diff mbox

[1/1] SUNRPC add rpc_gss_svc_t to gssd upcall

Message ID 1418423580-1212-1-git-send-email-andros@netapp.com (mailing list archive)
State New, archived
Headers show

Commit Message

Andy Adamson Dec. 12, 2014, 10:33 p.m. UTC 
From: Andy Adamson <andros@netapp.com>

Otherwise rpc.gssd will send a V4 NULL RPCSEC_GSS_INIT call with an RPCSEC_GSS
service of rpc_gss_svc_none for rpc_sec_gss_svc_integrity/privacy requests
from the kernel.

This change does not break current versions of rpc.gssd, and there is a
companion rpc.gssd patch: GSSD add rpc_gss_svc_t to the gssd upcall

Signed-off-by: Andy Adamson <andros@netapp.com>
---
 net/sunrpc/auth_gss/auth_gss.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Trond Myklebust Dec. 13, 2014, 12:26 a.m. UTC | #1 
Hi Andy

On Fri, Dec 12, 2014 at 5:33 PM,  <andros@netapp.com> wrote:
> From: Andy Adamson <andros@netapp.com>
>
> Otherwise rpc.gssd will send a V4 NULL RPCSEC_GSS_INIT call with an RPCSEC_GSS
> service of rpc_gss_svc_none for rpc_sec_gss_svc_integrity/privacy requests
> from the kernel.

I thought this behaviour of using rpc_gss_svc_none for the RPCSEC_GSS
negotiation in userland and then "stepping up" to a stricter service
in the kernel had been declared legal by the powers that be. What is
the concern about doing so?

Cheers,
  Trond
J. Bruce Fields Dec. 13, 2014, 3:45 a.m. UTC | #2 
On Fri, Dec 12, 2014 at 07:26:39PM -0500, Trond Myklebust wrote:
> Hi Andy
> 
> On Fri, Dec 12, 2014 at 5:33 PM,  <andros@netapp.com> wrote:
> > From: Andy Adamson <andros@netapp.com>
> >
> > Otherwise rpc.gssd will send a V4 NULL RPCSEC_GSS_INIT call with an RPCSEC_GSS
> > service of rpc_gss_svc_none for rpc_sec_gss_svc_integrity/privacy requests
> > from the kernel.
> 
> I thought this behaviour of using rpc_gss_svc_none for the RPCSEC_GSS
> negotiation in userland and then "stepping up" to a stricter service
> in the kernel had been declared legal by the powers that be.

Yes, in fact:

	https://www.ietf.org/rfc/rfc2203.txt 5.2.2:

	In a creation request, the seq_num and service fields are
	undefined and both must be ignored by the server.

--b.
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 53ed8d3..48054dc 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -449,8 +449,9 @@  static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
 	size_t buflen = sizeof(gss_msg->databuf);
 	int len;
 
-	len = scnprintf(p, buflen, "mech=%s uid=%d ", mech->gm_name,
-			from_kuid(&init_user_ns, gss_msg->uid));
+	len = scnprintf(p, buflen, "mech=%s uid=%d svc=%d ", mech->gm_name,
+			from_kuid(&init_user_ns, gss_msg->uid),
+			gss_msg->auth->service);
 	buflen -= len;
 	p += len;
 	gss_msg->msg.len = len;