* Patch: select non-conventional principal in gssd
@ 2014-08-06 14:59 Jurjen Bokma
2014-08-07 11:47 ` Steve Dickson
0 siblings, 1 reply; 5+ messages in thread
From: Jurjen Bokma @ 2014-08-06 14:59 UTC (permalink / raw)
To: linux-nfs
[-- Attachment #1: Type: text/plain, Size: 462 bytes --]
HiAll,
I have a patch to utils/gssd/krb5_util.c that enables kerberized NFS
mounts to succeed even if the principal is not <HOSTNAME>$.
It works by reading another principal name from the [appdefaults]
section of krb5.conf:
[appdefaults]
nfs = {
ad_principal_name = 129.125.39.115$
}
Patch is attached. Would you please incorporate it in the source if you
find it useful?
Sorry if I'm asking in the wrong place.
Best Regards
Jurjen
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: krb5_util.patch --]
[-- Type: text/x-patch; name="krb5_util.patch", Size: 1324 bytes --]
--- utils/gssd/krb5_util.c.orig 2014-08-06 10:54:18.806414170 +0200
+++ utils/gssd/krb5_util.c 2014-08-06 11:01:21.016320365 +0200
@@ -801,7 +801,8 @@
char *k5err = NULL;
int tried_all = 0, tried_default = 0;
krb5_principal princ;
-
+ const char *notsetstr = "not set";
+ char *adhostoverride;
/* Get full target hostname */
retval = get_full_hostname(tgtname, targethostname,
@@ -818,11 +819,18 @@
}
/* Compute the active directory machine name HOST$ */
- strcpy(myhostad, myhostname);
- for (i = 0; myhostad[i] != 0; ++i)
- myhostad[i] = toupper(myhostad[i]);
- myhostad[i] = '$';
- myhostad[i+1] = 0;
+ krb5_appdefault_string(context, "nfs", NULL, "ad_principal_name", notsetstr, &adhostoverride);
+ if (strcmp(adhostoverride, notsetstr) != 0) {
+ printerr (0, "AD host string overridden with \"%s\" from appdefaults\n", adhostoverride);
+ /* No overflow: Windows cannot handle strings longer than 19 chars */
+ strcpy(myhostad, adhostoverride);
+ } else {
+ strcpy(myhostad, myhostname);
+ for (i = 0; myhostad[i] != 0; ++i)
+ myhostad[i] = toupper(myhostad[i]);
+ myhostad[i] = '$';
+ myhostad[i+1] = 0;
+ }
retval = get_full_hostname(myhostname, myhostname, sizeof(myhostname));
if (retval)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Patch: select non-conventional principal in gssd
2014-08-06 14:59 Patch: select non-conventional principal in gssd Jurjen Bokma
@ 2014-08-07 11:47 ` Steve Dickson
2014-08-07 13:01 ` Jurjen Bokma
0 siblings, 1 reply; 5+ messages in thread
From: Steve Dickson @ 2014-08-07 11:47 UTC (permalink / raw)
To: Jurjen Bokma, linux-nfs
On 08/06/2014 10:59 AM, Jurjen Bokma wrote:
> HiAll,
>
> I have a patch to utils/gssd/krb5_util.c that enables kerberized NFS
> mounts to succeed even if the principal is not <HOSTNAME>$.
>
> It works by reading another principal name from the [appdefaults]
> section of krb5.conf:
>
> [appdefaults]
> nfs = {
> ad_principal_name = 129.125.39.115$
> }
>
> Patch is attached. Would you please incorporate it in the source if you
> find it useful?
> Sorry if I'm asking in the wrong place.
A couple things....
One please inline your patche in your email, not attach them
as suggested in https://www.kernel.org/doc/Documentation/SubmittingPatches
Inlining makes it easier to review...
--- utils/gssd/krb5_util.c.orig 2014-08-06 10:54:18.806414170 +0200
+++ utils/gssd/krb5_util.c 2014-08-06 11:01:21.016320365 +0200
@@ -801,7 +801,8 @@
char *k5err = NULL;
int tried_all = 0, tried_default = 0;
krb5_principal princ;
-
+ const char *notsetstr = "not set";
+ char *adhostoverride;
/* Get full target hostname */
retval = get_full_hostname(tgtname, targethostname,
@@ -818,11 +819,18 @@
}
/* Compute the active directory machine name HOST$ */
- strcpy(myhostad, myhostname);
- for (i = 0; myhostad[i] != 0; ++i)
- myhostad[i] = toupper(myhostad[i]);
- myhostad[i] = '$';
- myhostad[i+1] = 0;
+ krb5_appdefault_string(context, "nfs", NULL, "ad_principal_name", notsetstr, &adhostoverride);
Secondly, where does them memory for adhostoverride get freed??
steved.
