|
 |
83a95a |
From 8a186b2754997ed35f8a88d11457699517dd737c Mon Sep 17 00:00:00 2001
|
|
|
83a95a |
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
83a95a |
Date: Fri, 21 Jun 2013 13:01:55 +0200
|
|
|
83a95a |
Subject: [PATCH] Allow CVS server to use any Kerberos key with cvs service
|
|
|
83a95a |
name
|
|
|
83a95a |
MIME-Version: 1.0
|
|
|
83a95a |
Content-Type: text/plain; charset=UTF-8
|
|
|
83a95a |
Content-Transfer-Encoding: 8bit
|
|
|
83a95a |
|
|
|
83a95a |
This removes restriction for host to be equalled to local hostname.
|
|
|
83a95a |
Previous pinning to hostname prevented from deploying multiple
|
|
|
83a95a |
instances of a CVS server into a cluster where each node has different
|
|
|
83a95a |
hostname.
|
|
|
83a95a |
|
|
|
83a95a |
<https://bugzilla.redhat.com/show_bug.cgi?id=671460>
|
|
|
83a95a |
<https://bugzilla.redhat.com/show_bug.cgi?id=722972>
|
|
|
83a95a |
|
|
|
83a95a |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
83a95a |
---
|
|
|
83a95a |
doc/cvs.texinfo | 8 ++++----
|
|
|
83a95a |
src/server.c | 19 +++----------------
|
|
|
83a95a |
2 files changed, 7 insertions(+), 20 deletions(-)
|
|
|
83a95a |
|
|
|
83a95a |
diff --git a/doc/cvs.texinfo b/doc/cvs.texinfo
|
|
|
83a95a |
index ad3a414..3c7796a 100644
|
|
|
83a95a |
--- a/doc/cvs.texinfo
|
|
|
83a95a |
+++ b/doc/cvs.texinfo
|
|
|
83a95a |
@@ -2771,10 +2771,10 @@ an empty @file{CVSROOT/passwd} password file, and set
|
|
|
83a95a |
@code{SystemAuth=no} in the config file
|
|
|
83a95a |
(@pxref{config}).
|
|
|
83a95a |
|
|
|
83a95a |
-The GSSAPI server uses a principal name of
|
|
|
83a95a |
-cvs/@var{hostname}, where @var{hostname} is the
|
|
|
83a95a |
-canonical name of the server host. You will have to
|
|
|
83a95a |
-set this up as required by your GSSAPI mechanism.
|
|
|
83a95a |
+The GSSAPI server uses a principal name of cvs/@var{hostname}, where
|
|
|
83a95a |
+@var{hostname} can be any name. There is no restriction to canonical
|
|
|
83a95a |
+hostname to allow DNS load-balanced clusters. It assumes your GSSAPI
|
|
|
83a95a |
+mechanism can select a key with a host name matching client's request.
|
|
|
83a95a |
|
|
|
83a95a |
To connect using GSSAPI, use the @samp{:gserver:} method. For
|
|
|
83a95a |
example,
|
|
|
83a95a |
diff --git a/src/server.c b/src/server.c
|
|
|
83a95a |
index 0505ab9..586b5da 100644
|
|
|
83a95a |
--- a/src/server.c
|
|
|
83a95a |
+++ b/src/server.c
|
|
|
83a95a |
@@ -6168,9 +6168,7 @@ error 0 kerberos: can't get local name: %s\n", krb_get_err_text(status));
|
|
|
83a95a |
static void
|
|
|
83a95a |
gserver_authenticate_connection ()
|
|
|
83a95a |
{
|
|
|
83a95a |
- char hostname[MAXHOSTNAMELEN];
|
|
|
83a95a |
char hbuf[1025];
|
|
|
83a95a |
- struct addrinfo hints, *res0;
|
|
|
83a95a |
gss_buffer_desc tok_in, tok_out;
|
|
|
83a95a |
char buf[1024];
|
|
|
83a95a |
char *credbuf;
|
|
|
83a95a |
@@ -6181,23 +6179,12 @@ gserver_authenticate_connection ()
|
|
|
83a95a |
int nbytes;
|
|
|
83a95a |
gss_OID mechid;
|
|
|
83a95a |
|
|
|
83a95a |
- gethostname (hostname, sizeof hostname);
|
|
|
83a95a |
- hostname[sizeof(hostname)-1] = '\0';
|
|
|
83a95a |
- memset (&hints, 0, sizeof(hints));
|
|
|
83a95a |
- hints.ai_family = af;
|
|
|
83a95a |
- hints.ai_socktype = SOCK_STREAM;
|
|
|
83a95a |
- hints.ai_flags = AI_CANONNAME;
|
|
|
83a95a |
- if (getaddrinfo (hostname, NULL, &hints, &res0))
|
|
|
83a95a |
- error (1, 0, "can't get canonical hostname");
|
|
|
83a95a |
-
|
|
|
83a95a |
- sprintf (buf, "cvs@%s", res0->ai_canonname);
|
|
|
83a95a |
- freeaddrinfo (res0);
|
|
|
83a95a |
- tok_in.value = buf;
|
|
|
83a95a |
- tok_in.length = strlen (buf);
|
|
|
83a95a |
+ tok_in.value = "cvs";
|
|
|
83a95a |
+ tok_in.length = strlen (tok_in.value);
|
|
|
83a95a |
|
|
|
83a95a |
if (gss_import_name (&stat_min, &tok_in, GSS_C_NT_HOSTBASED_SERVICE,
|
|
|
83a95a |
&server_name) != GSS_S_COMPLETE)
|
|
|
83a95a |
- error (1, 0, "could not import GSSAPI service name %s", buf);
|
|
|
83a95a |
+ error (1, 0, "could not import GSSAPI service name %s", tok_in.value);
|
|
|
83a95a |
|
|
|
83a95a |
/* Acquire the server credential to verify the client's
|
|
|
83a95a |
authentication. */
|
|
|
83a95a |
--
|
|
|
83a95a |
1.8.1.4
|
|
|
83a95a |
|