nfs-utils/SOURCES/nfs-utils-1.3.0-rpcgssd-debug.patch

diff -up nfs-utils-1.3.0/aclocal/libtirpc.m4.orig nfs-utils-1.3.0/aclocal/libtirpc.m4
--- nfs-utils-1.3.0/aclocal/libtirpc.m4.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/aclocal/libtirpc.m4	2016-04-15 11:42:49.532156526 -0400
@@ -2,61 +2,61 @@ dnl Checks for TI-RPC library and header
 dnl
 AC_DEFUN([AC_LIBTIRPC], [
 
+  AS_IF(
+    [test "$enable_tirpc" != "no"],
+    [PKG_CHECK_MODULES([TIRPC], [libtirpc],
+                      [LIBTIRPC="${TIRPC_LIBS}"
+                       AM_CPPFLAGS="${AM_CPPFLAGS} ${TIRPC_CFLAGS}"
+                       AC_DEFINE([HAVE_LIBTIRPC], [1],
+                                 [Define to 1 if you have and wish to use libtirpc.])],
+                      [AC_LIBTIRPC_OLD
+                       AS_IF([test "$enable_tirpc" = "yes" -a -z "${LIBTIRPC}"],
+                             [AC_MSG_ERROR([libtirpc not found.])])])])
+
+     AS_IF([test -n "${LIBTIRPC}"],
+           [AC_CHECK_LIB([tirpc], [authgss_free_private_data],
+                         [AC_DEFINE([HAVE_AUTHGSS_FREE_PRIVATE_DATA], [1],
+                                    [Define to 1 if your rpcsec library provides authgss_free_private_data])],,
+                         [${LIBS}])])
+
+     AS_IF([test -n "${LIBTIRPC}"],
+           [AC_CHECK_LIB([tirpc], [libtirpc_set_debug],
+                         [AC_DEFINE([HAVE_LIBTIRPC_SET_DEBUG], [1],
+                                    [Define to 1 if your tirpc library provides libtirpc_set_debug])],,
+                         [${LIBS}])])
+
+  AC_SUBST([AM_CPPFLAGS])
+  AC_SUBST(LIBTIRPC)
+
+])dnl
+
+dnl Old way of checking libtirpc without pkg-config
+dnl This can go away when virtually all libtirpc provide a .pc file
+dnl
+AC_DEFUN([AC_LIBTIRPC_OLD], [
+
   AC_ARG_WITH([tirpcinclude],
               [AC_HELP_STRING([--with-tirpcinclude=DIR],
                               [use TI-RPC headers in DIR])],
               [tirpc_header_dir=$withval],
               [tirpc_header_dir=/usr/include/tirpc])
 
