<div class="synopsis">
B<bosserver> [B<-noauth>] [B<-log>] [B<-enable_peer_stats>]
- [B<-enable_process_stats>] [B<-help>]
+ [B<-enable_process_stats>] [B<-allow-dotted-principal>] [B<-help>]
=for html
</div>
other machines. To display or otherwise access the records, use the Rx
Monitoring API.
+=item B<-allow-dotted-principal>
+
+By default, the RXKAD security layer will disallow access by Kerberos
+principals with a dot in the first component of their name. This is to avoid
+the confusion where principals user/admin and user.admin are both mapped to the
+user.admin PTS entry. Sites whose Kerberos realms don't have these collisions
+between principal names may disable this check by starting the server
+with this option.
+
=item B<-help>
Prints the online help for this command. All other valid options are
S<<< [B<-busyat> <I<< redirect clients when queue > n >>>] >>>
[B<-nobusy>] S<<< [B<-rxpck> <I<number of rx extra packets>>] >>>
[B<-rxdbg>] [B<-rxdbge>] S<<< [B<-rxmaxmtu> <I<bytes>>] >>>
+ [B<-allow-dotted-principal>]
S<<< [B<-rxbind> <I<address to bind the Rx socket to>>] >>>
S<<< [B<-vattachpar> <I<number of volume attach threads>>] >>>
S<<< [B<-m> <I<min percentage spare in partition>>] >>>
Writes a trace of the File Server's operations on Rx events (such as
retransmissions) to the file F</usr/afs/logs/rx_dbg>.
+=item B<-allow-dotted-principal>
+
+By default, the RXKAD security layer will disallow access by Kerberos
+principals with a dot in the first component of their name. This is to avoid
+the confusion where principals user/admin and user.admin are both mapped to the
+user.admin PTS entry. Sites whose Kerberos realms don't have these collisions
+between principal names may disable this check by starting the server
+with this option.
+
=item F<-m> <I<min percentage spare in partition>>
Specifies the percentage of each AFS server partition that the AIX version
B<ptserver> S<<< [B<-database> <I<db path>>] >>> S<<< [B<-p> <I<number of processes>>] >>>
[B<-rebuildDB>] [B<-enable_peer_stats>] [B<-enable_process_stats>]
- [B<-help>]
+ [B<-allow-dotted-principal>] [B<-help>]
=for html
</div>
other machines. To display or otherwise access the records, use the Rx
Monitoring API.
+=item B<-allow-dotted-principal>
+
+By default, the RXKAD security layer will disallow access by Kerberos
+principals with a dot in the first component of their name. This is to avoid
+the confusion where principals user/admin and user.admin are both mapped to the
+user.admin PTS entry. Sites whose Kerberos realms don't have these collisions
+between principal names may disable this check by starting the server
+with this option.
+
=item B<-help>
Prints the online help for this command. All other valid options are
<div class="synopsis">
B<vlserver> S<<< [B<-p> <I<lwp processes>>] >>> [B<-nojumbo>]
- [B<-enable_peer_stats>] [B<-enable_process_stats>] [B<-help>]
+ [B<-allow-dotted-principal>] [B<-enable_peer_stats>] [B<-enable_process_stats>]
+ [B<-help>]
=for html
</div>
other machines. To display or otherwise access the records, use the Rx
Monitoring API.
+=item B<-allow-dotted-principal>
+
+By default, the RXKAD security layer will disallow access by Kerberos
+principals with a dot in the first component of their name. This is to avoid
+the confusion where principals user/admin and user.admin are both mapped to the
+user.admin PTS entry. Sites whose Kerberos realms don't have these collisions
+between principal names may disable this check by starting the server
+with this option.
+
=item B<-help>
Prints the online help for this command. All other valid options are
B<volserver> [B<-log>] S<<< [B<-p> <I<number of processes>>] >>>
S<<< [B<-udpsize> <I<size of socket buffer in bytes>>] >>>
- [B<-enable_peer_stats>] [B<-enable_process_stats>] [B<-help>]
+ [B<-enable_peer_stats>] [B<-enable_process_stats>]
+ [B<-allow-dotted-principal>] [B<-help>]
=for html
</div>
other machines. To display or otherwise access the records, use the Rx
Monitoring API.
