Blame SOURCES/libnfsidmap-0.25-multidomain.patch

76e38b
diff -up libnfsidmap-0.25/idmapd.conf.5.orig libnfsidmap-0.25/idmapd.conf.5
76e38b
--- libnfsidmap-0.25/idmapd.conf.5.orig	2017-01-10 13:30:28.696901000 -0500
76e38b
+++ libnfsidmap-0.25/idmapd.conf.5	2017-01-10 13:32:44.241316000 -0500
76e38b
@@ -63,6 +63,30 @@ The local NFSv4 domain name.  An NFSv4 d
76e38b
 a unique username<->UID and groupname<->GID mapping.
76e38b
 (Default: Host's fully-qualified DNS domain name)
76e38b
 .TP
76e38b
+.B No-Strip
76e38b
+In multi-domain environments, some NFS servers will append the identity
76e38b
+management domain to the owner and owner_group in lieu of a true NFSv4
76e38b
+domain.  This option can facilitate lookups in such environments.  If
76e38b
+set to a value other than "none", the nsswitch  plugin will first pass
76e38b
+the name to the password/group lookup function without stripping the
76e38b
+domain off.  If that mapping fails then the plugin will try again using
76e38b
+the old method (comparing the domain in the string to the Domain value,
76e38b
+stripping it if it matches, and passing the resulting short name to the
76e38b
+lookup function).  Valid values are "user", "group", "both", and
76e38b
+"none".
76e38b
+(Default: "none")
76e38b
+.TP
76e38b
+.B Reformat-Group
76e38b
+Winbind has a quirk whereby doing a group lookup in UPN format
76e38b
+(e.g. staff@americas.example.com) will cause the group to be
76e38b
+displayed prefixed with the full domain in uppercase
76e38b
+(e.g. AMERICAS.EXAMPLE.COM\\staff) instead of in the familiar netbios
76e38b
+name format (e.g. AMERICAS\\staff).  Setting this option to true
76e38b
+causes the name to be reformatted before passing it to the group
76e38b
+lookup function in order to work around this.  This setting is
76e38b
+ignored unless No-Strip is set to either "both" or "group".
76e38b
+(Default: "false")
76e38b
+.TP
76e38b
 .B Local-Realms
76e38b
 A comma-separated list of Kerberos realm names that may be considered equivalent to the
76e38b
 local realm name.  For example, users juser@ORDER.EDU and juser@MAIL.ORDER.EDU
76e38b
diff -up libnfsidmap-0.25/idmapd.conf.orig libnfsidmap-0.25/idmapd.conf
76e38b
--- libnfsidmap-0.25/idmapd.conf.orig	2011-12-05 15:28:10.000000000 -0500
76e38b
+++ libnfsidmap-0.25/idmapd.conf	2017-01-10 13:32:44.235315000 -0500
76e38b
@@ -4,6 +4,29 @@
76e38b
 # The default is the host's DNS domain name.
76e38b
 #Domain = local.domain.edu
76e38b
 
76e38b
+# In multi-domain environments, some NFS servers will append the identity
76e38b
+# management domain to the owner and owner_group in lieu of a true NFSv4
76e38b
+# domain.  This option can facilitate lookups in such environments.  If
76e38b
+# set to a value other than "none", the nsswitch  plugin will first pass
76e38b
+# the name to the password/group lookup function without stripping the
76e38b
+# domain off.  If that mapping fails then the plugin will try again using
76e38b
+# the old method (comparing the domain in the string to the Domain value,
76e38b
+# stripping it if it matches, and passing the resulting short name to the
76e38b
+# lookup function).  Valid values are "user", "group", "both", and
76e38b
+# "none".  The default is "none".
76e38b
+#No-Strip = none
76e38b
+
76e38b
+# Winbind has a quirk whereby doing a group lookup in UPN format
76e38b
+# (e.g. staff@americas.example.com) will cause the group to be
76e38b
+# displayed prefixed with the full domain in uppercase
76e38b
+# (e.g. AMERICAS.EXAMPLE.COM\staff) instead of in the familiar netbios
76e38b
+# name format (e.g. AMERICAS\staff).  Setting this option to true
76e38b
+# causes the name to be reformatted before passing it to the group
76e38b
+# lookup function in order to work around this.  This setting is
76e38b
+# ignored unless No-Strip is set to either "both" or "group".
76e38b
+# The default is "false".
76e38b
+#Reformat-Group = false
76e38b
+
76e38b
 # The following is a comma-separated list of Kerberos realm
76e38b
 # names that should be considered to be equivalent to the
76e38b
 # local realm, such that <user>@REALM.A can be assumed to
76e38b
diff -up libnfsidmap-0.25/libnfsidmap.c.orig libnfsidmap-0.25/libnfsidmap.c
76e38b
--- libnfsidmap-0.25/libnfsidmap.c.orig	2017-01-10 13:30:28.837901000 -0500
76e38b
+++ libnfsidmap-0.25/libnfsidmap.c	2017-01-10 13:32:44.247315000 -0500
76e38b
@@ -60,6 +60,8 @@
76e38b
 static char *default_domain;
76e38b
 static struct conf_list *local_realms;
76e38b
 int idmap_verbosity = 0;
76e38b
+int no_strip = 0;
76e38b
+int reformat_group = 0;
76e38b
 static struct mapping_plugin **nfs4_plugins = NULL;
76e38b
 static struct mapping_plugin **gss_plugins = NULL;
76e38b
 uid_t nobody_uid = (uid_t)-1;
76e38b
@@ -234,6 +236,8 @@ int nfs4_init_name_mapping(char *conffil
76e38b
 	int dflt = 0;
76e38b
 	struct conf_list *nfs4_methods, *gss_methods;
76e38b
 	char *nobody_user, *nobody_group;
76e38b
+	char *nostrip;
76e38b
+	char *reformatgroup;
76e38b
 