-  dnl if --enable-tirpc was specifed, the following components
-  dnl must be present, and we set up HAVE_ macros for them.
-
-  if test "$enable_tirpc" != "no"; then
-
-    dnl look for the library
-    AC_CHECK_LIB([tirpc], [clnt_tli_create], [:],
-                 [if test "$enable_tirpc" = "yes"; then
-			AC_MSG_ERROR([libtirpc not found.])
-		  else
-			AC_MSG_WARN([libtirpc not found. TIRPC disabled!])
-			enable_tirpc="no"
-		  fi])
-  fi
-
-  if test "$enable_tirpc" != "no"; then
-
-    dnl Check if library contains authgss_free_private_data
-    AC_CHECK_LIB([tirpc], [authgss_free_private_data], [have_free_private_data=yes],
-			[have_free_private_data=no])
-  fi
-
-  if test "$enable_tirpc" != "no"; then
-    dnl also must have the headers installed where we expect
-    dnl look for headers; add -I compiler option if found
-    AC_CHECK_HEADERS([${tirpc_header_dir}/netconfig.h],
-    		      AC_SUBST([AM_CPPFLAGS], ["-I${tirpc_header_dir}"]),
-		      [if test "$enable_tirpc" = "yes"; then
-			 AC_MSG_ERROR([libtirpc headers not found.])
-		       else
-			 AC_MSG_WARN([libtirpc headers not found. TIRPC disabled!])
-			 enable_tirpc="no"
-		       fi])
-
-  fi
-
-  dnl now set $LIBTIRPC accordingly
-  if test "$enable_tirpc" != "no"; then
-    AC_DEFINE([HAVE_LIBTIRPC], 1,
-              [Define to 1 if you have and wish to use libtirpc.])
-    LIBTIRPC="-ltirpc"
-    if test "$have_free_private_data" = "yes"; then
-      AC_DEFINE([HAVE_AUTHGSS_FREE_PRIVATE_DATA], 1,
-	      [Define to 1 if your rpcsec library provides authgss_free_private_data,])
-    fi
-  else
-    LIBTIRPC=""
-  fi
-
-  AC_SUBST(LIBTIRPC)
+  dnl Look for the library
+  AC_CHECK_LIB([tirpc], [clnt_tli_create],
+               [has_libtirpc="yes"],
+               [has_libtirpc="no"])
+
+  dnl Also must have the headers installed where we expect
+  dnl to look for headers; add -I compiler option if found
+  AS_IF([test "$has_libtirpc" = "yes"],
+        [AC_CHECK_HEADERS([${tirpc_header_dir}/netconfig.h],
+                          [AC_SUBST([AM_CPPFLAGS], ["-I${tirpc_header_dir}"])],
+                          [has_libtirpc="no"])])
+
+  dnl Now set $LIBTIRPC accordingly
+  AS_IF([test "$has_libtirpc" = "yes"],
+        [AC_DEFINE([HAVE_LIBTIRPC], [1],
+                   [Define to 1 if you have and wish to use libtirpc.])
+         LIBTIRPC="-ltirpc"])
 
 ])dnl
diff -up nfs-utils-1.3.0/support/include/nfslib.h.orig nfs-utils-1.3.0/support/include/nfslib.h
--- nfs-utils-1.3.0/support/include/nfslib.h.orig	2016-04-15 11:42:13.930460892 -0400
+++ nfs-utils-1.3.0/support/include/nfslib.h	2016-04-15 11:42:38.365938345 -0400
@@ -17,6 +17,7 @@
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <stdio.h>
+#include <stdbool.h>
 #include <paths.h>
 #include <rpcsvc/nfs_prot.h>
 #include <nfs/nfs.h>
@@ -129,8 +130,8 @@ void			fendrmtabent(FILE *fp);
 void			frewindrmtabent(FILE *fp);
 
 /* mydaemon */
-void mydaemon(int nochdir, int noclose, int *pipefds);
-void release_parent(int *pipefds);
+void daemon_init(bool fg);
+void daemon_ready(void);
 
 /*
  * wildmat borrowed from INN
@@ -182,6 +183,9 @@ size_t  strlcpy(char *, const char *, si
 ssize_t atomicio(ssize_t (*f) (int, void*, size_t),
 		 int, void *, size_t);
 
+#ifdef HAVE_LIBTIRPC_SET_DEBUG
+void  libtirpc_set_debug(char *name, int level, int use_stderr);
+#endif
 
 #define UNUSED(x) UNUSED_ ## x __attribute__((unused))
 
diff -up nfs-utils-1.3.0/support/nfs/mydaemon.c.orig nfs-utils-1.3.0/support/nfs/mydaemon.c
--- nfs-utils-1.3.0/support/nfs/mydaemon.c.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/support/nfs/mydaemon.c	2016-04-15 11:42:38.366938365 -0400
@@ -46,56 +46,61 @@
 #include <errno.h>
 #include <unistd.h>
 #include <stdio.h>
+#include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
 #include <xlog.h>
 
+#include "nfslib.h"
+
+static int pipefds[2] = { -1, -1};
+
 /**
- * mydaemon - daemonize, but have parent wait to exit
- * @nochdir:	skip chdir()'ing the child to / after forking if true
- * @noclose:	skip closing stdin/stdout/stderr if true
- * @pipefds:	pointer to 2 element array of pipefds
+ * daemon_init - initial daemon setup
+ * @fg:		whether to run in the foreground
  *
  * This function is like daemon(), but with our own special sauce to delay
  * the exit of the parent until the child is set up properly. A pipe is created
  * between parent and child. The parent process will wait to exit until the
- * child dies or writes a '1' on the pipe signaling that it started
- * successfully.
+ * child dies or writes an int on the pipe signaling its status.
  */
 void
-mydaemon(int nochdir, int noclose, int *pipefds)
+daemon_init(bool fg)
 {
 	int pid, status, tempfd;
 
