multiple-local-realms-20051208

This patch extends the krb.conf file allowing the specification of
multiple realms which should be treated as equivalents to the local
cell authentication domain.  Additional realms are specified on the
first line of the krb.conf file and are separated by white space.

In addition, the patch adds a new file stored in the same directory
as the krb.conf file called krb.excl.  This file contains a list of
principal names, one per line, that must not be treated as local
identities.

The purpose of this patch is to allow organizations that are supporting
multiple realms with synchronized user principal databases to allow
their users to login with any of the realms and treat the principal
names as equivalent to the local PTS identity.   The exclusion is
to allow certain names, such as those for administrative IDs, to be
restricted to a subset of the realms.

Further optimization of the afs_krb_exclusion() should be performed to
remove the need to re-read the file.  This patch should be considered
a temporary solution until a more permanent set of extensions to the
PT database and RPCs allow for the assignment of mechanism specific
aliases for PT IDs.

====================
This delta was composed from multiple commits as part of the CVS->Git migration.
The checkin message with each commit was inconsistent.
The following are the additional commit messages.
====================

correction to exclusion list parsing

diff --git a/src/audit/audit.c b/src/audit/audit.c
index aeea18567ffefa5e6d211aabc3c6ffb35ec1a6a7..7fe3f9a791442440fbd3e485526118a0d64d680c 100644 (file)
--- a/src/audit/audit.c
+++ b/src/audit/audit.c
@@ -420,12 +420,43 @@ osi_auditU(struct rx_call *call, char *audEvent, int errCode, ...)
                     }
                     if ((clen = strlen(tcell))) {
 #if defined(AFS_ATHENA_STDENV) || defined(AFS_KERBREALM_ENV)
-                        static char local_realm[AFS_REALM_SZ] = "";
-                        if (!local_realm[0]) {
-                            if (afs_krb_get_lrealm(local_realm, 0) != 0 /*KSUCCESS*/)
-                                strncpy(local_realm, "UNKNOWN.LOCAL.REALM", AFS_REALM_SZ);
+                        static char local_realms[AFS_NUM_LREALMS][AFS_REALM_SZ];
+                       static int  num_lrealms = -1;
+                       int i, lrealm_match;
+
+                       if (num_lrealms == -1) {
+                           for (i=0; i<AFS_NUM_LREALMS; i++) {
+                               if (afs_krb_get_lrealm(local_realms[i], i) != 0 /*KSUCCESS*/)
+                                   break;
+                           }
+
+                           if (i=0)
+                               strncpy(local_realms[0], "UNKNOWN.LOCAL.REALM", AFS_REALM_SZ);
+                           num_lrealms = i;
                         }
-                        if (strcasecmp(local_realm, tcell)) {
+
+                       /* Check to see if the ticket cell matches one of the local realms */
+                       lrealm_match = 0;
+                       for ( i=0;i<num_lrealms;i++ ) {
+                           if (!strcasecmp(local_realms[i], tcell)) {
+                               lrealm_match = 1;
+                               break;
+                           }
+                       }
+                       /* If yes, then make sure that the name is not present in 
+                        * an exclusion list */
+                       if (lrealm_match) {
+                           char uname[256];
+                           if (inst[0])
+                               snprintf(uname,sizeof(uname),"%s.%s@%s",name,inst,tcell);
+                           else
+                               snprintf(uname,sizeof(uname),"%s@%s",name,tcell);
+
+                           if (afs_krb_exclusion(uname))
+                               lrealm_match = 0;
+                       }
+
+                       if (!lrealm_match) {    
                             if (strlen(vname) + 1 + clen >= sizeof(vname))
                                 goto done;
                             strcat(vname, "@");

diff --git a/src/auth/userok.c b/src/auth/userok.c
index 09da2e070856d841917eed8359fdd4c93a10e0fc..b37385f0aac7aaa557eb57e3b35e337efeb5f107 100644 (file)
--- a/src/auth/userok.c
+++ b/src/auth/userok.c
@@ -403,7 +403,9 @@ afsconf_SuperUser(adir, acall, namep)
 
        afs_uint32 exp;
        static char lcell[MAXCELLCHARS] = "";
-       static char lrealm[AFS_REALM_SZ] = "";
+       static char lrealms[AFS_NUM_LREALMS][AFS_REALM_SZ];
+       static int  num_lrealms = -1;
+       int lrealm_match = 0, i;
 
