cifs-utils: moving resolve_host into separate file

The resolve_host routine from mount.cifs is carried out in separate file and appropriate corrections are made.

---
 Makefile.am    |    2 +-
 mount.cifs.c   |  105 +++++++-------------------------------------------------
 resolve_host.c |  105 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 resolve_host.h |   34 ++++++++++++++++++
 4 files changed, 153 insertions(+), 93 deletions(-)
 create mode 100644 resolve_host.c
 create mode 100644 resolve_host.h

index c53c9ec..1ac9249 100644
@@ -3,7 +3,7 @@ ACLOCAL_AMFLAGS = -I aclocal
 
 root_sbindir = "/sbin"
 root_sbin_PROGRAMS = mount.cifs
-mount_cifs_SOURCES = mount.cifs.c mtab.c util.c
+mount_cifs_SOURCES = mount.cifs.c mtab.c resolve_host.c util.c
 mount_cifs_LDADD = $(LIBCAP) $(CAPNG_LDADD)
 
 man_MANS = mount.cifs.8

new file mode 100644
index 0000000..b949245
@@ -0,0 +1,34 @@
+/*
+ * resolving DNS hostname routine
+ *
+ * Copyright (C) 2010 Jeff Layton ([email protected])
+ * Copyright (C) 2010 Igor Druzhinin ([email protected])
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _RESOLVE_HOST_H_
+#define _RESOLVE_HOST_H_
+
+#include <arpa/inet.h>
+
+/* currently maximum length of IPv6 address string */
+#define MAX_ADDRESS_LEN INET6_ADDRSTRLEN
+
+/* limit list of addresses to 16 max-size addrs */
+#define MAX_ADDR_LIST_LEN ((MAX_ADDRESS_LEN + 1) * 16)
+
+extern int resolve_host(const char *host, char *addrstr);
+
+#endif /* _RESOLVE_HOST_H_ */

1.7.2.1

It is a userspace part of a new infrastructure for stashing passwords in kernel keyring per user basis. The patch adds the "cifscreds" utility for management keys with credentials. Assembling of the utility from the distribution is possible with --enable-cifscreds=yes option of configure script.

---
 Makefile.am  |    5 +
 cifscreds.c  |  582 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 configure.ac |   15 ++-
 3 files changed, 600 insertions(+), 2 deletions(-)
 create mode 100644 cifscreds.c

index 1ac9249..38a16fe 100644
@@ -15,3 +15,8 @@ cifs_upcall_LDADD = -ltalloc -lkeyutils $(KRB5_LDADD)
 man_MANS += cifs.upcall.8
 endif
 
+if CONFIG_CIFSCREDS
+bin_PROGRAMS = cifscreds
+cifscreds_SOURCES = cifscreds.c resolve_host.c util.c
+cifscreds_LDADD = -lkeyutils
+endif

index 266380a..c7d420d 100644
@@ -16,12 +16,18 @@ AC_ARG_ENABLE(cifsupcall,
 	enable_cifsupcall=$enableval,
 	enable_cifsupcall="maybe")
 
+AC_ARG_ENABLE(cifscreds,
+	[AC_HELP_STRING([--enable-cifscreds],
+			[Create cifscreds utility @<:@default=no@:>@])],
+	enable_cifscreds=$enableval,
+	enable_cifscreds="no")
+
 # Checks for programs.
 AC_PROG_CC
 AC_GNU_SOURCE
 
 # Checks for header files.
-AC_CHECK_HEADERS([arpa/inet.h fcntl.h inttypes.h limits.h mntent.h netdb.h stddef.h stdint.h stdlib.h string.h strings.h sys/mount.h sys/param.h sys/socket.h sys/time.h syslog.h unistd.h], , [AC_MSG_ERROR([necessary header(s) not found])])
+AC_CHECK_HEADERS([arpa/inet.h ctype.h fcntl.h inttypes.h limits.h mntent.h netdb.h stddef.h stdint.h stdlib.h string.h strings.h sys/mount.h sys/param.h sys/socket.h sys/time.h syslog.h unistd.h], , [AC_MSG_ERROR([necessary header(s) not found])])
 
 if test $enable_cifsupcall != "no"; then
 	AC_CHECK_HEADERS([krb5.h krb5/krb5.h])