+	if (fg)
+		return;
+
 	if (pipe(pipefds) < 0) {
 		xlog_err("mydaemon: pipe() failed: errno %d (%s)\n",
 			 errno, strerror(errno));
-		exit(1);
+		exit(EXIT_FAILURE);
 	}
-	if ((pid = fork ()) < 0) {
+
+	pid = fork();
+	if (pid < 0) {
 		xlog_err("mydaemon: fork() failed: errno %d (%s)\n",
 			 errno, strerror(errno));
-		exit(1);
+		exit(EXIT_FAILURE);
 	}
 
-	if (pid != 0) {
-		/*
-		 * Parent. Wait for status from child.
-		 */
+	if (pid > 0) {
+		/* Parent */
 		close(pipefds[1]);
-		if (read(pipefds[0], &status, 1) != 1)
-			exit(1);
-		exit (0);
+		if (read(pipefds[0], &status, sizeof(status)) != sizeof(status))
+			exit(EXIT_FAILURE);
+		exit(status);
 	}
-	/* Child.	*/
+
+	/* Child */
 	close(pipefds[0]);
 	setsid ();
-	if (nochdir == 0) {
-		if (chdir ("/") == -1) {
-			xlog_err("mydaemon: chdir() failed: errno %d (%s)\n",
-				 errno, strerror(errno));
-			exit(1);
-		}
+
+	if (chdir ("/")) {
+		xlog_err("mydaemon: chdir() failed: errno %d (%s)\n",
+			 errno, strerror(errno));
+		exit(EXIT_FAILURE);
 	}
 
 	while (pipefds[1] <= 2) {
@@ -103,41 +108,39 @@ mydaemon(int nochdir, int noclose, int *
 		if (pipefds[1] < 0) {
 			xlog_err("mydaemon: dup() failed: errno %d (%s)\n",
 				 errno, strerror(errno));
-			exit(1);
+			exit(EXIT_FAILURE);
 		}
 	}
 
-	if (noclose == 0) {
-		tempfd = open("/dev/null", O_RDWR);
-		if (tempfd >= 0) {
-			dup2(tempfd, 0);
-			dup2(tempfd, 1);
-			dup2(tempfd, 2);
-			close(tempfd);
-		} else {
-			xlog_err("mydaemon: can't open /dev/null: errno %d "
-				 "(%s)\n", errno, strerror(errno));
-			exit(1);
-		}
+	tempfd = open("/dev/null", O_RDWR);
+	if (tempfd < 0) {
+		xlog_err("mydaemon: can't open /dev/null: errno %d "
+			 "(%s)\n", errno, strerror(errno));
+		exit(EXIT_FAILURE);
 	}
 
-	return;
+	dup2(tempfd, 0);
+	dup2(tempfd, 1);
+	dup2(tempfd, 2);
+	closelog();
+	dup2(pipefds[1], 3);
+	pipefds[1] = 3;
+	closeall(4);
 }
 
 /**
- * release_parent - tell the parent that it can exit now
- * @pipefds:	pipefd array that was previously passed to mydaemon()
+ * daemon_ready - tell interested parties that the daemon is ready
  *
- * This function tells the parent process of mydaemon() that it's now clear
- * to exit(0).
+ * This function tells e.g. the parent process that the daemon is up
+ * and running.
  */
 void
-release_parent(int *pipefds)
+daemon_ready(void)
 {
-	int status;
+	int status = 0;
 