        /* get auth details from server connection */
        code =
@@ -440,11 +442,40 @@ afsconf_SuperUser(adir, acall, namep)
        /* if running a krb environment, also get the local realm */
        /* note - this assumes AFS_REALM_SZ <= MAXCELLCHARS */
        /* just set it to lcell if it fails */
-       if (!lrealm[0]) {
-           if (afs_krb_get_lrealm(lrealm, 0) != 0)     /* KSUCCESS */
-               strncpy(lrealm, lcell, AFS_REALM_SZ);
+       if (num_lrealms == -1) {
+           for (i=0; i<AFS_NUM_LREALMS; i++) {
+               if (afs_krb_get_lrealm(lrealms[i], i) != 0 /*KSUCCESS*/)
+                   break;
+           }
+
+           if (i=0) {
+               strncpy(lrealms[0], lcell, AFS_REALM_SZ);
+               num_lrealms = 1;
+           } else {
+               num_lrealms = i;
+           }
        }
 
+       /* See if the ticket cell matches one of the local realms */
+       lrealm_match = 0;
+       for ( i=0;i<num_lrealms;i++ ) {
+           if (!strcasecmp(lrealms[i], tcell)) {
+               lrealm_match = 1;
+               break;
+           }
+       }
+
+       /* If yes, then make sure that the name is not present in 
+        * an exclusion list */
+       if (lrealm_match) {
+           if (tinst[0])
+               snprintf(uname,sizeof(uname),"%s.%s@%s",tname,tinst,tcell);
+           else
+               snprintf(uname,sizeof(uname),"%s@%s",tname,tcell);
+
+           if (afs_krb_exclusion(uname))
+               lrealm_match = 0;
+       }
 
        /* start with no uname and no authorization */
        strcpy(uname, "");
@@ -456,8 +487,8 @@ afsconf_SuperUser(adir, acall, namep)
            strcpy(uname, "<LocalAuth>");
            flag = 1;
 
-           /* cell of connection matches local cell or krb4 realm */
-       } else if (!strcasecmp(tcell, lcell) || !strcasecmp(tcell, lrealm)) {
+           /* cell of connection matches local cell or one of the realms */
+       } else if (!strcasecmp(tcell, lcell) || lrealm_match) {
            if ((tmp = CompFindUser(adir, tname, ".", tinst, NULL))) {
                strcpy(uname, tmp);
                flag = 1;
@@ -467,7 +498,6 @@ afsconf_SuperUser(adir, acall, namep)
                flag = 1;
 #endif
            }
-
            /* cell of conn doesn't match local cell or realm */
        } else {
            if ((tmp = CompFindUser(adir, tname, ".", tinst, tcell))) {

diff --git a/src/config/afs_sysnames.h b/src/config/afs_sysnames.h
index b54fc4fef42528799c4b7c023e95e79d87ed860f..94c5076b4ee33bd3e3d170eda9137d501274c8aa 100644 (file)
--- a/src/config/afs_sysnames.h
+++ b/src/config/afs_sysnames.h
@@ -263,4 +263,6 @@
 #ifdef AFS_KERBREALM_ENV
 #define        AFS_REALM_SZ            64
 #endif
+/* Specifies the number of equivalent local realm names */
+#define AFS_NUM_LREALMS         4
 #endif /* __AFS_SYSNAMES_INCL_ENV_ */