+ if (strcmp(adhostoverride, notsetstr) != 0) {
+ printerr (0, "AD host string overridden with \"%s\" from appdefaults\n", adhostoverride);
+ /* No overflow: Windows cannot handle strings longer than 19 chars */
+ strcpy(myhostad, adhostoverride);
+ } else {
+ strcpy(myhostad, myhostname);
+ for (i = 0; myhostad[i] != 0; ++i)
+ myhostad[i] = toupper(myhostad[i]);
+ myhostad[i] = '$';
+ myhostad[i+1] = 0;
+ }
retval = get_full_hostname(myhostname, myhostname, sizeof(myhostname));
if (retval)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Patch: select non-conventional principal in gssd
2014-08-07 11:47 ` Steve Dickson
@ 2014-08-07 13:01 ` Jurjen Bokma
2014-08-07 13:31 ` Steve Dickson
0 siblings, 1 reply; 5+ messages in thread
From: Jurjen Bokma @ 2014-08-07 13:01 UTC (permalink / raw)
To: SteveD, linux-nfs
On 08/07/2014 01:47 PM, Steve Dickson wrote:
>
> On 08/06/2014 10:59 AM, Jurjen Bokma wrote:
>> HiAll,
>>
>> I have a patch to utils/gssd/krb5_util.c that enables kerberized NFS
>> mounts to succeed even if the principal is not <HOSTNAME>$.
>>
>> It works by reading another principal name from the [appdefaults]
>> section of krb5.conf:
>>
>> [appdefaults]
>> nfs = {
>> ad_principal_name = 129.125.39.115$
>> }
>>
>> Patch is attached. Would you please incorporate it in the source if you
>> find it useful?
>> Sorry if I'm asking in the wrong place.
> A couple things....
>
> One please inline your patche in your email, not attach them
> as suggested in https://www.kernel.org/doc/Documentation/SubmittingPatches
> Inlining makes it easier to review...
I'm sorry. Also for not using the proper command, not choosing the
proper subsystem, and a couple more mistakes.
> <snip 1st version of patch>
> + krb5_appdefault_string(context, "nfs", NULL, "ad_principal_name", notsetstr, &adhostoverride);
> Secondly, where does them memory for adhostoverride get freed??
Thank you for reviewing. <shame>Leaking memory in just a dozen
LOC.</shame> Wrong assumption on my part.
With the free(adhostoverride) added, the patch becomes:
--- utils/gssd/krb5_util.c.orig 2014-08-06 10:54:18.806414170 +0200
+++ utils/gssd/krb5_util.c 2014-08-07 14:21:51.795949903 +0200
@@ -801,7 +801,8 @@ find_keytab_entry(krb5_context context,
char *k5err = NULL;
int tried_all = 0, tried_default = 0;
krb5_principal princ;
-
+ const char *notsetstr = "not set";
+ char *adhostoverride;
/* Get full target hostname */
retval = get_full_hostname(tgtname, targethostname,
@@ -818,11 +819,19 @@ find_keytab_entry(krb5_context context,
}
/* Compute the active directory machine name HOST$ */
- strcpy(myhostad, myhostname);
- for (i = 0; myhostad[i] != 0; ++i)
- myhostad[i] = toupper(myhostad[i]);
- myhostad[i] = '$';
- myhostad[i+1] = 0;
+ krb5_appdefault_string(context, "nfs", NULL,
"ad_principal_name", notsetstr, &adhostoverride);
+ if (strcmp(adhostoverride, notsetstr) != 0) {
+ printerr (0, "AD host string overridden with \"%s\" from
appdefaults\n", adhostoverride);
+ /* No overflow: Windows cannot handle strings longer
than 19 chars */
+ strcpy(myhostad, adhostoverride);
+ free(adhostoverride);
+ } else {
+ strcpy(myhostad, myhostname);
+ for (i = 0; myhostad[i] != 0; ++i)
+ myhostad[i] = toupper(myhostad[i]);
+ myhostad[i] = '$';
+ myhostad[i+1] = 0;
+ }
retval = get_full_hostname(myhostname, myhostname,
sizeof(myhostname));
if (retval)
And another one for the man page, if you like:
--- a/utils/gssd/gssd.man
+++ b/utils/gssd/gssd.man
@@ -140,7 +140,23 @@
that enables Kerberized NFS when the local system is joined
to an Active Directory domain using Samba.
A password for this principal must be provided in the local system's
keytab.
-.P
+If the host is joined to an AD domain, but not with a principal
<HOSTNAME>$,
+then another principal name can be configured in
+.B /etc/krb5.conf
+in a
+.B appdefaults
+stanza:
+.sp
+ [appdefaults]
+.br
+ nfs = {
+.br
+ # This name should reflect a principal that has a key in the keytab
+.br
+ ad_principal_name = 192.168.3.19$
+.br
+ }
+.sp
You can specify another keytab by using the
.B -k
option if
Thanks!
