- Verify k5start exists - Run k5start and check the top most principal (without this we would need to probably do some regexing through the klist to attempt to find which principal we want) - This will re-initialization *existing* kerberos tickets without need for password. - Actually show none connection options as a result of more kerberos work - Uses environment variables and has general defaults as a fallback
Signed-off-by: Adam Stokes astokes@fedoraproject.org --- matahari.init.in | 5 ---- matahari.sysconf.in | 14 +----------- src/lib/mh_agent.cpp | 58 ++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 57 insertions(+), 20 deletions(-)
diff --git a/matahari.init.in b/matahari.init.in index cb215de..75f9739 100644 --- a/matahari.init.in +++ b/matahari.init.in @@ -42,11 +42,6 @@ start() { MATAHARI_ARGS="--broker $MATAHARI_BROKER $MATAHARI_ARGS" fi
- # Setup kerberos ticket renewal - if [ -n "$KRB_RENEW" ]; then - k5start $KRB_RENEW_ARGS $KRB_REALM - fi - daemon $PROCESS $MATAHARI_ARGS --daemon RETVAL=$? echo diff --git a/matahari.sysconf.in b/matahari.sysconf.in index bc25e73..a936c27 100644 --- a/matahari.sysconf.in +++ b/matahari.sysconf.in @@ -17,16 +17,4 @@ MATAHARI_AGENT_ARGS="--reconnect=yes" # network_AGENT_ARGS=...
# Per console options -# sysconfig_CONSOLE_ARGS=... - -# Security -# Kerberos - -# Uncomment to enable auto-renew credentials -# KRB_RENEW=yes - -# Set custom application and arguments for renew process -# KRB_RENEW_ARGS="-f /etc/krb5.keytab -K 10 -l 10h" - -# Kerberos REALM -# KRB_REALM="qpidd/EXAMPLE.COM" +# sysconfig_CONSOLE_ARGS=... \ No newline at end of file diff --git a/src/lib/mh_agent.cpp b/src/lib/mh_agent.cpp index 61f32bf..8645101 100644 --- a/src/lib/mh_agent.cpp +++ b/src/lib/mh_agent.cpp @@ -234,8 +234,7 @@ int print_help(int code, const char *name, const char *arg, void *userdata) printf("\nOptions:\n"); printf("\t-h | --help print this help message.\n"); for (lpc = 0; lpc < DIMOF(matahari_options); lpc++) { - if (matahari_options[lpc].callback - && matahari_options[lpc].callback != connection_option) { + if (matahari_options[lpc].callback) { printf("\t-%c | --%-10s\t%s\n", matahari_options[lpc].code, matahari_options[lpc].long_name, matahari_options[lpc].description); } @@ -251,6 +250,48 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int retry) int backoff = 0; GList *srv_records = NULL, *cur_srv_record = NULL; struct mh_dnssrv_record *record; + GError *error = NULL; + int status; + const gchar *k5start_bin[] = { + "/usr/bin/k5start", + "-U", + "-f", + mh_options["krb5_keytab"].asString().c_str(), + "-K", + mh_options["krb5_interval"].asString().c_str(), + NULL, + }; + + mh_trace("kerberos: %s %s %s %s %s %s", + k5start_bin[0], + k5start_bin[1], + k5start_bin[2], + k5start_bin[3], + k5start_bin[4], + k5start_bin[5]); + + /* Attempt to initiate k5start for credential renewal's without + * prompting for a password each time an agent is run + */ + if (strcmp(amqp_options["sasl-mechanism"].asString().c_str(),"GSSAPI") == 0) { + if (g_file_test(k5start_bin[0], G_FILE_TEST_IS_EXECUTABLE)) { + mh_trace("Running k5start"); + if (!g_spawn_sync( + NULL, + (gchar **) k5start_bin, + NULL, + G_SPAWN_SEARCH_PATH, + NULL, + NULL, + NULL, + NULL, + &status, + &error)) { + mh_warn("k5start failure: %s", error->message); + g_error_free(error); + } + } + }
if (!mh_options.count("servername") || mh_options.count("dns-srv")) { /* @@ -342,6 +383,19 @@ read_environment(OptionsMap& options) if (data && strlen(data)) { options["serverport"] = data; } + data = getenv("KRB5_KEYTAB"); + if (data && strlen(data)) { + options["krb5_keytab"] = data; + } else { + options["krb5_keytab"] = "/etc/krb5.keytab"; + } + + data = getenv("KRB5_INTERVAL"); + if (data && strlen(data)) { + options["krb5_interval"] = data; + } else { + options["krb5_interval"] = "10"; + } }
static void
Nice work Adam. Just one thing to fix up before Coverity catches it.
On 15/09/11 19:57, Adam Stokes wrote:
- Verify k5start exists
- Run k5start and check the top most principal (without this we would need to probably do some regexing through the klist to attempt to find which principal we want)
- This will re-initialization *existing* kerberos tickets without need for password.
- Actually show none connection options as a result of more kerberos work
- Uses environment variables and has general defaults as a fallback
Signed-off-by: Adam Stokesastokes@fedoraproject.org
matahari.init.in | 5 ---- matahari.sysconf.in | 14 +----------- src/lib/mh_agent.cpp | 58 ++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 57 insertions(+), 20 deletions(-)
diff --git a/matahari.init.in b/matahari.init.in index cb215de..75f9739 100644 --- a/matahari.init.in +++ b/matahari.init.in @@ -42,11 +42,6 @@ start() { MATAHARI_ARGS="--broker $MATAHARI_BROKER $MATAHARI_ARGS" fi
- # Setup kerberos ticket renewal
- if [ -n "$KRB_RENEW" ]; then
k5start $KRB_RENEW_ARGS $KRB_REALM
- fi
daemon $PROCESS $MATAHARI_ARGS --daemon RETVAL=$? echo
diff --git a/matahari.sysconf.in b/matahari.sysconf.in index bc25e73..a936c27 100644 --- a/matahari.sysconf.in +++ b/matahari.sysconf.in @@ -17,16 +17,4 @@ MATAHARI_AGENT_ARGS="--reconnect=yes" # network_AGENT_ARGS=...
# Per console options -# sysconfig_CONSOLE_ARGS=...
-# Security -# Kerberos
-# Uncomment to enable auto-renew credentials -# KRB_RENEW=yes
-# Set custom application and arguments for renew process -# KRB_RENEW_ARGS="-f /etc/krb5.keytab -K 10 -l 10h"
-# Kerberos REALM -# KRB_REALM="qpidd/EXAMPLE.COM" +# sysconfig_CONSOLE_ARGS=... \ No newline at end of file
Can we add a newline at the end of the file? I didn't know you could still find editors that don't fix this for you...
diff --git a/src/lib/mh_agent.cpp b/src/lib/mh_agent.cpp index 61f32bf..8645101 100644 --- a/src/lib/mh_agent.cpp +++ b/src/lib/mh_agent.cpp @@ -234,8 +234,7 @@ int print_help(int code, const char *name, const char *arg, void *userdata) printf("\nOptions:\n"); printf("\t-h | --help print this help message.\n"); for (lpc = 0; lpc< DIMOF(matahari_options); lpc++) {
if (matahari_options[lpc].callback
-&& matahari_options[lpc].callback != connection_option) {
if (matahari_options[lpc].callback) { printf("\t-%c | --%-10s\t%s\n", matahari_options[lpc].code, matahari_options[lpc].long_name, matahari_options[lpc].description); }
@@ -251,6 +250,48 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int retry) int backoff = 0; GList *srv_records = NULL, *cur_srv_record = NULL; struct mh_dnssrv_record *record;
- GError *error = NULL;
- int status;
- const gchar *k5start_bin[] = {
"/usr/bin/k5start",
"-U",
"-f",
mh_options["krb5_keytab"].asString().c_str(),
I'm pretty sure that Coverity is going to complain about this :(
The solution is to make sure that the result of asString() stays in scope:
std::str keytab(mh_options["krb5_keytab"].asString()); const gchar *k5start_bin[] = { ... keytab.c_str(), ... };
I think everybody on the project has made this mistake at least once now; I know I have. It's incredibly subtle because if asString() returned a reference instead of a copy then everything would be legit.
"-K",
mh_options["krb5_interval"].asString().c_str(),
Ditto, obviously.
NULL,
- };
- mh_trace("kerberos: %s %s %s %s %s %s",
k5start_bin[0],
k5start_bin[1],
k5start_bin[2],
k5start_bin[3],
k5start_bin[4],
k5start_bin[5]);
- /* Attempt to initiate k5start for credential renewal's without
* prompting for a password each time an agent is run
*/
- if (strcmp(amqp_options["sasl-mechanism"].asString().c_str(),"GSSAPI") == 0) {
if (g_file_test(k5start_bin[0], G_FILE_TEST_IS_EXECUTABLE)) {
mh_trace("Running k5start");
if (!g_spawn_sync(
NULL,
(gchar **) k5start_bin,
NULL,
G_SPAWN_SEARCH_PATH,
NULL,
NULL,
NULL,
NULL,
+&status, +&error)) {
mh_warn("k5start failure: %s", error->message);
g_error_free(error);
}
}
}
if (!mh_options.count("servername") || mh_options.count("dns-srv")) { /*
@@ -342,6 +383,19 @@ read_environment(OptionsMap& options) if (data&& strlen(data)) { options["serverport"] = data; }
data = getenv("KRB5_KEYTAB");
if (data&& strlen(data)) {
options["krb5_keytab"] = data;
} else {
options["krb5_keytab"] = "/etc/krb5.keytab";
}
data = getenv("KRB5_INTERVAL");
if (data&& strlen(data)) {
options["krb5_interval"] = data;
} else {
options["krb5_interval"] = "10";
} }
static void
matahari@lists.fedorahosted.org