diff --git a/src/libafsauthent/afsauthent.def b/src/libafsauthent/afsauthent.def
index a822985923ecc5e239da605c36e8ed3aa3a997f4..86f2437e3725a5864f5930b231e2fb1eef26bd4c 100644 (file)
--- a/src/libafsauthent/afsauthent.def
+++ b/src/libafsauthent/afsauthent.def
@@ -63,7 +63,7 @@ EXPORTS
        pr_GetCPS                                       @62
        pr_Initialize                                   @63
        pr_GetHostCPS                                   @64
-       afs_krb_get_lrealm                              @65
+;      afs_krb_get_lrealm                              @65
        pr_NameToId                                     @66
        pr_IdToName                                     @67
        afs_gettimeofday                                @68
@@ -78,8 +78,8 @@ EXPORTS
        pioctl                                          @77
        rx_Init                                         @78
        ka_UserAuthenticateGeneral2                     @79
-    pr_CreateUser                   @80
-    pr_SNameToId                    @81
+       pr_CreateUser                                   @80
+       pr_SNameToId                                    @81
 
 
        DISK_function_names                             @83 DATA

diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c
index cb006e6ea994e588f64c7539d003cedee3ae2f5a..fd031b97c9441eed48d57f1890a4a9c8701df903 100644 (file)
--- a/src/ptserver/ptprocs.c
+++ b/src/ptserver/ptprocs.c
@@ -93,6 +93,7 @@ extern struct ubik_dbase *dbase;
 extern afs_int32 Initdb();
 extern int pr_noAuth;
 extern afs_int32 initd;
+extern char *pr_realmName;
 afs_int32 iNewEntry(), newEntry(), whereIsIt(), dumpEntry(), addToGroup(),
 nameToID(), Delete(), removeFromGroup();
 afs_int32 getCPS(), getCPS2(), getHostCPS(), listMax(), setMax(), listEntry();
@@ -179,22 +180,9 @@ WhoIsThis(acall, at, aid)
        if (exp < FT_ApproxTime())
            goto done;
 #endif
-       if (strlen(tcell)) {
-           extern char *pr_realmName;
-#if    defined(AFS_ATHENA_STDENV) || defined(AFS_KERBREALM_ENV)
-           static char local_realm[AFS_REALM_SZ] = "";
-           if (!local_realm[0]) {
-               if (afs_krb_get_lrealm(local_realm, 0) != 0 /*KSUCCESS*/)
-                   strncpy(local_realm, pr_realmName, AFS_REALM_SZ);
-           }
-#endif
-           if (
-#if    defined(AFS_ATHENA_STDENV) || defined(AFS_KERBREALM_ENV)
-                  strcasecmp(local_realm, tcell) &&
-#endif
-                  strcasecmp(pr_realmName, tcell))
-               foreign = 1;
-       }
+       if (tcell[0])
+           foreign = afs_is_foreign_ticket_name(tcell,name,inst,pr_realmName);
+
        strncpy(vname, name, sizeof(vname));
        if (ilen = strlen(inst)) {
            if (strlen(vname) + 1 + ilen >= sizeof(vname))
@@ -2295,7 +2283,6 @@ addWildCards(tt, alist, host)
 }
 #endif /* IP_WILDCARDS */
 
-
 afs_int32
 WhoIsThisWithName(acall, at, aid, aname)
      struct rx_call *acall;
@@ -2323,11 +2310,12 @@ WhoIsThisWithName(acall, at, aid, aname)
     } else if (code == 2) {    /* kad class */
 
        int clen;
-       extern char *pr_realmName;
 
        if ((code = rxkad_GetServerInfo(acall->conn, NULL, 0 /*was &exp */ ,
                                        name, inst, tcell, NULL)))
            goto done;
+
+
        strncpy(vname, name, sizeof(vname));
        if ((ilen = strlen(inst))) {
            if (strlen(vname) + 1 + ilen >= sizeof(vname))
@@ -2336,19 +2324,9 @@ WhoIsThisWithName(acall, at, aid, aname)
            strcat(vname, inst);
        }
        if ((clen = strlen(tcell))) {
+           int foreign = afs_is_foreign_ticket_name(tcell,name,inst,pr_realmName);
 
