Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sunrpc: Enable the kernel to specify the hostname part of service principals

Browse source 
A multi-homed NFS server may have more than one "nfs" key in its
keytab. Enable the kernel to pick the key it wants as a machine
credential when establishing a GSS context.

This is useful for GSS-protected NFSv4.0 callbacks, which are
required by RFC 7530 S3.3.3 to use the same principal as the service
principal the client used when establishing its lease.

A complementary modification to rpc.gssd is required to fully enable
this feature.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
Chuck Lever 2018-08-16 12:05:54 -04:00 committed by J. Bruce Fields
parent 44090cc876
commit a1a237775e
1 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
net/sunrpc/auth_gss/auth_gss.c
View file

@ -284,7 +284,12 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
return p;
}
#define UPCALL_BUF_LEN 128
/* XXX: Need some documentation about why UPCALL_BUF_LEN is so small.
* Is user space expecting no more than UPCALL_BUF_LEN bytes?
* Note that there are now _two_ NI_MAXHOST sized data items
* being passed in this string.
*/
#define UPCALL_BUF_LEN 256
struct gss_upcall_msg {
refcount_t count;
@ -462,8 +467,17 @@ static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
p += len;
gss_msg->msg.len += len;
}
if (service_name != NULL) {
len = scnprintf(p, buflen, "service=%s ", service_name);
if (service_name) {
char *c = strchr(service_name, '@');
if (!c)
len = scnprintf(p, buflen, "service=%s ",
service_name);
else
len = scnprintf(p, buflen,
"service=%.*s srchost=%s ",
(int)(c - service_name),
service_name, c + 1);
buflen -= len;
p += len;
gss_msg->msg.len += len;