+=item B<-allow-dotted-principal>
+
+By default, the RXKAD security layer will disallow access by Kerberos
+principals with a dot in the first component of their name. This is to avoid
+the confusion where principals user/admin and user.admin are both mapped to the
+user.admin PTS entry. Sites whose Kerberos realms don't have these collisions
+between principal names may disable this check by starting the server
+with this option.
+
=item B<-help>
Prints the online help for this command. All other valid options are
struct ktime bozo_nextRestartKT, bozo_nextDayKT;
int bozo_newKTs;
int rxBind = 0;
+int rxkadDisableDotCheck = 0;
#define ADDRSPERSITE 16 /* Same global is in rx/rx_user.c */
afs_uint32 SHostAddrs[ADDRSPERSITE];
else if (strcmp(argv[code], "-rxbind") == 0) {
rxBind = 1;
}
+ else if (strcmp(argv[code], "-allow-dotted-principals") == 0) {
+ rxkadDisableDotCheck = 1;
+ }
else if (!strcmp(argv[i], "-rxmaxmtu")) {
if ((i + 1) >= argc) {
fprintf(stderr, "missing argument for -rxmaxmtu\n");
#ifndef AFS_NT40_ENV
printf("Usage: bosserver [-noauth] [-log] "
"[-auditlog <log path>] "
- "[-rxmaxmtu <bytes>] [-rxbind] "
+ "[-rxmaxmtu <bytes>] [-rxbind] [-allow-dotted-principals]"
"[-syslog[=FACILITY]] "
"[-enable_peer_stats] [-enable_process_stats] "
"[-nofork] " "[-help]\n");
#else
printf("Usage: bosserver [-noauth] [-log] "
"[-auditlog <log path>] "
- "[-rxmaxmtu <bytes>] [-rxbind] "
+ "[-rxmaxmtu <bytes>] [-rxbind] [-allow-dotted-principals]"
"[-enable_peer_stats] [-enable_process_stats] "
"[-help]\n");
#endif
rx_SetMinProcs(tservice, 2);
rx_SetMaxProcs(tservice, 4);
rx_SetStackSize(tservice, BOZO_LWP_STACKSIZE); /* so gethostbyname works (in cell stuff) */
+ if (rxkadDisableDotCheck) {
+ rx_SetSecurityConfiguration(tservice, RXS_CONFIG_FLAGS,
+ (void *)RXS_CONFIG_FLAGS_DISABLE_DOTCHECK,
+ NULL);
+ }
tservice =
rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats", bozo_rxsc,
int restricted = 0;
int rxMaxMTU = -1;
int rxBind = 0;
+int rxkadDisableDotCheck = 0;
#define ADDRSPERSITE 16 /* Same global is in rx/rx_user.c */
afs_uint32 SHostAddrs[ADDRSPERSITE];
else if (strncmp(arg, "-rxbind", alen) == 0) {
rxBind = 1;
}
+ else if (strncmp(arg, "-allow-dotted-principals", alen) == 0) {
+ rxkadDisableDotCheck = 1;
+ }
else if (strncmp(arg, "-enable_peer_stats", alen) == 0) {
rx_enablePeerRPCStats();
} else if (strncmp(arg, "-enable_process_stats", alen) == 0) {
"[-p <number of processes>] [-rebuild] "
"[-groupdepth <depth>] "
"[-restricted] [-rxmaxmtu <bytes>] [-rxbind] "
+ "[-allow-dotted-principals] "
"[-enable_peer_stats] [-enable_process_stats] "
"[-default_access default_user_access default_group_access] "
"[-help]\n");
printf("Usage: ptserver [-database <db path>] "
"[-auditlog <log path>] "
"[-p <number of processes>] [-rebuild] [-rxbind] "
+ "[-allow-dotted-principals] "
"[-default_access default_user_access default_group_access] "
"[-restricted] [-rxmaxmtu <bytes>] [-rxbind] "
"[-groupdepth <depth>] " "[-help]\n");
"[-enable_peer_stats] [-enable_process_stats] "
"[-default_access default_user_access default_group_access] "
"[-restricted] [-rxmaxmtu <bytes>] [-rxbind] "
+ "[-allow-dotted-principals] "
"[-help]\n");
#else /* AFS_NT40_ENV */