-#if    defined(AFS_ATHENA_STDENV) || defined(AFS_KERBREALM_ENV)
-           static char local_realm[AFS_REALM_SZ] = "";
-           if (!local_realm[0]) {
-               if (afs_krb_get_lrealm(local_realm, 0) != 0 /*KSUCCESS*/)
-                   strncpy(local_realm, pr_realmName, AFS_REALM_SZ);
-           }
-#endif
-           if (
-#if    defined(AFS_ATHENA_STDENV) || defined(AFS_KERBREALM_ENV)
-                  strcasecmp(local_realm, tcell) &&
-#endif
-                  strcasecmp(pr_realmName, tcell)) {
+           if (foreign) {
                if (strlen(vname) + 1 + clen >= sizeof(vname))
                    goto done;
                strcat(vname, "@");

diff --git a/src/util/afsutil_prototypes.h b/src/util/afsutil_prototypes.h
index fbfc35f4068b6d904918fdf8489dafa360406f41..a3151fc25492d1bd9340723894083b0e21486510 100644 (file)
--- a/src/util/afsutil_prototypes.h
+++ b/src/util/afsutil_prototypes.h
@@ -74,7 +74,8 @@ extern int64_t flipbase64_to_int64(char *s);
 
 /* get_krbrlm.c */
 extern int afs_krb_get_lrealm(char *r, int n);
-
+extern int afs_krb_exclusion(char *name);
+extern int afs_is_foreign_ticket_name(char *tcell, char *tname, char *tinst, char *localrealm);
 /* hostparse.c */
 extern struct hostent *hostutil_GetHostByName(register char *ahost);
 extern char *hostutil_GetNameByINet(afs_uint32 addr);

diff --git a/src/util/dirpath.c b/src/util/dirpath.c
index 82e89b70c8ffec3e14c9bafecc1f44c433d51872..ff856f9523b1642cea05524e9db0be1ff4fe2882 100644 (file)
--- a/src/util/dirpath.c
+++ b/src/util/dirpath.c
@@ -365,6 +365,8 @@ initDirPathArray(void)
     pathp = dirPathArray[AFSDIR_SERVER_MIGRATELOG_FILEPATH_ID];
     AFSDIR_SERVER_FILEPATH(pathp, AFSDIR_MIGR_DIR, AFSDIR_MIGRATE_LOGNAME);
 
+    pathp = dirPathArray[AFSDIR_SERVER_KRB_EXCL_FILEPATH_ID];
+    AFSDIR_SERVER_FILEPATH(pathp, AFSDIR_SERVER_ETC_DIR, AFSDIR_KRB_EXCL_FILE);
 
     /* client file paths */
 #ifdef AFS_NT40_ENV

diff --git a/src/util/dirpath_nt.h b/src/util/dirpath_nt.h
index 230e0629d28a1a7c57f3684dcea5bacf185ab574..b0c62bc392ec06fb0b5fd813c86a45982db9ce81 100644 (file)
--- a/src/util/dirpath_nt.h
+++ b/src/util/dirpath_nt.h
@@ -135,6 +135,7 @@ extern int
 #define AFSDIR_BOSVR_FILE       "bosserver"
 #define AFSDIR_VOLSERLOG_FILE   "VolserLog"
 #define AFSDIR_AUDIT_FILE       "Audit"
+#define AFSDIR_KRB_EXCL_FILE    "krb.excl"
 
 #define AFSDIR_ROOTVOL_FILE     "RootVolume"
 #define AFSDIR_HOSTDUMP_FILE    "hosts.dump"
@@ -257,6 +258,7 @@ typedef enum afsdir_id {
     AFSDIR_SERVER_MIGRATELOG_FILEPATH_ID,
     AFSDIR_SERVER_BIN_FILE_DIRPATH_ID,
     AFSDIR_CLIENT_CELLALIAS_FILEPATH_ID,
+    AFSDIR_SERVER_KRB_EXCL_FILEPATH_ID,
     AFSDIR_PATHSTRING_MAX
 } afsdir_id_t;
 