 	if (pipefds[1] > 0) {
-		if (write(pipefds[1], &status, 1) != 1) {
+		if (write(pipefds[1], &status, sizeof(status)) != sizeof(status)) {
 			xlog_err("WARN: writing to parent pipe failed: errno "
 				 "%d (%s)\n", errno, strerror(errno));
 		}
diff -up nfs-utils-1.3.0/support/nfs/svc_create.c.orig nfs-utils-1.3.0/support/nfs/svc_create.c
--- nfs-utils-1.3.0/support/nfs/svc_create.c.orig	2016-04-15 11:42:13.931460911 -0400
+++ nfs-utils-1.3.0/support/nfs/svc_create.c	2016-04-15 11:42:38.366938365 -0400
@@ -133,7 +133,7 @@ svc_create_bindaddr(struct netconfig *nc
 		hint.ai_family = AF_INET6;
 #endif	/* IPV6_SUPPORTED */
 	else {
-		xlog(D_GENERAL, "Unrecognized bind address family: %s",
+		xlog(L_ERROR, "Unrecognized bind address family: %s",
 			nconf->nc_protofmly);
 		return NULL;
 	}
@@ -143,7 +143,7 @@ svc_create_bindaddr(struct netconfig *nc
 	else if (strcmp(nconf->nc_proto, NC_TCP) == 0)
 		hint.ai_protocol = (int)IPPROTO_TCP;
 	else {
-		xlog(D_GENERAL, "Unrecognized bind address protocol: %s",
+		xlog(L_ERROR, "Unrecognized bind address protocol: %s",
 			nconf->nc_proto);
 		return NULL;
 	}
@@ -275,7 +275,7 @@ svc_create_nconf_rand_port(const char *n
 	xprt = svc_tli_create(RPC_ANYFD, nconf, &bindaddr, 0, 0);
 	freeaddrinfo(ai);
 	if (xprt == NULL) {
-		xlog(D_GENERAL, "Failed to create listener xprt "
+		xlog(L_ERROR, "Failed to create listener xprt "
 			"(%s, %u, %s)", name, version, nconf->nc_netid);
 		return 0;
 	}
@@ -286,10 +286,12 @@ svc_create_nconf_rand_port(const char *n
 		return 0;
 	}
 
+	rpc_createerr.cf_stat = rpc_createerr.cf_error.re_errno = 0;
 	if (!svc_reg(xprt, program, version, dispatch, nconf)) {
 		/* svc_reg(3) destroys @xprt in this case */
-		xlog(D_GENERAL, "Failed to register (%s, %u, %s)",
-				name, version, nconf->nc_netid);
+		xlog(L_ERROR, "Failed to register (%s, %u, %s): %s",
+				name, version, nconf->nc_netid, 
+				clnt_spcreateerror("svc_reg() err"));
 		return 0;
 	}
 
diff -up nfs-utils-1.3.0/support/nfs/svc_socket.c.orig nfs-utils-1.3.0/support/nfs/svc_socket.c
--- nfs-utils-1.3.0/support/nfs/svc_socket.c.orig	2016-04-15 11:42:13.931460911 -0400
+++ nfs-utils-1.3.0/support/nfs/svc_socket.c	2016-04-15 11:42:38.367938385 -0400
@@ -24,6 +24,7 @@
 #include <sys/socket.h>
 #include <sys/fcntl.h>
 #include <errno.h>
+#include "xlog.h"
 
 #ifdef _LIBC
 # include <libintl.h>
@@ -90,9 +91,9 @@ svcsock_nonblock(int sock)
 	 * connection.
 	 */
 	if ((flags = fcntl(sock, F_GETFL)) < 0)
-		perror(_("svc_socket: can't get socket flags"));
+		xlog(L_ERROR, "svc_socket: can't get socket flags: %m");
 	else if (fcntl(sock, F_SETFL, flags|O_NONBLOCK) < 0)
-		perror(_("svc_socket: can't set socket flags"));
+		xlog(L_ERROR, "svc_socket: can't set socket flags: %m");
 	else
 		return sock;
 
@@ -110,7 +111,7 @@ svc_socket (u_long number, int type, int
 
   if ((sock = __socket (AF_INET, type, protocol)) < 0)
     {
-      perror (_("svc_socket: socket creation problem"));
+      xlog(L_ERROR, "svc_socket: socket creation problem: %m");
       return sock;
     }
 
