From bef34377525e4843fa1574a899f2e4a0933e37ed Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Tue, 23 May 2017 10:17:34 +0200
Subject: [ad/mountscript] Try more protocol versions, parallelize mounting

---
 data/ad/mountscript | 64 +++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 47 insertions(+), 17 deletions(-)

diff --git a/data/ad/mountscript b/data/ad/mountscript
index 25f04ea..03ac009 100644
--- a/data/ad/mountscript
+++ b/data/ad/mountscript
@@ -9,16 +9,28 @@ SEARCH=
 RESULT=
 REAL_ACCOUNT=
 WAIT=
+TMPDEL=
 if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
+	if which gawk &>/dev/null; then
+		un64() {
+			gawk 'BEGIN{FS=":: "}{c="base64 -d";if(/^\w+:: /) {print $2 |& c; close(c,"to"); c |& getline $2; close(c); printf("%s: %s\n", $1, $2); next} print $0 }'
+		}
+	else
+		un64() {
+			cat
+		}
+	fi
 	# determine fileserver and share for home directories
 	SEARCH=$(mktemp)
+	TMPDEL="$TMPDEL $SEARCH"
 	ldapsearch -l 3 -o nettimeout=3 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" dn distinguishedName homeMount realAccount > "${SEARCH}" 2>&1
-	BINDDN=$(cat "${SEARCH}" | grep -E '^(dn|distinguishedName):' | head -n 1 | cut -d ' ' -f 2-)
+	BINDDN=$(cat "${SEARCH}" | grep -E '^(dn|distinguishedName):' | un64 | head -n 1 | cut -d ' ' -f 2-)
 	if [ -z "$BINDDN" ]; then
 		slxlog "pam-ad-ldapquery" "Could not query DN of user ${PAM_USER}. No home directory available" "${SEARCH}"
 		WAIT=1
 	else
 		RESULT=$(mktemp)
+		TMPDEL="$TMPDEL $RESULT"
 		PW="/tmp/pw.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"
 		mkfifo -m 0600 "${PW}" || slxlog "pam-ad-fifo" "Could not create FIFO at ${PW}"
 		(
@@ -39,37 +51,55 @@ if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
 fi
 
 if [ -n "${VOLUME}" ]; then
+	isHomeMounted() {
+		grep -Fuq " ${PERSISTENT_HOME_DIR} " /proc/mounts
+	}
 	# Remember for hooks in pam_script_auth.d
 	export PERSISTENT_NETPATH=$(echo "$VOLUME" | tr '/' '\')
 
 	export USER="${REAL_ACCOUNT}"
 	export PASSWD="${PAM_AUTHTOK}"
 
-	echo '' > "${RESULT}"
-	for opt in "vers=1.0,sec=ntlm" "vers=3.0,sec=ntlm" "vers=1.0,sec=ntlmv2" "vers=3.0,sec=ntlmv2"; do
-		MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,${opt},nounix,file_mode=0700,dir_mode=0700"
-		/opt/openslx/bin/timeout -t 8 -s 9 /opt/openslx/bin/timeout -t 7 -s 15 mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" >> "${RESULT}" 2>&1
-		RETVAL=$?
-		[ "$RETVAL" = "0" ] && break
+	# We try 6 different mount option combinations; launch them in 1 second steps until one of them succeeds
+	CNT=0
+	PIDS=
+	for opt in "vers=3.0,sec=ntlmssp" "vers=2.1,sec=ntlmssp" "vers=1.0,sec=ntlm" "vers=3.0,sec=ntlmv2" "vers=1.0,sec=ntlmv2" "vers=3.0,sec=ntlm"; do
+		CNT=$(( CNT + 1 ))
+		FILEVAR="LOG$CNT"
+		FILE=$(mktemp)
+		eval "${FILEVAR}=$FILE"
+		TMPDEL="$TMPDEL $FILE"
+		MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,${opt},nounix,file_mode=0700,dir_mode=0700,noacl,nobrl"
+		echo " * Trying '$opt'" > "$FILE"
+		mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" >> "${FILE}" 2>&1 &
+		PID=$!
+		PIDS="$PIDS $PID" # Remember all PIDs
+		usleep 250000
+		kill -0 "$PID" && usleep 250000
+		kill -0 "$PID" && usleep 250000
+		kill -0 "$PID" && usleep 250000
+		isHomeMounted && break
 	done
 
-	if [ "$RETVAL" = "124" ] || [ "$RETVAL" = "137" ] || [ "$RETVAL" = "143" ]; then
-		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "${RESULT}"
-		WAIT=1
-	elif [ "$RETVAL" != "0" ]; then
-		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Exit code: ${RETVAL}, Args: ${MOUNT_OPTS})" "${RESULT}"
-		WAIT=1
+	while ! isHomeMounted && [ "$CNT" -lt 10 ] && kill -0 $PIDS; do # No quotes
+		sleep 1
+		CNT=$(( CNT + 1 ))
+	done
+	kill -9 $PIDS # Kill any leftovers; No quotes
+
+	if ! isHomeMounted; then
+		LOG_COMBINED=$(mktemp)
+		cat "$LOG1" "$LOG2" "$LOG3" "$LOG4" "$LOG5" "$LOG6" > "$LOG_COMBINED"
+		slxlog --delete "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed." "${LOG_COMBINED}"
 	else
 		PERSISTENT_OK=yes
-		chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null
+		#chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null TODO: Still needed? Use & maybe?
 	fi
 
 	unset USER
 	unset PASSWD
 fi
 
-[ "$WAIT" = "1" ] && sleep 1
-[ -n "${RESULT}" ] && rm -f -- "${RESULT}"
-[ -n "${SEARCH}" ] && rm -f -- "${SEARCH}"
+[ -n "${TMPDEL}" ] && rm -f -- ${TMPDEL} # No quotes
 true
 
-- 
cgit v1.2.3-55-g7522