@@ -325,6 +327,7 @@ const char *getDirPath(afsdir_id_t string_id);
 #define AFSDIR_SERVER_WEIGHTING_CONSTANTS_FILEPATH getDirPath(AFSDIR_SERVER_WEIGHTING_CONSTANTS_FILEPATH_ID)
 #define AFSDIR_SERVER_THRESHOLD_CONSTANTS_FILEPATH getDirPath(AFSDIR_SERVER_THRESHOLD_CONSTANTS_FILEPATH_ID)
 #define AFSDIR_SERVER_MIGRATELOG_FILEPATH getDirPath(AFSDIR_SERVER_MIGRATELOG_FILEPATH_ID)
+#define AFSDIR_SERVER_KRB_EXCL_FILEPATH getDirPath(AFSDIR_SERVER_KRB_EXCL_FILEPATH_ID)
 
 /* client file paths */
 #define AFSDIR_CLIENT_THISCELL_FILEPATH getDirPath(AFSDIR_CLIENT_THISCELL_FILEPATH_ID)

diff --git a/src/util/get_krbrlm.c b/src/util/get_krbrlm.c
index 0c6769a1270e3dd84dcb67fdfb0c7b1164718d05..b707954bdc327b45ab8099fd72365158f09e1618 100644 (file)
--- a/src/util/get_krbrlm.c
+++ b/src/util/get_krbrlm.c
@@ -26,21 +26,148 @@ RCSID
 #define        KSUCCESS        0
 #define        KFAILURE        (-1)
 
+static char *
+parse_str(char *buffer, char *result, int size)
+{
+    int n=0;
+
+    if (!buffer)
+        goto cleanup;
+
+    while (*buffer && isspace(*buffer))
+        buffer++;
+    while (*buffer && !isspace(*buffer)) {
+       if (n < size - 1) {
+           *result++=*buffer++;
+           n++;
+       } else {
+           buffer++;
+       }
+    }
+
+  cleanup:
+    *result='\0';
+    return buffer;
+}
+
+
 int
 afs_krb_get_lrealm(char *r, int n)
 {
+    char linebuf[2048];
+    char tr[AFS_REALM_SZ] = "";
+    char *p;
     FILE *cnffile/*, *fopen()*/;
+    int i;
+    int rv = KFAILURE;
 
-    if (n > 1)
-       return (KFAILURE);      /* Temporary restriction */
+    *r = '\0';
 