@@ -121,7 +122,7 @@ svc_socket (u_long number, int type, int
 			sizeof (ret));
       if (ret < 0)
 	{
-	  perror (_("svc_socket: socket reuse problem"));
+	  xlog(L_ERROR, "svc_socket: socket reuse problem: %m");
 	  return ret;
 	}
     }
@@ -132,7 +133,7 @@ svc_socket (u_long number, int type, int
 
   if (bind(sock, (struct sockaddr *) &addr, len) < 0)
     {
-      perror (_("svc_socket: bind problem"));
+      xlog(L_ERROR, "svc_socket: bind problem: %m");
       (void) __close(sock);
       sock = -1;
     }
diff -up nfs-utils-1.3.0/utils/gssd/context_heimdal.c.orig nfs-utils-1.3.0/utils/gssd/context_heimdal.c
--- nfs-utils-1.3.0/utils/gssd/context_heimdal.c.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/utils/gssd/context_heimdal.c	2016-04-15 11:42:38.367938385 -0400
@@ -260,7 +260,7 @@ serialize_krb5_ctx(gss_ctx_id_t *_ctx, g
 	if (write_heimdal_seq_key(&p, end, ctx)) goto out_err;
 
 	buf->length = p - (char *)buf->value;
-	printerr(2, "serialize_krb5_ctx: returning buffer "
+	printerr(4, "serialize_krb5_ctx: returning buffer "
 		    "with %d bytes\n", buf->length);
 
 	return 0;
diff -up nfs-utils-1.3.0/utils/gssd/context_lucid.c.orig nfs-utils-1.3.0/utils/gssd/context_lucid.c
--- nfs-utils-1.3.0/utils/gssd/context_lucid.c.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/utils/gssd/context_lucid.c	2016-04-15 11:42:38.367938385 -0400
@@ -206,7 +206,7 @@ prepare_krb5_rfc4121_buffer(gss_krb5_luc
 	if (WRITE_BYTES(&p, end, lctx->send_seq)) goto out_err;
 
 	/* Protocol 0 here implies DES3 or RC4 */
-	printerr(2, "%s: protocol %d\n", __FUNCTION__, lctx->protocol);
+	printerr(4, "%s: protocol %d\n", __FUNCTION__, lctx->protocol);
 	if (lctx->protocol == 0) {
 		enctype = lctx->rfc1964_kd.ctx_key.type;
 		keysize = lctx->rfc1964_kd.ctx_key.length;
@@ -219,7 +219,7 @@ prepare_krb5_rfc4121_buffer(gss_krb5_luc
 			keysize = lctx->cfx_kd.ctx_key.length;
 		}
 	}
-	printerr(2, "%s: serializing key with enctype %d and size %d\n",
+	printerr(4, "%s: serializing key with enctype %d and size %d\n",
 		 __FUNCTION__, enctype, keysize);
 
 	if (WRITE_BYTES(&p, end, enctype)) goto out_err;
@@ -265,7 +265,7 @@ serialize_krb5_ctx(gss_ctx_id_t *ctx, gs
 	gss_krb5_lucid_context_v1_t *lctx = 0;
 	int retcode = 0;
 
-	printerr(2, "DEBUG: %s: lucid version!\n", __FUNCTION__);
+	printerr(4, "DEBUG: %s: lucid version!\n", __FUNCTION__);
 	maj_stat = gss_export_lucid_sec_context(&min_stat, ctx,
 						1, &return_ctx);
 	if (maj_stat != GSS_S_COMPLETE) {
diff -up nfs-utils-1.3.0/utils/gssd/gssd.c.orig nfs-utils-1.3.0/utils/gssd/gssd.c
--- nfs-utils-1.3.0/utils/gssd/gssd.c.orig	2016-04-15 11:42:13.917460638 -0400
+++ nfs-utils-1.3.0/utils/gssd/gssd.c	2016-04-15 11:42:38.369938424 -0400
@@ -1,7 +1,7 @@
 /*
   gssd.c
 
-  Copyright (c) 2000 The Regents of the University of Michigan.
+  Copyright (c) 2000, 2004 The Regents of the University of Michigan.
   All rights reserved.
 