Jurjen
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Patch: select non-conventional principal in gssd
2014-08-07 13:01 ` Jurjen Bokma
@ 2014-08-07 13:31 ` Steve Dickson
0 siblings, 0 replies; 5+ messages in thread
From: Steve Dickson @ 2014-08-07 13:31 UTC (permalink / raw)
To: Jurjen Bokma, linux-nfs
On 08/07/2014 09:01 AM, Jurjen Bokma wrote:
> On 08/07/2014 01:47 PM, Steve Dickson wrote:
>>
>> On 08/06/2014 10:59 AM, Jurjen Bokma wrote:
>>> HiAll,
>>>
>>> I have a patch to utils/gssd/krb5_util.c that enables kerberized NFS
>>> mounts to succeed even if the principal is not <HOSTNAME>$.
>>>
>>> It works by reading another principal name from the [appdefaults]
>>> section of krb5.conf:
>>>
>>> [appdefaults]
>>> nfs = {
>>> ad_principal_name = 129.125.39.115$
>>> }
>>>
>>> Patch is attached. Would you please incorporate it in the source if you
>>> find it useful?
>>> Sorry if I'm asking in the wrong place.
>> A couple things....
>>
>> One please inline your patche in your email, not attach them
>> as suggested in https://www.kernel.org/doc/Documentation/SubmittingPatches
>> Inlining makes it easier to review...
> I'm sorry. Also for not using the proper command, not choosing the
> proper subsystem, and a couple more mistakes.
Unfortunately you still don't have a proper Signed-off-by:
as described in the above documentation... So you will
need to re-post the patch... but...
So lets start from the beginning....
When you commit the patch to your git tree do:
git commit -s -a # this will automatically added the Signed-off-by:
Next create the patch with:
git format-patch -1
Finally send the patch to list with
git send-email \
--to "Steve Dickson <steved@redhat.com>" \
--cc "Linux NFS Mailing list <linux-nfs@vger.kernel.org>" \
*.patch
Note: git send-email has a --dry-run that will test the sending
without actually sending it... I would suggest you always do a
test sending... Just to make sure things are going in the
right direction! ;-)
steved.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Patch: select non-conventional principal in gssd
@ 2014-08-06 18:42 Jurjen Bokma
0 siblings, 0 replies; 5+ messages in thread
From: Jurjen Bokma @ 2014-08-06 18:42 UTC (permalink / raw)
To: linux-nfs
[-- Attachment #1: Type: text/plain, Size: 437 bytes --]
HiAll,
I have patched utils/gssd/krb5_util.c to enable kerberized NFS
mounts to succeed even if the principal is not <HOSTNAME>$.
It works by reading another principal name from the [appdefaults]
section of krb5.conf:
[appdefaults]
nfs = {
ad_principal_name = 129.125.39.115$
}
Patch is attached. Would you please incorporate it in the source if you
find it useful?
Sorry if I'm asking in the wrong place.
Best Regards
Jurjen
[-- Attachment #2: krb5_util.patch --]
[-- Type: text/x-patch, Size: 1289 bytes --]
--- utils/gssd/krb5_util.c.orig 2014-08-06 10:54:18.806414170 +0200
+++ utils/gssd/krb5_util.c 2014-08-06 11:01:21.016320365 +0200
@@ -801,7 +801,8 @@
char *k5err = NULL;
int tried_all = 0, tried_default = 0;
krb5_principal princ;
-
+ const char *notsetstr = "not set";
+ char *adhostoverride;
/* Get full target hostname */
retval = get_full_hostname(tgtname, targethostname,
@@ -818,11 +819,18 @@
}
/* Compute the active directory machine name HOST$ */
- strcpy(myhostad, myhostname);
- for (i = 0; myhostad[i] != 0; ++i)
- myhostad[i] = toupper(myhostad[i]);
- myhostad[i] = '$';
- myhostad[i+1] = 0;
+ krb5_appdefault_string(context, "nfs", NULL, "ad_principal_name", notsetstr, &adhostoverride);
+ if (strcmp(adhostoverride, notsetstr) != 0) {
+ printerr (0, "AD host string overridden with \"%s\" from appdefaults\n", adhostoverride);
+ /* No overflow: Windows cannot handle strings longer than 19 chars */
+ strcpy(myhostad, adhostoverride);
+ } else {
+ strcpy(myhostad, myhostname);
+ for (i = 0; myhostad[i] != 0; ++i)
+ myhostad[i] = toupper(myhostad[i]);
+ myhostad[i] = '$';
+ myhostad[i+1] = 0;
+ }
retval = get_full_hostname(myhostname, myhostname, sizeof(myhostname));
if (retval)
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2014-08-07 13:31 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-08-06 14:59 Patch: select non-conventional principal in gssd Jurjen Bokma
2014-08-07 11:47 ` Steve Dickson
2014-08-07 13:01 ` Jurjen Bokma
2014-08-07 13:31 ` Steve Dickson
2014-08-06 18:42 Jurjen Bokma
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.