     if ((cnffile = fopen(AFSDIR_SERVER_KCONF_FILEPATH, "r")) == NULL) {
        return (KFAILURE);
     }
-    if (fscanf(cnffile, "%s", r) != 1) {
-       (void)fclose(cnffile);
-       return (KFAILURE);
+    if (fgets(linebuf, sizeof(linebuf)-1, cnffile) == NULL) {
+       goto cleanup;
+    }
+    linebuf[sizeof(linebuf)-1] = '\0';
+    for (i=0, p=linebuf; i<=n && *p; i++) {
+        p = parse_str(p, tr, AFS_REALM_SZ);
     }
+
+    if (*tr) {
+       strcpy(r,tr);
+       rv = KSUCCESS;
+    }
+
+  cleanup:
     (void)fclose(cnffile);
-    return (KSUCCESS);
+    return rv;
 }
+
+int
+afs_krb_exclusion(char * name)
+{
+    char linebuf[2048];
+    char excl_name[256] = "";
+    FILE *cnffile/*, *fopen()*/;
+    int exclude = 0;
+
+    if ((cnffile = fopen(AFSDIR_SERVER_KRB_EXCL_FILEPATH, "r")) == NULL)
+       return exclude;
+
+    for (;;) {
+       if (fgets(linebuf, sizeof(linebuf)-1, cnffile) == NULL) {
+           goto cleanup;
+       }
+       linebuf[sizeof(linebuf)-1] = '\0';
+        parse_str(linebuf, excl_name, sizeof(excl_name));
+
+       if (!strcmp(name,excl_name)) {
+           exclude = 1;
+           break;
+       }
+    }
+
+  cleanup:
+    (void)fclose(cnffile);
+    return exclude;
+}
+
+int 
+afs_is_foreign_ticket_name(char *tcell, char *tname, char *tinst, char *localrealm)
+{
+    int foreign = 0;
+
+    if (localrealm && strcasecmp(localrealm, tcell))
+       foreign = 1;
+
+#if    defined(AFS_ATHENA_STDENV) || defined(AFS_KERBREALM_ENV)
+    if (!foreign) {
+       static char local_realms[AFS_NUM_LREALMS][AFS_REALM_SZ];
+       static int  num_lrealms = -1;
+       int lrealm_match, i;
+       char uname[256];
+
+       if (num_lrealms == -1) {
+           for (i=0; i<AFS_NUM_LREALMS; i++) {
+               if (afs_krb_get_lrealm(local_realms[i], i) != 0 /*KSUCCESS*/)
+                   break;
+           }
+
+           if (i=0 && localrealm) {
+               strncpy(local_realms[0], localrealm, AFS_REALM_SZ);
+               num_lrealms = 1;
+           } else {
+               num_lrealms = i;
+           }
+       }
+
+       /* See if the ticket cell matches one of the local realms */
+       lrealm_match = 0;
+       for ( i=0;i<num_lrealms;i++ ) {
+           if (!strcasecmp(local_realms[i], tcell)) {
+               lrealm_match = 1;
+               break;
+           }
+       }
+
+       /* If yes, then make sure that the name is not present in 
+        * an exclusion list */
+       if (lrealm_match) {
+           if (tinst[0])
+               snprintf(uname,sizeof(uname),"%s.%s@%s",tname,tinst,tcell);
+           else
+               snprintf(uname,sizeof(uname),"%s@%s",tname,tcell);
+
+           if (afs_krb_exclusion(uname))
+               lrealm_match = 0;
+       }
+
+       foreign = !lrealm_match;
+    }
+#endif
+    return foreign;
+}
+
+
+

diff --git a/src/util/test/dirpath_test.c b/src/util/test/dirpath_test.c
index 1bf1405203f26e8fc9faa2e94d3e7b3a0016d089..b0584b72b989ccbf2f7c3f03bd122e479fa05ef7 100644 (file)
--- a/src/util/test/dirpath_test.c
+++ b/src/util/test/dirpath_test.c
@@ -124,6 +124,8 @@ main(int argc, char *argv[])
           AFSDIR_SERVER_FILELOG_FILEPATH);
     printf("AFSDIR_SERVER_AUDIT_FILEPATH = %s\n",
           AFSDIR_SERVER_AUDIT_FILEPATH);
+    printf("AFSDIR_SERVER_KRB_EXCL_FILEPATH  = %s\n",
+          AFSDIR_SERVER_KRB_EXCL_FILEPATH);
     printf("\n");
     printf("\n");
     printf("AFSDIR_CLIENT_THISCELL_FILEPATH = %s\n",

diff --git a/src/viced/host.c b/src/viced/host.c
index c768188eeae28c649484c1c28f4823399032573a..6b7eb809226f080c80255f1031b07eb24c80524f 100644 (file)
--- a/src/viced/host.c
+++ b/src/viced/host.c
@@ -1348,20 +1348,34 @@ h_GetHost_r(struct rx_connection *tcon)
 
 
 static char localcellname[PR_MAXNAMELEN + 1];
-char local_realm[AFS_REALM_SZ] = "";
+char local_realms[AFS_NUM_LREALMS][AFS_REALM_SZ];
+int  num_lrealms = -1;
 