   Copyright (c) 2000 Dug Song <dugsong@UMICH.EDU>.
@@ -40,9 +40,18 @@
 #include <config.h>
 #endif	/* HAVE_CONFIG_H */
 
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
 #include <sys/param.h>
 #include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <sys/inotify.h>
 #include <rpc/rpc.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
 
 #include <unistd.h>
 #include <err.h>
@@ -51,41 +60,684 @@
 #include <stdlib.h>
 #include <string.h>
 #include <signal.h>
+#include <memory.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <netdb.h>
+#include <event.h>
+
 #include "gssd.h"
 #include "err_util.h"
 #include "gss_util.h"
 #include "krb5_util.h"
 #include "nfslib.h"
 
-char pipefs_dir[PATH_MAX] = GSSD_PIPEFS_DIR;
-char keytabfile[PATH_MAX] = GSSD_DEFAULT_KEYTAB_FILE;
-char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR ":" GSSD_USER_CRED_DIR;
-char *ccachesearch[GSSD_MAX_CCACHE_SEARCH + 1];
+static char *pipefs_path = GSSD_PIPEFS_DIR;
+static DIR *pipefs_dir;
+static int pipefs_fd;
+static int inotify_fd;
+struct event inotify_ev;
+
+char *keytabfile = GSSD_DEFAULT_KEYTAB_FILE;
+char **ccachesearch;
 int  use_memcache = 0;
 int  root_uses_machine_creds = 1;
 unsigned int  context_timeout = 0;
 unsigned int  rpc_timeout = 5;
 char *preferred_realm = NULL;
-int pipefds[2] = { -1, -1 };
+/* Avoid DNS reverse lookups on server names */
+static bool avoid_dns = true;
+
+
+TAILQ_HEAD(topdir_list_head, topdir) topdir_list;
+
+struct topdir {
+	TAILQ_ENTRY(topdir) list;
+	TAILQ_HEAD(clnt_list_head, clnt_info) clnt_list;
+	int wd;
+	char name[];
+};
+
+/*
+ * topdir_list:
+ *	linked list of struct topdir with basic data about a topdir.
+ *
+ * clnt_list:
+ *      linked list of struct clnt_info with basic data about a clntXXX dir,
+ *      one per topdir.
+ *
+ * Directory structure: created by the kernel
+ *      {rpc_pipefs}/{topdir}/clntXX      : one per rpc_clnt struct in the kernel
+ *      {rpc_pipefs}/{topdir}/clntXX/krb5 : read uid for which kernel wants
+ *					    a context, write the resulting context
+ *      {rpc_pipefs}/{topdir}/clntXX/info : stores info such as server name
+ *      {rpc_pipefs}/{topdir}/clntXX/gssd : pipe for all gss mechanisms using
+ *					    a text-based string of parameters
+ *
+ * Algorithm:
+ *      Poll all {rpc_pipefs}/{topdir}/clntXX/YYYY files.  When data is ready,
+ *      read and process; performs rpcsec_gss context initialization protocol to
+ *      get a cred for that user.  Writes result to corresponding krb5 file
+ *      in a form the kernel code will understand.
+ *      In addition, we make sure we are notified whenever anything is
+ *      created or destroyed in {rpc_pipefs} or in any of the clntXX directories,
+ *      and rescan the whole {rpc_pipefs} when this happens.
+ */
+
+/*
+ * convert a presentation address string to a sockaddr_storage struct. Returns
+ * true on success or false on failure.
+ *
+ * Note that we do not populate the sin6_scope_id field here for IPv6 addrs.
+ * gssd nececessarily relies on hostname resolution and DNS AAAA records
+ * do not generally contain scope-id's. This means that GSSAPI auth really
+ * can't work with IPv6 link-local addresses.
+ *
+ * We *could* consider changing this if we did something like adopt the
+ * Microsoft "standard" of using the ipv6-literal.net domainname, but it's
