nfsd: pass client principal name in rsc downcall
Two principals are involved in krb5 authentication: the target, who we authenticate *to* (normally the name of the server, like nfs/server.citi.umich.edu@CITI.UMICH.EDU), and the source, we we authenticate *as* (normally a user, like bfields@UMICH.EDU) In the case of NFSv4 callbacks, the target of the callback should be the source of the client's setclientid call, and the source should be the nfs server's own principal. Therefore we allow svcgssd to pass down the name of the principal that just authenticated, so that on setclientid we can store that principal name with the new client, to be used later on callbacks. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
This commit is contained in:

committed by
Trond Myklebust

父節點
34769fc488
當前提交
68e76ad0ba
@@ -54,6 +54,7 @@
|
||||
#include <linux/mutex.h>
|
||||
#include <linux/lockd/bind.h>
|
||||
#include <linux/module.h>
|
||||
#include <linux/sunrpc/svcauth_gss.h>
|
||||
|
||||
#define NFSDDBG_FACILITY NFSDDBG_PROC
|
||||
|
||||
@@ -377,6 +378,7 @@ free_client(struct nfs4_client *clp)
|
||||
shutdown_callback_client(clp);
|
||||
if (clp->cl_cred.cr_group_info)
|
||||
put_group_info(clp->cl_cred.cr_group_info);
|
||||
kfree(clp->cl_principal);
|
||||
kfree(clp->cl_name.data);
|
||||
kfree(clp);
|
||||
}
|
||||
@@ -696,6 +698,7 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
|
||||
unsigned int strhashval;
|
||||
struct nfs4_client *conf, *unconf, *new;
|
||||
__be32 status;
|
||||
char *princ;
|
||||
char dname[HEXDIR_LEN];
|
||||
|
||||
if (!check_name(clname))
|
||||
@@ -783,6 +786,14 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
|
||||
}
|
||||
copy_verf(new, &clverifier);
|
||||
new->cl_addr = sin->sin_addr.s_addr;
|
||||
princ = svc_gss_principal(rqstp);
|
||||
if (princ) {
|
||||
new->cl_principal = kstrdup(princ, GFP_KERNEL);
|
||||
if (new->cl_principal == NULL) {
|
||||
free_client(new);
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
copy_cred(&new->cl_cred, &rqstp->rq_cred);
|
||||
gen_confirm(new);
|
||||
gen_callback(new, setclid);
|
||||
|
Reference in New Issue
Block a user