printf("Usage: ptserver [-database <db path>] "
"[-auditlog <log path>] "
"[-default_access default_user_access default_group_access] "
"[-restricted] [-rxmaxmtu <bytes>] [-rxbind] "
+ "[-allow-dotted-principals] "
"[-p <number of processes>] [-rebuild] " "[-help]\n");
#endif
#endif
}
rx_SetMinProcs(tservice, 2);
rx_SetMaxProcs(tservice, lwps);
+ if (rxkadDisableDotCheck) {
+ rx_SetSecurityConfiguration(tservice, RXS_CONFIG_FLAGS,
+ (void *)RXS_CONFIG_FLAGS_DISABLE_DOTCHECK,
+ NULL);
+ }
tservice =
rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats", sc, 3,
return 0;
}
+/* Set configuration options for all of a service's security objects */
+
+afs_int32
+rx_SetSecurityConfiguration(struct rx_service *service,
+ rx_securityConfigVariables type,
+ void *value)
+{
+ int i;
+ for (i = 0; i<service->nSecurityObjects; i++) {
+ if (service->securityObjects[i]) {
+ RXS_SetConfiguration(service->securityObjects[i], NULL, type,
+ value, NULL);
+ }
+ }
+ return 0;
+}
+
struct rx_service *
rx_NewService(u_short port, u_short serviceId, char *serviceName,
struct rx_securityClass **securityObjects, int nSecurityObjects,
afs_int32 sparel[8];
};
+/* Configuration settings */
+
+/* Enum for storing configuration variables which can be set via the
+ * SetConfiguration method in the rx_securityClass, below
+ */
+
+typedef enum {
+ RXS_CONFIG_FLAGS /* afs_uint32 set of bitwise flags */
+} rx_securityConfigVariables;
+
+/* For the RXS_CONFIG_FLAGS, the following bit values are defined */
+
+/* Disable the principal name contains dot check in rxkad */
+#define RXS_CONFIG_FLAGS_DISABLE_DOTCHECK 0x01
+
/* XXXX (rewrite this description) A security class object contains a set of
* procedures and some private data to implement a security model for rx
* connections. These routines are called by rx as appropriate. Rx knows
int (*op_GetStats) (struct rx_securityClass * aobj,
struct rx_connection * aconn,
struct rx_securityObjectStats * astats);
- int (*op_Spare1) (void);
+ int (*op_SetConfiguration) (struct rx_securityClass * aobj,
+ struct rx_connection * aconn,
+ rx_securityConfigVariables atype,
+ void * avalue,
+ void ** acurrentValue);
int (*op_Spare2) (void);
int (*op_Spare3) (void);
} *ops;
#define RXS_CheckPacket(obj,call,packet) RXS_OP(obj,CheckPacket,(obj,call,packet))
#define RXS_DestroyConnection(obj,conn) RXS_OP(obj,DestroyConnection,(obj,conn))
#define RXS_GetStats(obj,conn,stats) RXS_OP(obj,GetStats,(obj,conn,stats))
-
+#define RXS_SetConfiguration(obj, conn, type, value, currentValue) RXS_OP(obj, SetConfiguration,(obj,conn,type,value,currentValue))
/* Structure for keeping rx statistics. Note that this structure is returned
char *get_key_rock; /* rock for get_key function */
int (*get_key) (); /* func. of kvno and server key ptr */
int (*user_ok) (); /* func called with new client name */
+ afs_uint32 flags; /* configuration flags */
};
/* private data in server-side connection */
afs_uint32 * expiration, char *name,
char *instance, char *cell,
afs_int32 * kvno);
-
-
+extern afs_int32 rxkad_SetConfiguration(struct rx_securityClass *aobj,
+ struct rx_connection *aconn,
+ rx_securityConfigVariables atype,
+ void * avalue, void **aresult);
/* ticket.c */
extern int tkt_DecodeTicket(char *asecret, afs_int32 ticketLen,