@@ -82,6 +88,10 @@ if test $enable_cifsupcall != "no"; then
 	AC_SUBST(KRB5_LDADD)
 fi
 
+if test $enable_cifscreds = "yes"; then
+	AC_CHECK_HEADERS([keyutils.h], , [AC_MSG_ERROR([keyutils.h not found, consider installing keyutils-libs-devel.])])
+fi
+
 # Checks for typedefs, structures, and compiler characteristics.
 AC_HEADER_STDBOOL
 AC_TYPE_UID_T

@@ -98,7 +108,7 @@ AC_FUNC_REALLOC
 AC_FUNC_STRNLEN
 
 # check for required functions
-AC_CHECK_FUNCS([alarm atexit endpwent getmntent getpass gettimeofday inet_ntop memset realpath setenv strchr strdup strerror strncasecmp strndup strpbrk strrchr strstr strtol strtoul uname], , [AC_MSG_ERROR([necessary functions(s) not found])])
+AC_CHECK_FUNCS([alarm atexit endpwent getmntent getpass gettimeofday inet_ntop memset realpath setenv strchr strcmp strdup strerror strncasecmp strndup strpbrk strrchr strstr strtol strtoul tolower uname], , [AC_MSG_ERROR([necessary functions(s) not found])])
 
 # ugly, but I'm not sure how to check for functions in a library that's not in $LIBS
 cu_saved_libs=$LIBS

@@ -117,6 +127,7 @@ fi
 LIBS=$cu_saved_libs
 
 AM_CONDITIONAL(CONFIG_CIFSUPCALL, [test "$enable_cifsupcall" != "no"])
+AM_CONDITIONAL(CONFIG_CIFSCREDS, [test "$enable_cifscreds" = "yes"])
 
 LIBCAP_NG_PATH
 

1.7.2.1

I've started dusting off this work with the aim of extending multiuser mount code to non-krb5 mounts. While doing this, I've found a couple of problems...

The current scheme is to store a key with this description:

cifscreds:<ip>:<username>:[domainname]

The first problem is that the username shouldn't be part of the description. We don't necessarily know what the username will be in advance. It may be different from the local unix username. So I think we need to eliminate the "username" part from the description and instead store that name in the "payload". We should probably also encode the port number be part of the address for situations where the host has multiple smb servers with different credential DB's.

The second problem is that "ip" and "domainname" should basically be mutually exclusive. IOW, someone ought to specify an ip address for which the credentials are valid, or specify credentials that will work for any machine that's in a particular domain.

So, I think we need 2 key description formats:

cifscreds:address+port

...and...

cifscreds:domain

...and the username and password should be stored together in the value part of the key.

Then, the kernel's algorithm can look something like this:

1) see if there are credentials for the IP address (and maybe port) with which we are communicating

...if those don't exist...

2) see if there are credentials for the domain that the server claims to be part of

Does this make sense? If so, then I'll start work on a patchset to change this over (unless you would rather do the work).

Thanks,

Jeff Layton <[email protected]>

Nice work, Igor.

Looks good -- both patches merged. That should allow people to start playing with it. They should make the 4.7 release.

There's still plenty of work to do here:

1) the kernel pieces need to go in once they're ready. I'll plan to review the latest ones this weekend sometime.

2) it needs a manpage

Once all of that is done, we can start considering building it by default (i.e. make the default "enable" instead of "disable").

We also need to have a hard look at how to sync this work up with the multiuser mount work. That's not something we need to worry about until the multiuser mount code for krb5 goes in.

Cheers,

Jeff Layton <[email protected]>