summaryrefslogtreecommitdiff
path: root/include/linux/sunrpc
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2015-11-20 18:48:02 +0300
committerJ. Bruce Fields <bfields@redhat.com>2015-11-24 21:36:31 +0300
commit414ca017a54d26c3a58ed1504884e51448d22ae1 (patch)
treee76eb79e0573b50eed71b8fe5a20696f702fde82 /include/linux/sunrpc
parent920dd9bb7d7cf9ae339e15240326a28a22f08a74 (diff)
downloadlinux-414ca017a54d26c3a58ed1504884e51448d22ae1.tar.xz
nfsd4: fix gss-proxy 4.1 mounts for some AD principals
The principal name on a gss cred is used to setup the NFSv4.0 callback, which has to have a client principal name to authenticate to. That code wants the name to be in the form servicetype@hostname. rpc.svcgssd passes down such names (and passes down no principal name at all in the case the principal isn't a service principal). gss-proxy always passes down the principal name, and passes it down in the form servicetype/hostname@REALM. So we've been munging the name gss-proxy passes down into the format the NFSv4.0 callback code expects, or throwing away the name if we can't. Since the introduction of the MACH_CRED enforcement in NFSv4.1, we've also been using the principal name to verify that certain operations are done as the same principal as was used on the original EXCHANGE_ID call. For that application, the original name passed down by gss-proxy is also useful. Lack of that name in some cases was causing some kerberized NFSv4.1 mount failures in an Active Directory environment. This fix only works in the gss-proxy case. The fix for legacy rpc.svcgssd would be more involved, and rpc.svcgssd already has other problems in the AD case. Reported-and-tested-by: James Ralston <ralston@pobox.com> Acked-by: Simo Sorce <simo@redhat.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'include/linux/sunrpc')
-rw-r--r--include/linux/sunrpc/svcauth.h9
1 files changed, 8 insertions, 1 deletions
diff --git a/include/linux/sunrpc/svcauth.h b/include/linux/sunrpc/svcauth.h
index 8d71d6577459..c00f53a4ccdd 100644
--- a/include/linux/sunrpc/svcauth.h
+++ b/include/linux/sunrpc/svcauth.h
@@ -23,13 +23,19 @@ struct svc_cred {
kgid_t cr_gid;
struct group_info *cr_group_info;
u32 cr_flavor; /* pseudoflavor */
- char *cr_principal; /* for gss */
+ /* name of form servicetype/hostname@REALM, passed down by
+ * gss-proxy: */
+ char *cr_raw_principal;
+ /* name of form servicetype@hostname, passed down by
+ * rpc.svcgssd, or computed from the above: */
+ char *cr_principal;
struct gss_api_mech *cr_gss_mech;
};
static inline void init_svc_cred(struct svc_cred *cred)
{
cred->cr_group_info = NULL;
+ cred->cr_raw_principal = NULL;
cred->cr_principal = NULL;
cred->cr_gss_mech = NULL;
}
@@ -38,6 +44,7 @@ static inline void free_svc_cred(struct svc_cred *cred)
{
if (cred->cr_group_info)
put_group_info(cred->cr_group_info);
+ kfree(cred->cr_raw_principal);
kfree(cred->cr_principal);
gss_mech_put(cred->cr_gss_mech);
init_svc_cred(cred);