char *get_key_rock, int serv_kvno, char *name,
char *inst, char *cell, char *session_key,
afs_int32 * host, afs_int32 * start,
- afs_int32 * end);
+ afs_int32 * end, afs_int32 disableDotCheck);
#endif
rxkad_CheckPacket, /* check data packet */
rxkad_DestroyConnection,
rxkad_GetStats,
- 0, /* spare 1 */
+ rxkad_SetConfiguration,
0, /* spare 2 */
0, /* spare 3 */
};
code =
tkt_DecodeTicket5(tix, tlen, tsp->get_key, tsp->get_key_rock,
kvno, client.name, client.instance, client.cell,
- &sessionkey, &host, &start, &end);
+ &sessionkey, &host, &start, &end,
+ tsp->flags & RXS_CONFIG_FLAGS_DISABLE_DOTCHECK);
if (code)
return code;
}
} else
return RXKADNOAUTH;
}
+
+/* Set security object configuration variables */
+afs_int32 rxkad_SetConfiguration(struct rx_securityClass *aobj,
+ struct rx_connection *aconn,
+ rx_securityConfigVariables atype,
+ void * avalue, void **currentValue)
+{
+ struct rxkad_sprivate *private =
+ (struct rxkad_sprivate *) aobj->privateData;
+
+ switch (atype) {
+ case RXS_CONFIG_FLAGS:
+ if (currentValue) {
+ *((afs_uint32 *)currentValue) = private->flags;
+ } else {
+ private->flags = (afs_uint32) avalue;
+ }
+ break;
+ default:
+ break;
+ }
+ return 0;
+}
int (*get_key) (char *, int, struct ktc_encryptionKey *),
char *get_key_rock, int serv_kvno, char *name, char *inst,
char *cell, char *session_key, afs_int32 * host,
- afs_int32 * start, afs_int32 * end)
+ afs_int32 * start, afs_int32 * end, afs_int32 disableCheckdot)
{
char plain[MAXKRB5TICKETLEN];
struct ktc_encryptionKey serv_key;
goto bad_ticket;
}
- /*
- * If the first part of the name_string contains a dot, punt since
- * then we can't see the diffrence between the kerberos 5
- * principals foo.root and foo/root later in the fileserver.
- */
- if (strchr(decr_part.cname.name_string.val[0], '.') != NULL)
- goto bad_ticket;
+ if (!disableCheckdot) {
+ /*
+ * If the first part of the name_string contains a dot, punt since
+ * then we can't see the diffrence between the kerberos 5
+ * principals foo.root and foo/root later in the fileserver.
+ */
+ if (strchr(decr_part.cname.name_string.val[0], '.') != NULL)
+ goto bad_ticket;
+ }
/* Verify that decr_part.key is of right type */
switch (decr_part.key.keytype) {
int printBanner = 0;
int rxJumbograms = 1; /* default is to send and receive jumbograms. */
int rxBind = 0; /* don't bind */
+int rxkadDisableDotCheck = 0; /* disable check for dot in principal name */
int rxMaxMTU = -1;
afs_int32 implicitAdminRights = PRSFS_LOOKUP; /* The ADMINISTER right is
* already implied */
fputs("[-rxdbge (enable rxevent debugging)] ", stdout);
fputs("[-rxmaxmtu <bytes>] ", stdout);
fputs("[-rxbind (bind the Rx socket to one address)] ", stdout);
+ fputs("[-allow-dotted-principals (disable the rxkad principal name dot check)] ", stdout);
#ifdef AFS_DEMAND_ATTACH_FS
fputs("[-fs-state-dont-save (disable state save during shutdown)] ", stdout);
fputs("[-fs-state-dont-restore (disable state restore during startup)] ", stdout);
rxJumbograms = 0;
} else if (!strcmp(argv[i], "-rxbind")) {
rxBind = 1;
+ } else if (!strcmp(argv[i], "-allow-dotted-principals")) {
+ rxkadDisableDotCheck = 1;
} else if (!strcmp(argv[i], "-rxmaxmtu")) {
if ((i + 1) >= argc) {