+ * not really feasible at present.
+ */
+static bool
+gssd_addrstr_to_sockaddr(struct sockaddr *sa, const char *node, const char *port)
+{
+	int rc;
+	struct addrinfo *res;
+	struct addrinfo hints = { .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV };
+
+#ifndef IPV6_SUPPORTED
+	hints.ai_family = AF_INET;
+#endif /* IPV6_SUPPORTED */
+
+	rc = getaddrinfo(node, port, &hints, &res);
+	if (rc) {
+		printerr(0, "ERROR: unable to convert %s|%s to sockaddr: %s\n",
+			 node, port,
+			 rc == EAI_SYSTEM ? strerror(errno) : gai_strerror(rc));
+		return false;
+	}
+
+#ifdef IPV6_SUPPORTED
+	/*
+	 * getnameinfo ignores the scopeid. If the address turns out to have
+	 * a non-zero scopeid, we can't use it -- the resolved host might be
+	 * completely different from the one intended.
+	 */
+	if (res->ai_addr->sa_family == AF_INET6) {
+		struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)res->ai_addr;
+		if (sin6->sin6_scope_id) {
+			printerr(0, "ERROR: address %s has non-zero "
+				    "sin6_scope_id!\n", node);
+			freeaddrinfo(res);
+			return false;
+		}
+	}
+#endif /* IPV6_SUPPORTED */
+
+	memcpy(sa, res->ai_addr, res->ai_addrlen);
+	freeaddrinfo(res);
+	return true;
+}
+
+/*
+ * convert a sockaddr to a hostname
+ */
+static char *
+gssd_get_servername(const char *name, const struct sockaddr *sa, const char *addr)
+{
+	socklen_t		addrlen;
+	int			err;
+	char			hbuf[NI_MAXHOST];
+	unsigned char		buf[sizeof(struct in6_addr)];
+
+	while (avoid_dns) {
+		/*
+		 * Determine if this is a server name, or an IP address.
+		 * If it is an IP address, do the DNS lookup otherwise
+		 * skip the DNS lookup.
+		 */
+		if (strchr(name, '.') == NULL)
+			break; /* local name */
+		else if (inet_pton(AF_INET, name, buf) == 1)
+			break; /* IPv4 address */
+		else if (inet_pton(AF_INET6, name, buf) == 1)
+			break; /* IPv6 addrss */
+
+		return strdup(name);
+	}
+
+	switch (sa->sa_family) {
+	case AF_INET:
+		addrlen = sizeof(struct sockaddr_in);
+		break;
+#ifdef IPV6_SUPPORTED
+	case AF_INET6:
+		addrlen = sizeof(struct sockaddr_in6);
+		break;
+#endif /* IPV6_SUPPORTED */
+	default:
+		printerr(0, "ERROR: unrecognized addr family %d\n",
+			 sa->sa_family);
+		return NULL;
+	}
+
+	err = getnameinfo(sa, addrlen, hbuf, sizeof(hbuf), NULL, 0,
+			  NI_NAMEREQD);
+	if (err) {
+		printerr(0, "ERROR: unable to resolve %s to hostname: %s\n",
+			 addr, err == EAI_SYSTEM ? strerror(errno) :
+						   gai_strerror(err));
+		return NULL;
+	}
+
+	return strdup(hbuf);
+}
+
+static void
+gssd_read_service_info(int dirfd, struct clnt_info *clp)
+{
+	int fd;
+	FILE *info = NULL;
+	int numfields;
+	char *server = NULL;
+	char *service = NULL;
+	int program;
+	int version;
+	char *address = NULL;
+	char *protoname = NULL;
+	char *port = NULL;
+	char *servername = NULL;
+
+	fd = openat(dirfd, "info", O_RDONLY);
+	if (fd < 0) {
+		printerr(0, "ERROR: can't open %s/info: %s\n",
+			 clp->relpath, strerror(errno));
+		goto fail;
+	}
+
+	info = fdopen(fd, "r");
+	if (!info) {
+		printerr(0, "ERROR: can't fdopen %s/info: %s\n",
+			 clp->relpath, strerror(errno));
+		close(fd);
+		goto fail;
+	}
+
+	/*
+	 * Some history:
+	 *
+	 * The first three lines were added with rpc_pipefs in 2003-01-13.
+	 * (commit af2f003391786fb632889c02142c941b212ba4ff)
+	 * 
+	 * The 'protocol' line was added in 2003-06-11.
