Dirk Mueller
99d3e0d9fa
0002-gssd-revert-commit-513630d720bd.patch, 0003-gssd-switch-to-using-rpc_gss_seccreate.patch, 0004-gssd-handle-KRB5_AP_ERR_BAD_INTEGRITY-for-machine-cr.patch, 0005-gssd-handle-KRB5_AP_ERR_BAD_INTEGRITY-for-user-crede.patch, 0006-configure-check-for-rpc_gss_seccreate.patch: fixes for libtirpc 1.3.5 - drop reenable-nfsv2.patch (poo#106679) Fix crash when rpc-gssd run with -v. - Replace references to /var/adm/fillup-templates with new options. - do not strip the binaries - mkinitrd-boot.sh: allow other mkinitrd-setup - nfs-utils-eperm-fallback.patch: mount.nfs Includes new config file: /etc/nfsmount.conf and - Kill processes on NFS mounts when unmounting bnc#442490 * fix typo in handling of "init.d/nfs status" - nfs.init: * unmount rpc_pipefs - fix sysconfig filename for changed fillup call services (gssd and idmpad have been rolled in to nfs/nfsserver). - remove svcinfo.d dir as it is provided now by filesystem - update to version 1.1.2 - uses libgssglue instead of libgssapi - add rpcbind support [fate#300607] - added gssapi to buildrequires (#116355) showmount has been removed there (#309782) - added README.NFSv4 (#182775) OBS-URL: https://build.opensuse.org/package/show/Base:System/nfs-utils?expand=0&rev=285
102 lines
3.5 KiB
Diff
102 lines
3.5 KiB
Diff
From 15cd566633b1546f0808d0694ede094b4c99752d Mon Sep 17 00:00:00 2001
|
|
From: Olga Kornievskaia <kolga@netapp.com>
|
|
Date: Mon, 11 Dec 2023 08:57:28 -0500
|
|
Subject: [PATCH 5/6] gssd: handle KRB5_AP_ERR_BAD_INTEGRITY for user
|
|
credentials
|
|
|
|
Unlike the machine credential case, we can't throw away the ticket
|
|
cache and use the keytab to renew the credentials. Instead, we
|
|
need to remove the service ticket for the server that returned
|
|
KRB5_AP_ERR_BAD_INTEGRITY and try again.
|
|
|
|
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
|
|
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
|
|
Signed-off-by: Steve Dickson <steved@redhat.com>
|
|
---
|
|
utils/gssd/gssd_proc.c | 2 ++
|
|
utils/gssd/krb5_util.c | 42 ++++++++++++++++++++++++++++++++++++++++++
|
|
utils/gssd/krb5_util.h | 1 +
|
|
3 files changed, 45 insertions(+)
|
|
|
|
diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
|
|
index 29600a3f..7629de0b 100644
|
|
--- a/utils/gssd/gssd_proc.c
|
|
+++ b/utils/gssd/gssd_proc.c
|
|
@@ -435,6 +435,8 @@ create_auth_rpc_client(struct clnt_info *clp,
|
|
if (cred == GSS_C_NO_CREDENTIAL)
|
|
retval = gssd_refresh_krb5_machine_credential(clp->servername,
|
|
"*", NULL, 1);
|
|
+ else
|
|
+ retval = gssd_k5_remove_bad_service_cred(clp->servername);
|
|
if (!retval) {
|
|
auth = rpc_gss_seccreate(rpc_clnt, tgtname,
|
|
mechanism, rpcsec_gss_svc_none,
|
|
diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
|
|
index f6ce1fec..6f66ef4f 100644
|
|
--- a/utils/gssd/krb5_util.c
|
|
+++ b/utils/gssd/krb5_util.c
|
|
@@ -1553,6 +1553,48 @@ gssd_acquire_user_cred(gss_cred_id_t *gss_cred)
|
|
return ret;
|
|
}
|
|
|
|
+/* Removed a service ticket for nfs/<name> from the ticket cache
|
|
+ */
|
|
+int
|
|
+gssd_k5_remove_bad_service_cred(char *name)
|
|
+{
|
|
+ krb5_creds in_creds, out_creds;
|
|
+ krb5_error_code ret;
|
|
+ krb5_context context;
|
|
+ krb5_ccache cache;
|
|
+ krb5_principal principal;
|
|
+ int retflags = KRB5_TC_MATCH_SRV_NAMEONLY;
|
|
+ char srvname[1024];
|
|
+
|
|
+ ret = krb5_init_context(&context);
|
|
+ if (ret)
|
|
+ goto out_cred;
|
|
+ ret = krb5_cc_default(context, &cache);
|
|
+ if (ret)
|
|
+ goto out_free_context;
|
|
+ ret = krb5_cc_get_principal(context, cache, &principal);
|
|
+ if (ret)
|
|
+ goto out_close_cache;
|
|
+ memset(&in_creds, 0, sizeof(in_creds));
|
|
+ in_creds.client = principal;
|
|
+ sprintf(srvname, "nfs/%s", name);
|
|
+ ret = krb5_parse_name(context, srvname, &in_creds.server);
|
|
+ if (ret)
|
|
+ goto out_free_principal;
|
|
+ ret = krb5_cc_retrieve_cred(context, cache, retflags, &in_creds, &out_creds);
|
|
+ if (ret)
|
|
+ goto out_free_principal;
|
|
+ ret = krb5_cc_remove_cred(context, cache, 0, &out_creds);
|
|
+out_free_principal:
|
|
+ krb5_free_principal(context, principal);
|
|
+out_close_cache:
|
|
+ krb5_cc_close(context, cache);
|
|
+out_free_context:
|
|
+ krb5_free_context(context);
|
|
+out_cred:
|
|
+ return ret;
|
|
+}
|
|
+
|
|
#ifdef HAVE_SET_ALLOWABLE_ENCTYPES
|
|
/*
|
|
* this routine obtains a credentials handle via gss_acquire_cred()
|
|
diff --git a/utils/gssd/krb5_util.h b/utils/gssd/krb5_util.h
|
|
index 62c91a0e..7ef87018 100644
|
|
--- a/utils/gssd/krb5_util.h
|
|
+++ b/utils/gssd/krb5_util.h
|
|
@@ -22,6 +22,7 @@ char *gssd_k5_err_msg(krb5_context context, krb5_error_code code);
|
|
void gssd_k5_get_default_realm(char **def_realm);
|
|
|
|
int gssd_acquire_user_cred(gss_cred_id_t *gss_cred);
|
|
+int gssd_k5_remove_bad_service_cred(char *srvname);
|
|
|
|
#ifdef HAVE_SET_ALLOWABLE_ENCTYPES
|
|
extern int limit_to_legacy_enctypes;
|
|
--
|
|
2.46.0
|
|
|