fprintf(stderr, "missing argument for -rxmaxmtu\n");
("Failed to initialize RX, probably two servers running.\n"));
exit(-1);
}
+ if (rxkadDisableDotCheck) {
+ rx_SetSecurityConfiguration(tservice, RXS_CONFIG_FLAGS,
+ (void *)RXS_CONFIG_FLAGS_DISABLE_DOTCHECK,
+ NULL);
+ }
rx_SetMinProcs(tservice, 3);
rx_SetMaxProcs(tservice, lwps);
rx_SetCheckReach(tservice, 1);
int rxJumbograms = 1; /* default is to send and receive jumbo grams */
int rxMaxMTU = -1;
afs_int32 rxBind = 0;
+int rxkadDisableDotCheck = 0;
#define ADDRSPERSITE 16 /* Same global is in rx/rx_user.c */
afs_uint32 SHostAddrs[ADDRSPERSITE];
} else if (strcmp(argv[index], "-rxbind") == 0) {
rxBind = 1;
-
+ } else if (strcmp(argv[index], "-allow-dotted-principals") == 0) {
+ rxkadDisableDotCheck = 1;
} else if (!strcmp(argv[index], "-rxmaxmtu")) {
if ((index + 1) >= argc) {
fprintf(stderr, "missing argument for -rxmaxmtu\n");
/* support help flag */
#ifndef AFS_NT40_ENV
printf("Usage: vlserver [-p <number of processes>] [-nojumbo] "
- "[-rxmaxmtu <bytes>] [-rxbind] "
+ "[-rxmaxmtu <bytes>] [-rxbind] [-allow-dotted-principals] "
"[-auditlog <log path>] "
"[-syslog[=FACILITY]] "
"[-enable_peer_stats] [-enable_process_stats] "
"[-help]\n");
#else
printf("Usage: vlserver [-p <number of processes>] [-nojumbo] "
- "[-rxmaxmtu <bytes>] [-rxbind] "
+ "[-rxmaxmtu <bytes>] [-rxbind] [-allow-dotted-principals] "
"[-auditlog <log path>] "
"[-enable_peer_stats] [-enable_process_stats] "
"[-help]\n");
lwps = 4;
rx_SetMaxProcs(tservice, lwps);
+ if (rxkadDisableDotCheck) {
+ rx_SetSecurityConfiguration(tservice, RXS_CONFIG_FLAGS,
+ (void *)RXS_CONFIG_FLAGS_DISABLE_DOTCHECK,
+ NULL);
+ }
+
tservice =
rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats", sc, 3,
RXSTATS_ExecuteRequest);
int udpBufSize = 0; /* UDP buffer size for receive */
int rxBind = 0;
+int rxkadDisableDotCheck = 0;
#define ADDRSPERSITE 16 /* Same global is in rx/rx_user.c */
afs_uint32 SHostAddrs[ADDRSPERSITE];
goto usage;
} else if (strcmp(argv[code], "-rxbind") == 0) {
rxBind = 1;
+ } else if (strcmp(argv[code], "-allow-dotted-principals") == 0) {
+ rxkadDisableDotCheck = 1;
} else if (strcmp(argv[code], "-p") == 0) {
lwps = atoi(argv[++code]);
if (lwps > MAXLWP) {
#ifndef AFS_NT40_ENV
printf("Usage: volserver [-log] [-p <number of processes>] "
"[-auditlog <log path>] "
- "[-nojumbo] [-rxmaxmtu <bytes>] [-rxbind] "
+ "[-nojumbo] [-rxmaxmtu <bytes>] [-rxbind] [-allow-dotted-principals] "
"[-udpsize <size of socket buffer in bytes>] "
"[-syslog[=FACILITY]] "
"[-enable_peer_stats] [-enable_process_stats] "
#else
printf("Usage: volserver [-log] [-p <number of processes>] "
"[-auditlog <log path>] "
- "[-nojumbo] [-rxmaxmtu <bytes>] [-rxbind] "
+ "[-nojumbo] [-rxmaxmtu <bytes>] [-rxbind] [-allow-dotted-principals] "
"[-udpsize <size of socket buffer in bytes>] "
"[-enable_peer_stats] [-enable_process_stats] "
"[-help]\n");
rx_SetStackSize(service, (32 * 1024));
#endif
+ if (rxkadDisableDotCheck) {
+ rx_SetSecurityConfiguration(service, RXS_CONFIG_FLAGS,
+ (void *)RXS_CONFIG_FLAGS_DISABLE_DOTCHECK,
+ NULL);
+ }
+
service =
rx_NewService(0, RX_STATS_SERVICE_ID, "rpcstats", securityObjects, 3,
RXSTATS_ExecuteRequest);
git://git.openafs.org / openafs.git / commitdiff