Add new versions of log_badauth gssrpc callbacks

libgssrpc supports two callbacks for gss_accept_sec_context failures
on servers (one for AUTH_GSS and one for AUTH_GSSAPI), which are
IPv4-specific.  Provide an alternate version which supplies the
transport handle instead of the address, so that we can get the
address via the file descriptor for TCP connections.

(cherry picked from commit 4c57a429760a3b3aa89938a13708742675f9548b)

ticket: 7770

diff --git a/src/include/gssrpc/auth_gssapi.h b/src/include/gssrpc/auth_gssapi.h
index d842930bb0590ac6b9451159b33e68708dd52a3c..9d94853228ef3ae88955f659f585027f7881b59d 100644 (file)
--- a/src/include/gssrpc/auth_gssapi.h
+++ b/src/include/gssrpc/auth_gssapi.h
@@ -54,6 +54,14 @@ typedef void (*auth_gssapi_log_badauth_func)
                struct sockaddr_in *raddr,
                caddr_t data);
 
+/* auth_gssapi_log_badauth_func is IPv4-specific; this version gives the
+ * transport handle so the fd can be used to get the address. */
+typedef void (*auth_gssapi_log_badauth2_func)
+     (OM_uint32 major,
+               OM_uint32 minor,
+               SVCXPRT *xprt,
+               caddr_t data);
+
 typedef void (*auth_gssapi_log_badverf_func)
      (gss_name_t client,
                gss_name_t server,
@@ -117,6 +125,9 @@ void svcauth_gssapi_unset_names
 void svcauth_gssapi_set_log_badauth_func
 (auth_gssapi_log_badauth_func func,
           caddr_t data);
+void svcauth_gssapi_set_log_badauth2_func
+(auth_gssapi_log_badauth2_func func,
+          caddr_t data);
 void svcauth_gssapi_set_log_badverf_func
 (auth_gssapi_log_badverf_func func,
           caddr_t data);
@@ -126,6 +137,8 @@ void svcauth_gssapi_set_log_miscerr_func
 
 void svcauth_gss_set_log_badauth_func(auth_gssapi_log_badauth_func,
                                      caddr_t);
+void svcauth_gss_set_log_badauth2_func(auth_gssapi_log_badauth2_func,
+                                      caddr_t);
 void svcauth_gss_set_log_badverf_func(auth_gssapi_log_badverf_func,
                                      caddr_t);
 void svcauth_gss_set_log_miscerr_func(auth_gssapi_log_miscerr_func,

diff --git a/src/include/gssrpc/rename.h b/src/include/gssrpc/rename.h
index 318be1a52dd4070f30600957ecd8474d92a6b07f..ecec66ab103df97eb7c30b44d0df9fcce172e3da 100644 (file)
--- a/src/include/gssrpc/rename.h
+++ b/src/include/gssrpc/rename.h
@@ -125,10 +125,12 @@
 #define svcauth_gssapi_set_names       gssrpc_svcauth_gssapi_set_names
 #define svcauth_gssapi_unset_names     gssrpc_svcauth_gssapi_unset_names
 #define svcauth_gssapi_set_log_badauth_func    gssrpc_svcauth_gssapi_set_log_badauth_func
+#define svcauth_gssapi_set_log_badauth2_func   gssrpc_svcauth_gssapi_set_log_badauth2_func
 #define svcauth_gssapi_set_log_badverf_func    gssrpc_svcauth_gssapi_set_log_badverf_func
 #define svcauth_gssapi_set_log_miscerr_func    gssrpc_svcauth_gssapi_set_log_miscerr_func
 
 #define svcauth_gss_set_log_badauth_func       gssrpc_svcauth_gss_set_log_badauth_func
+#define svcauth_gss_set_log_badauth2_func      gssrpc_svcauth_gss_set_log_badauth2_func
 #define svcauth_gss_set_log_badverf_func       gssrpc_svcauth_gss_set_log_badverf_func
 #define svcauth_gss_set_log_miscerr_func       gssrpc_svcauth_gss_set_log_miscerr_func
 

diff --git a/src/lib/rpc/libgssrpc.exports b/src/lib/rpc/libgssrpc.exports
index e6509d90c50cf3f4ba1f6f120e99dd22a2bd43c5..79e69612ddbbdbe2c1d69eb168efcf2fdb08674a 100644 (file)
--- a/src/lib/rpc/libgssrpc.exports
+++ b/src/lib/rpc/libgssrpc.exports
@@ -60,10 +60,12 @@ gssrpc_svc_sendreply
 gssrpc_svc_unregister
 gssrpc_svcauth_gss_get_principal
 gssrpc_svcauth_gss_set_log_badauth_func
+gssrpc_svcauth_gss_set_log_badauth2_func
 gssrpc_svcauth_gss_set_log_badverf_func
 gssrpc_svcauth_gss_set_log_miscerr_func
 gssrpc_svcauth_gss_set_svc_name
 gssrpc_svcauth_gssapi_set_log_badauth_func
+gssrpc_svcauth_gssapi_set_log_badauth2_func
 gssrpc_svcauth_gssapi_set_log_badverf_func
 gssrpc_svcauth_gssapi_set_log_miscerr_func
 gssrpc_svcauth_gssapi_set_names

diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c
index 68498daa83e518d1101e4342f7778cd0ee37a7fd..8da70032a1e8d5fc9ac2212ea6bb211ca72adead 100644 (file)
--- a/src/lib/rpc/svc_auth_gss.c
+++ b/src/lib/rpc/svc_auth_gss.c
@@ -80,6 +80,8 @@ typedef struct gss_union_ctx_id_t {
 
 static auth_gssapi_log_badauth_func log_badauth = NULL;
 static caddr_t log_badauth_data = NULL;
+static auth_gssapi_log_badauth2_func log_badauth2 = NULL;
+static caddr_t log_badauth2_data = NULL;
 static auth_gssapi_log_badverf_func log_badverf = NULL;
 static caddr_t log_badverf_data = NULL;
 static auth_gssapi_log_miscerr_func log_miscerr = NULL;
@@ -186,6 +188,16 @@ svcauth_gss_release_cred(void)
        return (TRUE);
 }
 
+/* Invoke log_badauth callbacks for an authentication failure. */
+static void
+badauth(OM_uint32 maj, OM_uint32 minor, SVCXPRT *xprt)
+{
+       if (log_badauth != NULL)
+               (*log_badauth)(maj, minor, &xprt->xp_raddr, log_badauth_data);
+       if (log_badauth2 != NULL)
+               (*log_badauth2)(maj, minor, xprt, log_badauth2_data);
+}
+
 static bool_t
 svcauth_gss_accept_sec_context(struct svc_req *rqst,
                               struct rpc_gss_init_res *gr)
@@ -226,12 +238,7 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst,
        log_status("accept_sec_context", gr->gr_major, gr->gr_minor);
        if (gr->gr_major != GSS_S_COMPLETE &&
            gr->gr_major != GSS_S_CONTINUE_NEEDED) {
-               if (log_badauth != NULL) {
-                       (*log_badauth)(gr->gr_major,
-                                      gr->gr_minor,
-                                      &rqst->rq_xprt->xp_raddr,
-                                      log_badauth_data);
-               }
+               badauth(gr->gr_major, gr->gr_minor, rqst->rq_xprt);
                gd->ctx = GSS_C_NO_CONTEXT;
                goto errout;
        }
@@ -673,6 +680,14 @@ void svcauth_gss_set_log_badauth_func(
        log_badauth_data = data;
 }
 
+void
+svcauth_gss_set_log_badauth2_func(auth_gssapi_log_badauth2_func func,
+                                 caddr_t data)
+{
+       log_badauth2 = func;
+       log_badauth2_data = data;
+}
+
 /*
  * Function: svcauth_gss_set_log_badverf_func
  *

diff --git a/src/lib/rpc/svc_auth_gssapi.c b/src/lib/rpc/svc_auth_gssapi.c
index 9688b8cd7c60c166d3ef5f01e3777d805c8504fa..e3af08fb6d85c538a067e2e687c14b905953f99d 100644 (file)
--- a/src/lib/rpc/svc_auth_gssapi.c
+++ b/src/lib/rpc/svc_auth_gssapi.c
@@ -125,6 +125,8 @@ static int server_creds_count = 0;
 
 static auth_gssapi_log_badauth_func log_badauth = NULL;
 static caddr_t log_badauth_data = NULL;
+static auth_gssapi_log_badauth2_func log_badauth2 = NULL;
+static caddr_t log_badauth2_data = NULL;
 static auth_gssapi_log_badverf_func log_badverf = NULL;
 static caddr_t log_badverf_data = NULL;
 static auth_gssapi_log_miscerr_func log_miscerr = NULL;
@@ -141,6 +143,16 @@ typedef struct _client_list {
 static client_list *clients = NULL;
 
 
+/* Invoke log_badauth callbacks for an authentication failure. */
+static void
+badauth(OM_uint32 maj, OM_uint32 minor, SVCXPRT *xprt)
+{
+     if (log_badauth != NULL)
+         (*log_badauth)(maj, minor, &xprt->xp_raddr, log_badauth_data);
+     if (log_badauth2 != NULL)
+         (*log_badauth2)(maj, minor, xprt, log_badauth2_data);
+}
+
 enum auth_stat gssrpc__svcauth_gssapi(
      register struct svc_req *rqst,
      register struct rpc_msg *msg,
@@ -443,11 +455,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
                                           call_res.gss_major,
                                           call_res.gss_minor));
 
-              if (log_badauth != NULL)
-                   (*log_badauth)(call_res.gss_major,
-                                  call_res.gss_minor,
-                                  &rqst->rq_xprt->xp_raddr,
-                                  log_badauth_data);
+              badauth(call_res.gss_major, call_res.gss_minor, rqst->rq_xprt);
 
               gss_release_buffer(&minor_stat, &output_token);
               svc_sendreply(rqst->rq_xprt, xdr_authgssapi_init_res,
@@ -1027,6 +1035,14 @@ void svcauth_gssapi_set_log_badauth_func(
      log_badauth_data = data;
 }
 
+void
+svcauth_gssapi_set_log_badauth2_func(auth_gssapi_log_badauth2_func func,
+                                    caddr_t data)
+{
+     log_badauth2 = func;
+     log_badauth2_data = data;
+}
+
 /*
  * Function: svcauth_gssapi_set_log_badverf_func
  *