 /* not reentrant */
 void
 h_InitHostPackage()
 {
     afsconf_GetLocalCell(confDir, localcellname, PR_MAXNAMELEN);
-    if (!local_realm[0]) {
-       if (afs_krb_get_lrealm(local_realm, 0) != 0 /*KSUCCESS*/) {
+    if (num_lrealms == -1) {
+       int i;
+       for (i=0; i<AFS_NUM_LREALMS; i++) {
+           if (afs_krb_get_lrealm(local_realms[i], i) != 0 /*KSUCCESS*/)
+               break;
+       }
+
+       if (i=0) {
            ViceLog(0,
                    ("afs_krb_get_lrealm failed, using %s.\n",
                     localcellname));
-           strcpy(local_realm, localcellname);
+           strncpy(local_realms[0], localcellname, AFS_REALM_SZ);
+           num_lrealms = i =1;
+       } else {
+           num_lrealms = i;
        }
+
+       /* initialize the rest of the local realms to nullstring for debugging */
+       for (; i<AFS_NUM_LREALMS; i++)
+           local_realms[i][0] = '\0';
     }
     rxcon_ident_key = rx_KeyCreate((rx_destructor_t) free);
     rxcon_client_key = rx_KeyCreate((rx_destructor_t) 0);
@@ -1391,11 +1405,10 @@ MapName_r(char *aname, char *acell, afs_int32 * aval)
 
     cnamelen = strlen(acell);
     if (cnamelen) {
-       if (strcasecmp(local_realm, acell)
-           && strcasecmp(localcellname, acell)) {
+       if (afs_is_foreign_ticket_name(aname, "", acell, localcellname)) {
            ViceLog(2,
-                   ("MapName: cell is foreign.  cell=%s, localcell=%s, localrealm=%s\n",
-                    acell, localcellname, local_realm));
+                   ("MapName: cell is foreign.  cell=%s, localcell=%s, localrealms={%s,%s,%s,%s}\n",
+                   acell, localcellname, local_realms[0],local_realms[1],local_realms[2],local_realms[3]));
            if ((anamelen + cnamelen + 1) >= PR_MAXNAMELEN) {
                ViceLog(2,
                        ("MapName: Name too long, using AnonymousID for %s@%s\n",

diff --git a/src/viced/viced.c b/src/viced/viced.c
index 9d34351b282d6acdd1684afe4b428b6520e72a4e..517ccd5facd359775760dfef432f328d25851c8f 100644 (file)
--- a/src/viced/viced.c
+++ b/src/viced/viced.c
@@ -1052,7 +1052,8 @@ ParseArgs(int argc, char *argv[])
        else if (!strcmp(argv[i], "-nojumbo")) {
            rxJumbograms = 0;
        } else if (!strcmp(argv[i], "-realm")) {
-           extern char local_realm[AFS_REALM_SZ];
+           extern char local_realms[AFS_NUM_LREALMS][AFS_REALM_SZ];
+           extern int  num_lrealms;
            if ((i + 1) >= argc) {
                fprintf(stderr, "missing argument for -realm\n"); 
                return -1; 
@@ -1063,7 +1064,15 @@ ParseArgs(int argc, char *argv[])
                     AFS_REALM_SZ);
                return -1;
            }
-           strncpy(local_realm, argv[i], AFS_REALM_SZ);
+           if (num_lrealms == -1) 
+               num_lrealms = 0;
+           if (num_lrealms >= AFS_NUM_LREALMS) {
+               printf
+                   ("a maximum of %d -realm arguments can be specified.\n",
+                    AFS_NUM_LREALMS);
+               return -1;
+           }
+           strncpy(local_realms[num_lrealms++], argv[i], AFS_REALM_SZ);
        } else if (!strcmp(argv[i], "-udpsize")) {
            if ((i + 1) >= argc) {
                printf("You have to specify -udpsize <integer value>\n");