76e38b
 	/* XXX: need to be able to reload configurations... */
76e38b
 	if (nfs4_plugins) /* already succesfully initialized */
76e38b
@@ -306,6 +310,26 @@ int nfs4_init_name_mapping(char *conffil
76e38b
 			IDMAP_LOG(1, ("libnfsidmap: Realms list: <NULL> "));
76e38b
 	}
76e38b
 
76e38b
+	nostrip = conf_get_str_with_def("General", "No-Strip", "none");
76e38b
+	if (strcasecmp(nostrip, "both") == 0)
76e38b
+		no_strip = IDTYPE_USER|IDTYPE_GROUP;
76e38b
+	else if (strcasecmp(nostrip, "group") == 0)
76e38b
+		no_strip = IDTYPE_GROUP;
76e38b
+	else if (strcasecmp(nostrip, "user") == 0)
76e38b
+		no_strip = IDTYPE_USER;
76e38b
+	else
76e38b
+		no_strip = 0;
76e38b
+
76e38b
+	if (no_strip & IDTYPE_GROUP) {
76e38b
+		reformatgroup = conf_get_str_with_def("General", "Reformat-Group", "false");
76e38b
+		if ((strcasecmp(reformatgroup, "true") == 0) ||
76e38b
+		    (strcasecmp(reformatgroup, "on") == 0) ||
76e38b
+		    (strcasecmp(reformatgroup, "yes") == 0))
76e38b
+			reformat_group = 1;
76e38b
+		else
76e38b
+			reformat_group = 0;
76e38b
+	}
76e38b
+
76e38b
 	nfs4_methods = conf_get_list("Translation", "Method");
76e38b
 	if (nfs4_methods) {
76e38b
 		IDMAP_LOG(1, ("libnfsidmap: processing 'Method' list"));
76e38b
diff -up libnfsidmap-0.25/nfsidmap_internal.h.orig libnfsidmap-0.25/nfsidmap_internal.h
76e38b
--- libnfsidmap-0.25/nfsidmap_internal.h.orig	2011-12-05 15:28:10.000000000 -0500
76e38b
+++ libnfsidmap-0.25/nfsidmap_internal.h	2017-01-10 13:32:44.253315000 -0500
76e38b
@@ -63,6 +63,8 @@ typedef enum {
76e38b
 	IDTYPE_GROUP = 2
76e38b
 } idtypes;
76e38b
 
76e38b
+extern int no_strip;
76e38b
+extern int reformat_group;
76e38b
 extern int idmap_verbosity;
76e38b
 extern nfs4_idmap_log_function_t idmap_log_func;
76e38b
 /* Level zero always prints, others print depending on verbosity level */
76e38b
diff -up libnfsidmap-0.25/nss.c.orig libnfsidmap-0.25/nss.c
76e38b
--- libnfsidmap-0.25/nss.c.orig	2017-01-10 13:30:28.892903000 -0500
76e38b
+++ libnfsidmap-0.25/nss.c	2017-01-10 13:32:44.259316000 -0500
76e38b
@@ -45,6 +45,7 @@
76e38b
 #include <err.h>
76e38b
 #include <grp.h>
76e38b
 #include <limits.h>
76e38b
+#include <ctype.h>
76e38b
 #include "nfsidmap.h"
76e38b
 #include "nfsidmap_internal.h"
76e38b
 #include "cfg.h"
76e38b
@@ -58,14 +59,20 @@
76e38b
  * and ignore the domain entirely when looking up a name.
76e38b
  */
76e38b
 
76e38b
-static int write_name(char *dest, char *localname, char *domain, size_t len)
76e38b
+static int write_name(char *dest, char *localname, char *domain, size_t len,
76e38b
+		      int doappend)
76e38b
 {
76e38b
-	if (strlen(localname) + 1 + strlen(domain) + 1 > len) {
76e38b
-		return -ENOMEM; /* XXX: Is there an -ETOOLONG? */
76e38b
+	if (doappend || !strchr(localname,'@')) {
76e38b
+		if (strlen(localname) + 1 + strlen(domain) + 1 > len)
76e38b
+			return -ENOMEM; /* XXX: Is there an -ETOOLONG? */
76e38b
+		strcpy(dest, localname);
76e38b
+		strcat(dest, "@");
76e38b
+		strcat(dest, domain);
76e38b
+	} else {
76e38b
+		if (strlen(localname) + 1 > len)
76e38b
+			return -ENOMEM;
76e38b
+		strcpy(dest, localname);
76e38b
 	}
76e38b
-	strcpy(dest, localname);
76e38b
-	strcat(dest, "@");
76e38b
-	strcat(dest, domain);
76e38b
 	return 0;
76e38b
 }
76e38b
 
76e38b
@@ -87,7 +94,10 @@ static int nss_uid_to_name(uid_t uid, ch
76e38b
 		err = -ENOENT;
76e38b
 	if (err)
76e38b
 		goto out_buf;
76e38b
-	err = write_name(name, pw->pw_name, domain, len);
76e38b
+	if (no_strip & IDTYPE_USER)
76e38b
+		err = write_name(name, pw->pw_name, domain, len, 0);
76e38b
+	else
76e38b
+		err = write_name(name, pw->pw_name, domain, len, 1);
76e38b
 out_buf:
76e38b
 	free(buf);
76e38b
 out:
76e38b
@@ -121,7 +131,10 @@ static int nss_gid_to_name(gid_t gid, ch
76e38b
 
76e38b
 	if (err)
76e38b
 		goto out_buf;
76e38b
-	err = write_name(name, gr->gr_name, domain, len);
76e38b
+	if (no_strip & IDTYPE_GROUP)
76e38b
+		err = write_name(name, gr->gr_name, domain, len, 0);
76e38b
+	else
76e38b
+		err = write_name(name, gr->gr_name, domain, len, 1);
76e38b
 out_buf:
76e38b
 	free(buf);
76e38b
 out:
76e38b
@@ -164,7 +177,8 @@ struct pwbuf {
76e38b
 	char buf[1];
76e38b
 };
76e38b
 
76e38b
-static struct passwd *nss_getpwnam(const char *name, const char *domain, int *err_p)
76e38b
+static struct passwd *nss_getpwnam(const char *name, const char *domain,
76e38b
+				   int *err_p, int dostrip)
76e38b
 {
76e38b
 	struct passwd *pw;
76e38b
 	struct pwbuf *buf;
76e38b
@@ -180,22 +194,29 @@ static struct passwd *nss_getpwnam(const
76e38b
 		goto err;
76e38b
 
76e38b
 	err = EINVAL;
76e38b
-	localname = strip_domain(name, domain);
76e38b
-	IDMAP_LOG(4, ("nss_getpwnam: name '%s' domain '%s': "
76e38b
-		  "resulting localname '%s'", name, domain, localname));
76e38b
-	if (localname == NULL) {
76e38b
-		IDMAP_LOG(0, ("nss_getpwnam: name '%s' does not map "
76e38b
-			"into domain '%s'", name,
76e38b
-			domain ? domain : "<not-provided>"));
76e38b
-		goto err_free_buf;
76e38b
-	}
76e38b
+	if (dostrip) {
76e38b
+		localname = strip_domain(name, domain);
76e38b
+		IDMAP_LOG(4, ("nss_getpwnam: name '%s' domain '%s': "
76e38b
+			  "resulting localname '%s'", name, domain, localname));
76e38b
+		if (localname == NULL) {
76e38b
+			IDMAP_LOG(0, ("nss_getpwnam: name '%s' does not map "
76e38b
+				"into domain '%s'", name,
76e38b
+				domain ? domain : "<not-provided>"));
76e38b
+			goto err_free_buf;
76e38b
+		}
76e38b
 
76e38b
-	err = getpwnam_r(localname, &buf->pwbuf, buf->buf, buflen, &pw;;
76e38b
-	if (pw == NULL && domain != NULL)
76e38b
-		IDMAP_LOG(0,
76e38b
-			("nss_getpwnam: name '%s' not found in domain '%s'",
76e38b
-			localname, domain));
76e38b
-	free(localname);
76e38b
+		err = getpwnam_r(localname, &buf->pwbuf, buf->buf, buflen, &pw;;
76e38b
+		if (pw == NULL && domain != NULL)
76e38b
+			IDMAP_LOG(1,
76e38b
+				("nss_getpwnam: name '%s' not found in domain '%s'",
76e38b
+				localname, domain));
76e38b
+		free(localname);
76e38b
+	} else {
76e38b
+		err = getpwnam_r(name, &buf->pwbuf, buf->buf, buflen, &pw;;
76e38b
+		if (pw == NULL)
76e38b
+			IDMAP_LOG(1,
76e38b
+				("nss_getpwnam: name '%s' not found (domain not stripped)", name));
76e38b
+	}
76e38b
 	if (err == 0 && pw != NULL) {
76e38b
 		*err_p = 0;
76e38b
 		return pw;
76e38b
@@ -217,28 +238,83 @@ static int nss_name_to_uid(char *name, u
76e38b
 	int err = -ENOENT;
76e38b
 
76e38b
 	domain = get_default_domain();
76e38b
-	pw = nss_getpwnam(name, domain, &err;;
76e38b
+	if (no_strip & IDTYPE_USER) {
76e38b
+		pw = nss_getpwnam(name, domain, &err, 0);
76e38b
+		if (pw != NULL)
76e38b
+			goto out_uid;
76e38b
+	}
76e38b
+	pw = nss_getpwnam(name, domain, &err, 1);
76e38b
 	if (pw == NULL)
76e38b
 		goto out;
76e38b
+out_uid:
76e38b
 	*uid = pw->pw_uid;
76e38b
+	IDMAP_LOG(4, ("nss_name_to_uid: name '%s' uid %u", name, *uid));
76e38b
 	free(pw);
76e38b
 	err = 0;
76e38b
 out:
76e38b
 	return err;
76e38b
 }
76e38b
 
76e38b
-static int nss_name_to_gid(char *name, gid_t *gid)
76e38b
+static char *reformat_name(const char *name)
76e38b
+{
76e38b
+	const char *domain;
76e38b
+	const char *c;
76e38b
+	const char *d;
76e38b
+	char *l = NULL;
76e38b
+	int len;
76e38b
+	int dlen = 0;
76e38b
+	int i;
76e38b
+
76e38b
+	c = strchr(name, '@');
76e38b
+	if (c == NULL)
76e38b
+		goto out;
76e38b
+	len = c - name;
76e38b
+	domain = ++c;
76e38b
+	d = strchr(domain, '.');
76e38b
+	if (d == NULL)
76e38b
+		goto out;
76e38b
+	dlen = d - domain;
76e38b
+	l = malloc(dlen + 1 + len + 1);
76e38b
+	if (l == NULL)
76e38b
+		goto out;
76e38b
+	for (i = 0; i < dlen; i++)
76e38b
+		l[i] = toupper(domain[i]);
76e38b
+	l[dlen] = '\\';
76e38b
+	memcpy(l + dlen + 1, name, len);
76e38b
+	l[dlen + 1 + len] = '\0';
76e38b
+out:
76e38b
+	return l;
76e38b
+}
76e38b
+
76e38b
+static int _nss_name_to_gid(char *name, gid_t *gid, int dostrip)
76e38b
 {
76e38b
 	struct group *gr = NULL;
76e38b
 	struct group grbuf;
76e38b
-	char *buf, *localname, *domain;
76e38b
+	char *buf, *domain;
76e38b
 	size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
76e38b
 	int err = -EINVAL;
76e38b
+	char *localname = NULL;
76e38b
+	char *ref_name = NULL;
76e38b
 
76e38b
 	domain = get_default_domain();
76e38b
-	localname = strip_domain(name, domain);
76e38b
-	if (!localname)
76e38b
-		goto out;
76e38b
+	if (dostrip) {
76e38b
+		localname = strip_domain(name, domain);
76e38b
+		IDMAP_LOG(4, ("nss_name_to_gid: name '%s' domain '%s': "
76e38b
+			  "resulting localname '%s'", name, domain, localname));
76e38b
+		if (!localname) {
76e38b
+			IDMAP_LOG(0, ("nss_name_to_gid: name '%s' does not map "
76e38b
+				  "into domain '%s'", name, domain));
76e38b
+			goto out;
76e38b
+		}
76e38b
+	} else if (reformat_group) {
76e38b
+		ref_name = reformat_name(name);
76e38b
+		if (ref_name == NULL) {
76e38b
+			IDMAP_LOG(1, ("nss_name_to_gid: failed to reformat name '%s'",
76e38b
+				  name));
76e38b
+			err = -ENOENT;
76e38b
+			goto out;
76e38b
+		}
76e38b
+	}
76e38b
 
76e38b
 	err = -ENOMEM;
76e38b
 	if (buflen > UINT_MAX)
76e38b
@@ -248,9 +324,24 @@ static int nss_name_to_gid(char *name, g
76e38b
 		buf = malloc(buflen);
76e38b
 		if (!buf)
76e38b
 			goto out_name;
76e38b
-		err = -getgrnam_r(localname, &grbuf, buf, buflen, &gr);
76e38b
-		if (gr == NULL && !err)
76e38b
+		if (dostrip)
76e38b
+			err = -getgrnam_r(localname, &grbuf, buf, buflen, &gr);
76e38b
+		else if (reformat_group)
76e38b
+			err = -getgrnam_r(ref_name, &grbuf, buf, buflen, &gr);
76e38b
+		else
76e38b
+			err = -getgrnam_r(name, &grbuf, buf, buflen, &gr);
76e38b
+		if (gr == NULL && !err) {
76e38b
+			if (dostrip)
76e38b
+				IDMAP_LOG(1, ("nss_name_to_gid: name '%s' not found "
76e38b
+					  "in domain '%s'", localname, domain));
76e38b
+			else if (reformat_group)
76e38b
+				IDMAP_LOG(1, ("nss_name_to_gid: name '%s' not found "
76e38b
+					  "(reformatted)", ref_name));
76e38b
+			else
76e38b
+				IDMAP_LOG(1, ("nss_name_to_gid: name '%s' not found "
76e38b
+					  "(domain not stripped)", name));
76e38b
 			err = -ENOENT;
76e38b
+		}
76e38b
 		if (err == -ERANGE) {
76e38b
 			buflen *= 2;
76e38b
 			free(buf);
76e38b
@@ -260,10 +351,28 @@ static int nss_name_to_gid(char *name, g
76e38b
 	if (err)
76e38b
 		goto out_buf;
76e38b
 	*gid = gr->gr_gid;
76e38b
+	IDMAP_LOG(4, ("nss_name_to_gid: name '%s' gid %u", name, *gid));
76e38b
 out_buf:
76e38b
 	free(buf);
76e38b
 out_name:
76e38b
-	free(localname);
76e38b
+	if (dostrip)
76e38b
+		free(localname);
76e38b
+	if (reformat_group)
76e38b
+		free(ref_name);
76e38b
+out:
76e38b
+	return err;
76e38b
+}
76e38b
+
76e38b
+static int nss_name_to_gid(char *name, gid_t *gid)
76e38b
+{
76e38b
+	int err = 0;
76e38b
+
76e38b
+	if (no_strip & IDTYPE_GROUP) {
76e38b
+		err = _nss_name_to_gid(name, gid, 0);
76e38b
+		if (!err)
76e38b
+			goto out;
76e38b
+	}
76e38b
+	err = _nss_name_to_gid(name, gid, 1);
76e38b
 out:
76e38b
 	return err;
76e38b
 }
76e38b
@@ -306,7 +415,7 @@ static int nss_gss_princ_to_ids(char *se
76e38b
 		return -ENOENT;
76e38b
 	}
76e38b
 	/* XXX: this should call something like getgssauthnam instead? */
76e38b
-	pw = nss_getpwnam(princ, NULL, &err;;
76e38b
+	pw = nss_getpwnam(princ, NULL, &err, 0);
76e38b
 	if (pw == NULL) {
76e38b
 		err = -ENOENT;
76e38b
 		goto out;
76e38b
@@ -329,7 +438,7 @@ int nss_gss_princ_to_grouplist(char *sec
76e38b
 		goto out;
76e38b
 	/* XXX: not quite right?  Need to know default realm? */
76e38b
 	/* XXX: this should call something like getgssauthnam instead? */
76e38b
-	pw = nss_getpwnam(princ, NULL, &ret;;
76e38b
+	pw = nss_getpwnam(princ, NULL, &ret, 0);
76e38b
 	if (pw == NULL) {
76e38b
 		ret = -ENOENT;
76e38b
 		goto out;