diff -ru nfs-utils-1.2.2/debian/changelog nfs-utils-1.2.2-lihas0/debian/changelog --- nfs-utils-1.2.2/debian/changelog 2010-04-06 11:15:29.000000000 +0200 +++ nfs-utils-1.2.2-lihas0/debian/changelog 2010-04-28 13:29:47.000000000 +0200 @@ -1,3 +1,9 @@ +nfs-utils (1:1.2.2-1-lihas1) unstable; urgency=low + + * add hostname swicth + + -- Adrian Reyer Wed, 28 Apr 2010 13:29:10 +0200 + nfs-utils (1:1.2.2-1) unstable; urgency=low [ Anibal Monsalve Salazar ] diff -ru nfs-utils-1.2.2/utils/gssd/gss_util.c nfs-utils-1.2.2-lihas0/utils/gssd/gss_util.c --- nfs-utils-1.2.2/utils/gssd/gss_util.c 2010-04-28 11:11:12.000000000 +0200 +++ nfs-utils-1.2.2-lihas0/utils/gssd/gss_util.c 2010-04-28 13:27:57.000000000 +0200 @@ -92,8 +92,8 @@ #include #endif -/* Global gssd_credentials handle */ -gss_cred_id_t gssd_creds; +/* Null-terminated array of global gssd_credentials handles */ +gss_cred_id_t *gssd_creds = NULL; gss_OID g_mechOid = GSS_C_NULL_OID;; @@ -191,45 +191,65 @@ } int -gssd_acquire_cred(char *server_name) +gssd_acquire_creds(char **server_names) { gss_buffer_desc name; gss_name_t target_name; u_int32_t maj_stat, min_stat; u_int32_t ignore_maj_stat, ignore_min_stat; gss_buffer_desc pbuf; + int name_count, i; - name.value = (void *)server_name; - name.length = strlen(server_name); - - maj_stat = gss_import_name(&min_stat, &name, - (const gss_OID) GSS_C_NT_HOSTBASED_SERVICE, - &target_name); - - if (maj_stat != GSS_S_COMPLETE) { - pgsserr("gss_import_name", maj_stat, min_stat, g_mechOid); + /* Allocate gssd_creds structure */ + for (name_count=0; server_names[name_count]; name_count++) + ; + if (name_count == 0) { + printerr(0, "No server names entered for gssd_acquire_creds"); + return (FALSE); + } + gssd_creds = malloc(sizeof(*gssd_creds) * (name_count + 1)); + if (!gssd_creds) { + perror("malloc"); return (FALSE); } - - maj_stat = gss_acquire_cred(&min_stat, target_name, 0, - GSS_C_NULL_OID_SET, GSS_C_ACCEPT, - &gssd_creds, NULL, NULL); - - if (maj_stat != GSS_S_COMPLETE) { - pgsserr("gss_acquire_cred", maj_stat, min_stat, g_mechOid); - ignore_maj_stat = gss_display_name(&ignore_min_stat, - target_name, &pbuf, NULL); - if (ignore_maj_stat == GSS_S_COMPLETE) { - printerr(1, "Unable to obtain credentials for '%.*s'\n", - pbuf.length, pbuf.value); - ignore_maj_stat = gss_release_buffer(&ignore_min_stat, - &pbuf); - } - } - - ignore_maj_stat = gss_release_name(&ignore_min_stat, &target_name); - - return (maj_stat == GSS_S_COMPLETE); + bzero(gssd_creds, sizeof(*gssd_creds) * (name_count + 1)); + + for (i = 0; i < name_count; i++) { + name.value = (void *)server_names[i]; + name.length = strlen(server_names[i]); + + maj_stat = gss_import_name(&min_stat, &name, + (const gss_OID) GSS_C_NT_HOSTBASED_SERVICE, + &target_name); + + if (maj_stat != GSS_S_COMPLETE) { + pgsserr("gss_import_name", maj_stat, min_stat, g_mechOid); + return (FALSE); + } + + maj_stat = gss_acquire_cred(&min_stat, target_name, 0, + GSS_C_NULL_OID_SET, GSS_C_ACCEPT, + &gssd_creds[i], NULL, NULL); + + if (maj_stat != GSS_S_COMPLETE) { + pgsserr("gss_acquire_cred", maj_stat, min_stat, g_mechOid); + ignore_maj_stat = gss_display_name(&ignore_min_stat, + target_name, &pbuf, NULL); + if (ignore_maj_stat == GSS_S_COMPLETE) { + printerr(0, "Unable to obtain credentials for '%.*s'\n", + pbuf.length, pbuf.value); + ignore_maj_stat = gss_release_buffer(&ignore_min_stat, + &pbuf); + } + } + ignore_maj_stat = gss_release_name(&ignore_min_stat, &target_name); + if (maj_stat != GSS_S_COMPLETE) + goto err_out; + } + + return (TRUE); +err_out: + return (FALSE); } int gssd_check_mechs(void) diff -ru nfs-utils-1.2.2/utils/gssd/gss_util.h nfs-utils-1.2.2-lihas0/utils/gssd/gss_util.h --- nfs-utils-1.2.2/utils/gssd/gss_util.h 2010-02-18 13:35:00.000000000 +0100 +++ nfs-utils-1.2.2-lihas0/utils/gssd/gss_util.h 2010-04-28 13:27:57.000000000 +0200 @@ -35,9 +35,9 @@ #include #include "write_bytes.h" -extern gss_cred_id_t gssd_creds; +extern gss_cred_id_t *gssd_creds; -int gssd_acquire_cred(char *server_name); +int gssd_acquire_creds(char **server_names); void pgsserr(char *msg, u_int32_t maj_stat, u_int32_t min_stat, const gss_OID mech); int gssd_check_mechs(void); diff -ru nfs-utils-1.2.2/utils/gssd/svcgssd.c nfs-utils-1.2.2-lihas0/utils/gssd/svcgssd.c --- nfs-utils-1.2.2/utils/gssd/svcgssd.c 2010-02-18 13:35:00.000000000 +0100 +++ nfs-utils-1.2.2-lihas0/utils/gssd/svcgssd.c 2010-04-28 13:27:57.000000000 +0200 @@ -167,11 +167,39 @@ static void usage(char *progname) { - fprintf(stderr, "usage: %s [-n] [-f] [-v] [-r] [-i]\n", + fprintf(stderr, "usage: %s [-n] [-f] [-v] [-r] [-i] [-h hostname [-h hostname ...]]