead it was proposed that gssd changes its design to do what kinit does and forgo the use of krb5_cc_initialize and instead setup the output cache via krb5_get_init_creds_opt_set_out_cache() prior to calling krb5_get_init_creds_keytab() which would then store credentials automatically. https://mailman.mit.edu/pipermail/krbdev/2025-February/013708.html Signed-off-by: Olga Kornievskaia --- utils/gssd/krb5_util.c | 103 ++++++++++++++++++++--------------------- 1 file changed, 50 insertions(+), 53 deletions(-) diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c index 201585ed..560e8be1 100644 --- a/utils/gssd/krb5_util.c +++ b/utils/gssd/krb5_util.c @@ -168,7 +168,8 @@ static int select_krb5_ccache(const struct dirent *d); static int gssd_find_existing_krb5_ccache(uid_t uid, char *dirname, const char **cctype, struct dirent **d); static int gssd_get_single_krb5_cred(krb5_context context, - krb5_keytab kt, struct gssd_k5_kt_princ *ple, int force_renew); + krb5_keytab kt, struct gssd_k5_kt_princ *ple, int force_renew, + krb5_ccache ccache); static int query_krb5_ccache(const char* cred_cache, char **ret_princname, char **ret_realm); @@ -395,16 +396,14 @@ static int gssd_get_single_krb5_cred(krb5_context context, krb5_keytab kt, struct gssd_k5_kt_princ *ple, - int force_renew) + int force_renew, + krb5_ccache ccache) { krb5_get_init_creds_opt *opts = NULL; krb5_creds my_creds; - krb5_ccache ccache = NULL; char kt_name[BUFSIZ]; - char cc_name[BUFSIZ]; int code; time_t now = time(0); - char *cache_type; char *pname = NULL; char *k5err = NULL; int nocache = 0; @@ -457,6 +456,14 @@ gssd_get_single_krb5_cred(krb5_context context, krb5_get_init_creds_opt_set_tkt_life(opts, 5*60); #endif + if ((code = krb5_get_init_creds_opt_set_out_ccache(context, opts, + ccache))) { + k5err = gssd_k5_err_msg(context, code); + printerr(1, "WARNING: %s while initializing ccache for " + "principal '%s' using keytab '%s'\n", k5err, + pname ? pname : "", kt_name); + goto out; + } if ((code = krb5_get_init_creds_keytab(context, &my_creds, ple->princ, kt, 0, NULL, opts))) { k5err = gssd_k5_err_msg(context, code); @@ -466,61 +473,18 @@ gssd_get_single_krb5_cred(krb5_context context, goto out; } - /* - * Initialize cache file which we're going to be using - */ - pthread_mutex_lock(&ple_lock); - if (use_memcache) - cache_type = "MEMORY"; - else - cache_type = "FILE"; - snprintf(cc_name, sizeof(cc_name), "%s:%s/%s%s_%s", - cache_type, - ccachesearch[0], GSSD_DEFAULT_CRED_PREFIX, - GSSD_DEFAULT_MACHINE_CRED_SUFFIX, ple->realm); ple->endtime = my_creds.times.endtime; - if (ple->ccname == NULL || strcmp(ple->ccname, cc_name) != 0) { - free(ple->ccname); - ple->ccname = strdup(cc_name); - if (ple->ccname == NULL) { - printerr(0, "ERROR: no storage to duplicate credentials " - "cache name '%s'\n", cc_name); - code = ENOMEM; - pthread_mutex_unlock(&ple_lock); - goto out; - } - } pthread_mutex_unlock(&ple_lock); - if ((code = krb5_cc_resolve(context, cc_name, &ccache))) { - k5err = gssd_k5_err_msg(context, code); - printerr(0, "ERROR: %s while opening credential cache '%s'\n", - k5err, cc_name); - goto out; - } - if ((code = krb5_cc_initialize(context, ccache, ple->princ))) { - k5err = gssd_k5_err_msg(context, code); - printerr(0, "ERROR: %s while initializing credential " - "cache '%s'\n", k5err, cc_name); - goto out; - } - if ((code = krb5_cc_store_cred(context, ccache, &my_creds))) { - k5err = gssd_k5_err_msg(context, code); - printerr(0, "ERROR: %s while storing credentials in '%s'\n", - k5err, cc_name); - goto out; - } code = 0; - printerr(2, "%s(0x%lx): principal '%s' ccache:'%s'\n", - __func__, tid, pname, cc_name); + printerr(2, "%s(0x%lx): principal '%s' ccache:'%s'\n", + __func__, tid, pname, ple->ccname); out: if (opts) krb5_get_init_creds_opt_free(context, opts); if (pname) k5_free_unparsed_name(context, pname); - if (ccache) - krb5_cc_close(context, ccache); krb5_free_cred_contents(context, &my_creds); free(k5err); return (code); @@ -1147,10 +1111,12 @@ gssd_refresh_krb5_machine_credential_internal(char *hostname, { krb5_error_code code = 0; krb5_context context; - krb5_keytab kt = NULL;; + krb5_keytab kt = NULL; + krb5_ccache ccache = NULL; int retval = 0; - char *k5err = NULL; + char *k5err = NULL, *cache_type; const char *svcnames[] = { "$", "root", "nfs", "host", NULL }; + char cc_name[BUFSIZ]; /* * If a specific service name was specified, use it. @@ -1209,7 +1175,38 @@ gssd_refresh_krb5_machine_credential_internal(char *hostname, goto out_free_kt; } } - retval = gssd_get_single_krb5_cred(context, kt, ple, force_renew); + + if (use_memcache) + cache_type = "MEMORY"; + else + cache_type = "FILE"; + snprintf(cc_name, sizeof(cc_name), "%s:%s/%s%s_%s", + cache_type, + ccachesearch[0], GSSD_DEFAULT_CRED_PREFIX, + GSSD_DEFAULT_MACHINE_CRED_SUFFIX, ple->realm); + + pthread_mutex_lock(&ple_lock); + if (ple->ccname == NULL || strcmp(ple->ccname, cc_name) != 0) { + free(ple->ccname); + ple->ccname = strdup(cc_name); + if (ple->ccname == NULL) { + printerr(0, "ERROR: no storage to duplicate credentials " + "cache name '%s'\n", cc_name); + code = ENOMEM; + pthread_mutex_unlock(&ple_lock); + goto out_free_kt; + } + } + pthread_mutex_unlock(&ple_lock); + if ((code = krb5_cc_resolve(context, cc_name, &ccache))) { + k5err = gssd_k5_err_msg(context, code); + printerr(0, "ERROR: %s while opening credential cache '%s'\n", + k5err, cc_name); + goto out_free_kt; + } + + retval = gssd_get_single_krb5_cred(context, kt, ple, force_renew, ccache); + krb5_cc_close(context, ccache); out_free_kt: krb5_kt_close(context, kt); out_free_context: