On 09/16/2011 09:44 AM, Zane Bitter wrote:
Ack, thanks Adam :)
Yep, looks fine, but I included a couple of minor comments on where a
helper in utilities.h could be used.
On 16/09/11 15:30, Adam Stokes wrote:
> - Verify k5start exists
> - Run k5start and check the top most principal (without
> this we would need to probably do some regexing through the
> klist to attempt to find which principal we want)
> - This will re-initialization *existing* kerberos tickets without
> need for password.
> - Actually show none connection options as a result of more kerberos
> work
> - Uses environment variables and has general defaults as a fallback
>
> Signed-off-by: Adam Stokes<astokes(a)fedoraproject.org>
> ---
> matahari.init.in | 4 ---
> matahari.sysconf.in | 12 ----------
> src/lib/mh_agent.cpp | 60 ++++++++++++++++++++++++++++++++++++++++++++++++-
> 3 files changed, 58 insertions(+), 18 deletions(-)
>
> diff --git a/matahari.init.in b/matahari.init.in
> index e9588f9..323ad89 100644
> --- a/matahari.init.in
> +++ b/matahari.init.in
> @@ -46,10 +46,6 @@ start() {
> MATAHARI_ARGS="--broker $MATAHARI_BROKER $MATAHARI_ARGS"
> fi
>
> - # Setup kerberos ticket renewal
> - if [ -n "$KRB_RENEW" ]; then
> - k5start $KRB_RENEW_ARGS $KRB_REALM
> - fi
>
> daemon $PROCESS $MATAHARI_ARGS --daemon
> RETVAL=$?
> diff --git a/matahari.sysconf.in b/matahari.sysconf.in
> index bc25e73..edd0065 100644
> --- a/matahari.sysconf.in
> +++ b/matahari.sysconf.in
> @@ -18,15 +18,3 @@ MATAHARI_AGENT_ARGS="--reconnect=yes"
>
> # Per console options
> # sysconfig_CONSOLE_ARGS=...
> -
> -# Security
> -# Kerberos
> -
> -# Uncomment to enable auto-renew credentials
> -# KRB_RENEW=yes
> -
> -# Set custom application and arguments for renew process
> -# KRB_RENEW_ARGS="-f /etc/krb5.keytab -K 10 -l 10h"
> -
> -# Kerberos REALM
> -# KRB_REALM="qpidd/EXAMPLE.COM"
> diff --git a/src/lib/mh_agent.cpp b/src/lib/mh_agent.cpp
> index 61f32bf..4a7cbf1 100644
> --- a/src/lib/mh_agent.cpp
> +++ b/src/lib/mh_agent.cpp
> @@ -234,8 +234,7 @@ int print_help(int code, const char *name, const char *arg, void
*userdata)
> printf("\nOptions:\n");
> printf("\t-h | --help print this help message.\n");
> for (lpc = 0; lpc< DIMOF(matahari_options); lpc++) {
> - if (matahari_options[lpc].callback
> -&& matahari_options[lpc].callback != connection_option) {
> + if (matahari_options[lpc].callback) {
> printf("\t-%c | --%-10s\t%s\n", matahari_options[lpc].code,
> matahari_options[lpc].long_name,
matahari_options[lpc].description);
> }
> @@ -251,6 +250,50 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int
retry)
> int backoff = 0;
> GList *srv_records = NULL, *cur_srv_record = NULL;
> struct mh_dnssrv_record *record;
> + GError *error = NULL;
> + int status;
> + std::string krb5_keytab(mh_options["krb5_keytab"].asString());
> + std::string krb5_interval(mh_options["krb5_interval"].asString());
> + const gchar *k5start_bin[] = {
> + "/usr/bin/k5start",
> + "-U",
> + "-f",
> + krb5_keytab.c_str(),
> + "-K",
> + krb5_interval.c_str(),
> + NULL,
> + };
> +
> + mh_trace("kerberos: %s %s %s %s %s %s",
> + k5start_bin[0],
> + k5start_bin[1],
> + k5start_bin[2],
> + k5start_bin[3],
> + k5start_bin[4],
> + k5start_bin[5]);
> +
> + /* Attempt to initiate k5start for credential renewal's without
> + * prompting for a password each time an agent is run
> + */
> + if
(strcmp(amqp_options["sasl-mechanism"].asString().c_str(),"GSSAPI") ==
0) {
> + if (g_file_test(k5start_bin[0], G_FILE_TEST_IS_EXECUTABLE)) {
> + mh_trace("Running k5start");
> + if (!g_spawn_sync(
> + NULL,
> + (gchar **) k5start_bin,
> + NULL,
> + G_SPAWN_SEARCH_PATH,
> + NULL,
> + NULL,
> + NULL,
> + NULL,
> +&status,
> +&error)) {
> + mh_warn("k5start failure: %s", error->message);
> + g_error_free(error);
> + }
> + }
> + }
>
> if (!mh_options.count("servername") ||
mh_options.count("dns-srv")) {
> /*
> @@ -342,6 +385,19 @@ read_environment(OptionsMap& options)
> if (data&& strlen(data)) {
> options["serverport"] = data;
> }
> + data = getenv("KRB5_KEYTAB");
> + if (data&& strlen(data)) {
This is equivalent to:
if (!mh_strlen_zero(data)) {
}
> + options["krb5_keytab"] = data;
> + } else {
> + options["krb5_keytab"] = "/etc/krb5.keytab";
> + }
> +
> + data = getenv("KRB5_INTERVAL");
> + if (data&& strlen(data)) {
Here too.
> + options["krb5_interval"] = data;
> + } else {
> + options["krb5_interval"] = "10";
> + }
> }
>
> static void
_______________________________________________
Matahari mailing list
Matahari(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/matahari
--
Russell Bryant