Patch to adress ticket #94

[Simo Sorce]

This just changes the configuration file.

I think this is the best way as we do realy want to be able to have completely different options for the client and the serve anyways.

Simo.

[Simo Sorce]

----- Original Message -----
> This just changes the configuration file.
>
> I think this is the best way as we do realy want to be able to have
> completely different options for the client and the serve anyways.

Additional patch to avoid problems depending on the order of the
services in the configuration file.

Simo.

P.S: Patches also available here:
http://fedorapeople.org/cgit/simo/public_git/gss-proxy.git/log/?h=wip

[Anthony Joseph Messina]

On Wednesday, June 19, 2013 11:48:14 AM Simo Sorce wrote:
> This just changes the configuration file.
>
> I think this is the best way as we do realy want to be able to have
> completely different options for the client and the serve anyways.
>
> Simo.

I can confirm that the following works on a F19 NFS client, so long as 
GSSPROXY_SOCKET is either

1. not defined in /etc/sysconfig/nfs, or
2. set to the default of /var/lib/gssproxy/default.sock

using:

nfs-utils-1.2.8-2.0.fc19.x86_64
gssproxy-0.2.3-5.fc19.x86_64

with contents of /etc/gssproxy/gssproxy.conf:

[gssproxy]

[service/nfs-server]
   mechs = krb5
   socket = /run/gssproxy.sock
   cred_store = keytab:/etc/krb5.keytab
   trusted = yes
   kernel_nfsd = yes
   euid = 0

[service/nfs-client]
  mechs = krb5
  cred_store = keytab:/etc/krb5.keytab
  cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_%U
  cred_store = client_keytab:/var/lib/gssproxy/clients/%U.keytab
  trusted = yes
  euid = 0

-A

[Günther Deschner]

Ok,

Simo, I pushed the two patches after testing a little. Thanks Anthony 
for testing as well!

Attached, a followup patch, that would also mention servicename, euid 
and socketname when debug is enabled.

Thanks,
Guenther

On 19/06/13 18:48, Anthony Messina wrote:
> On Wednesday, June 19, 2013 11:48:14 AM Simo Sorce wrote:
> > This just changes the configuration file.
> >
> > I think this is the best way as we do realy want to be able to have
> > completely different options for the client and the serve anyways.
> >
> > Simo.
>
> I can confirm that the following works on a F19 NFS client, so long as
> GSSPROXY_SOCKET is either
> not defined in /etc/sysconfig/nfs, or
> set to the default of /var/lib/gssproxy/default.sock
>
> using:
>
> nfs-utils-1.2.8-2.0.fc19.x86_64
> gssproxy-0.2.3-5.fc19.x86_64
>
> with contents of /etc/gssproxy/gssproxy.conf:
>
> [gssproxy]
>
> [service/nfs-server]
>     mechs = krb5
>     socket = /run/gssproxy.sock
>     cred_store = keytab:/etc/krb5.keytab
>     trusted = yes
>     kernel_nfsd = yes
>     euid = 0
>
> [service/nfs-client]
>    mechs = krb5
>    cred_store = keytab:/etc/krb5.keytab
>    cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_%U
>    cred_store = client_keytab:/var/lib/gssproxy/clients/%U.keytab
>    trusted = yes
>    euid = 0
>
> -A
>
> gss-proxy mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/gss-proxy

[Simo Sorce]

On Fri, 2013-06-21 at 18:47 +0200, Günther Deschner wrote:
> From 234d98abaa78b49d5524d5eb04801a3ac788cef5 Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?G=C3=BCnther=20Deschner?= 
> Date: Fri, 21 Jun 2013 18:39:42 +0200
> Subject: [PATCH] Further improve debugging, mention servicename,
> socket and
>  euid.
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
> Signed-off-by: Günther Deschner
>
> proxy/src/gp_rpc_process.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/proxy/src/gp_rpc_process.c b/proxy/src/gp_rpc_process.c
> index 460c546..18f8dc6 100644
> --- a/proxy/src/gp_rpc_process.c
> +++ b/proxy/src/gp_rpc_process.c
> @@ -23,6 +23,7 @@
>     DEALINGS IN THE SOFTWARE.
>  */
>
> +#include "gp_proxy.h"
>  #include "gp_rpc_process.h"
>
> typedef int (*gp_exec_fn)(gp_exec_std_args);
> @@ -336,7 +337,9 @@ static int gp_rpc_execute(struct gssproxy_ctx
> *gpctx,
>                            struct gp_service *gpsvc, uint32_t proc,
>                            union gp_rpc_arg *arg, union gp_rpc_res
> *res)
>  {
> GPDEBUG("gp_rpc_execute: executing %d (%s)\n", proc,
>
> gp_rpc_procname(proc));
> GPDEBUG("gp_rpc_execute: executing %d (%s) for service "%s",
>
> euid: %d, socket: %s\n",
>    proc, gp_rpc_procname(proc), gpsvc->name, gpsvc->euid,
>
> gpsvc->socket);
> return gp_xdr_set[proc].exec_fn(gpctx, gpsvc, arg, res);
>
> }
>
> -- 
> 1.8.1.4

Reviewed-by: Simo Sorce

Feel free to push it.

Simo.