\n", progname); exit(1); } +static char ** +svclist_add(char **svclist, char *newhost) +{ + int i = 0; + + if (svclist) + for (i=0; svclist[i]; i++) + ; + if (!svclist) + svclist = malloc(sizeof(*svclist) * (i + 2)); + else + svclist = realloc(svclist, sizeof(*svclist) * (i + 2)); + if (!svclist) { + perror("malloc"); + exit(1); + } + svclist[i + 1] = NULL; + svclist[i] = malloc(strlen(newhost) + 1 + strlen(GSSD_SERVICE_NAME) + 1); + if (!svclist[i]) { + perror("malloc"); + exit(1); + } + sprintf(svclist[i], "%s@%s", GSSD_SERVICE_NAME, newhost); + + return svclist; +} + int main(int argc, char *argv[]) { @@ -183,8 +211,11 @@ int opt; extern char *optarg; char *progname; + char *default_svclist[] = { GSSD_SERVICE_NAME , (char *)NULL }; + char **svclist = NULL; + int retval; - while ((opt = getopt(argc, argv, "fivrnp:")) != -1) { + while ((opt = getopt(argc, argv, "fivrnp:h:")) != -1) { switch (opt) { case 'f': fg = 1; @@ -201,6 +232,9 @@ case 'r': rpc_verbosity++; break; + case 'h': + svclist = svclist_add(svclist, optarg); + break; default: usage(argv[0]); break; @@ -244,12 +278,18 @@ signal(SIGTERM, sig_die); signal(SIGHUP, sig_hup); - if (get_creds && !gssd_acquire_cred(GSSD_SERVICE_NAME)) { - printerr(0, "unable to obtain root (machine) credentials\n"); - printerr(0, "do you have a keytab entry for " - "nfs/@ in " - "/etc/krb5.keytab?\n"); - exit(1); + if (get_creds) { + if (!svclist) + svclist = default_svclist; + + retval = gssd_acquire_creds(svclist); + if (!retval) { + printerr(0, "unable to obtain root (machine) credentials\n"); + printerr(0, "do you have a keytab entry for " + "nfs/@ in " + "/etc/krb5.keytab?\n"); + exit(1); + } } if (!fg) diff -ru nfs-utils-1.2.2/utils/gssd/svcgssd_proc.c nfs-utils-1.2.2-lihas0/utils/gssd/svcgssd_proc.c --- nfs-utils-1.2.2/utils/gssd/svcgssd_proc.c 2010-02-18 13:35:00.000000000 +0100 +++ nfs-utils-1.2.2-lihas0/utils/gssd/svcgssd_proc.c 2010-04-28 13:27:57.000000000 +0200 @@ -408,6 +408,7 @@ static char *cp; int32_t ctx_endtime; char *hostbased_name = NULL; + int i; printerr(1, "handling null request\n"); @@ -449,24 +450,30 @@ memcpy(&ctx, in_handle.value, in_handle.length); } - maj_stat = gss_accept_sec_context(&min_stat, &ctx, gssd_creds, - &in_tok, GSS_C_NO_CHANNEL_BINDINGS, &client_name, - &mech, &out_tok, &ret_flags, NULL, NULL); - - if (maj_stat == GSS_S_CONTINUE_NEEDED) { - printerr(1, "gss_accept_sec_context GSS_S_CONTINUE_NEEDED\n"); - - /* Save the context handle for future calls */ - out_handle.length = sizeof(ctx); - memcpy(out_handle.value, &ctx, sizeof(ctx)); - goto continue_needed; - } - else if (maj_stat != GSS_S_COMPLETE) { + for (i = 0; gssd_creds[i]; i++) { + maj_stat = gss_accept_sec_context(&min_stat, &ctx, gssd_creds[i], + &in_tok, GSS_C_NO_CHANNEL_BINDINGS, &client_name, + &mech, &out_tok, &ret_flags, NULL, NULL); + + if (maj_stat == GSS_S_CONTINUE_NEEDED) { + printerr(1, "gss_accept_sec_context GSS_S_CONTINUE_NEEDED\n"); + + /* Save the context handle for future calls */ + out_handle.length = sizeof(ctx); + memcpy(out_handle.value, &ctx, sizeof(ctx)); + goto continue_needed; + } + else if (maj_stat == GSS_S_COMPLETE) + break; /* We have found matching credential */ + printerr(1, "WARNING: gss_accept_sec_context failed\n"); pgsserr("handle_nullreq: gss_accept_sec_context", maj_stat, min_stat, mech); - goto out_err; } + + if (maj_stat != GSS_S_COMPLETE) + goto out_err; + if (get_ids(client_name, mech, &cred)) { /* get_ids() prints error msg */ maj_stat = GSS_S_BAD_NAME; /* XXX ? */