+	 * (commit 9bd741ae48785d0c0e75cf906ff66f893d600c2d)
+	 *
+	 * The 'port' line was added in 2007-09-26.
+	 * (commit bf19aacecbeebccb2c3d150a8bd9416b7dba81fe)
+	 */
+	numfields = fscanf(info,
+			   "RPC server: %ms\n"
+			   "service: %ms (%d) version %d\n"
+			   "address: %ms\n"
+			   "protocol: %ms\n"
+			   "port: %ms\n",
+			   &server,
+			   &service, &program, &version,
+			   &address,
+			   &protoname,
+			   &port);
+
+
+	switch (numfields) {
+	case 5:
+		protoname = strdup("tcp");
+		if (!protoname)
+			goto fail;
+		/* fall through */
+	case 6:
+		/* fall through */
+	case 7:
+		break;
+	default:
+		goto fail;
+	}
+
+	if (!gssd_addrstr_to_sockaddr((struct sockaddr *)&clp->addr,
+				 address, port ? port : ""))
+		goto fail;
+
+	servername = gssd_get_servername(server, (struct sockaddr *)&clp->addr, address);
+	if (!servername)
+		goto fail;
+
+	if (asprintf(&clp->servicename, "%s@%s", service, servername) < 0)
+		goto fail;
+
+	clp->servername = servername;
+	clp->prog = program;
+	clp->vers = version;
+	clp->protocol = protoname;
+
+	goto out;
+
+fail:
+	printerr(0, "ERROR: failed to parse %s/info\n", clp->relpath);
+	free(servername);
+	free(protoname);
+	clp->servicename = NULL;
+	clp->servername = NULL;
+	clp->prog = 0;
+	clp->vers = 0;
+	clp->protocol = NULL;
+out:
+	if (info)
+		fclose(info);
+
+	free(server);
+	free(service);
+	free(address);
+	free(port);
+}
+
+static void
+gssd_destroy_client(struct clnt_info *clp)
+{
+	if (clp->krb5_fd >= 0) {
+		close(clp->krb5_fd);
+		event_del(&clp->krb5_ev);
+	}
+
+	if (clp->gssd_fd >= 0) {
+		close(clp->gssd_fd);
+		event_del(&clp->gssd_ev);
+	}
+
+	inotify_rm_watch(inotify_fd, clp->wd);
+	free(clp->relpath);
+	free(clp->servicename);
+	free(clp->servername);
+	free(clp->protocol);
+	free(clp);
+}
+
+static void gssd_scan(void);
+
+static void
+gssd_clnt_gssd_cb(int UNUSED(fd), short UNUSED(which), void *data)
+{
+	struct clnt_info *clp = data;
+
+	handle_gssd_upcall(clp);
+}
+
+static void
+gssd_clnt_krb5_cb(int UNUSED(fd), short UNUSED(which), void *data)
+{
+	struct clnt_info *clp = data;
+
+	handle_krb5_upcall(clp);
+}
+
+static struct clnt_info *
+gssd_get_clnt(struct topdir *tdi, const char *name)
+{
+	struct clnt_info *clp;
+
+	TAILQ_FOREACH(clp, &tdi->clnt_list, list)
+		if (!strcmp(clp->name, name))
+			return clp;
+
+	clp = calloc(1, sizeof(struct clnt_info));
+	if (!clp) {
+		printerr(0, "ERROR: can't malloc clnt_info: %s\n",
+			 strerror(errno));
+		return NULL;
+	}
+
+	if (asprintf(&clp->relpath, "%s/%s", tdi->name, name) < 0) {
+		clp->relpath = NULL;
+		goto out;
+	}
+
+	clp->wd = inotify_add_watch(inotify_fd, clp->relpath, IN_CREATE | IN_DELETE);
+	if (clp->wd < 0) {
+		if (errno != ENOENT)
+			printerr(0, "ERROR: inotify_add_watch failed for %s: %s\n",
+			 	clp->relpath, strerror(errno));
+		goto out;
+	}
+
+	clp->name = clp->relpath + strlen(tdi->name) + 1;
+	clp->krb5_fd = -1;
+	clp->gssd_fd = -1;
+
+	TAILQ_INSERT_HEAD(&tdi->clnt_list, clp, list);
+	return clp;
+
+out:
+	free(clp->relpath);
+	free(clp);
+	return NULL;
+}
+
+static int
+gssd_scan_clnt(struct clnt_info *clp)
+{
+	int clntfd;
+	bool gssd_was_closed;
+	bool krb5_was_closed;
+
+	gssd_was_closed = clp->gssd_fd < 0 ? true : false;
+	krb5_was_closed = clp->krb5_fd < 0 ? true : false;
+
+	clntfd = openat(pipefs_fd, clp->relpath, O_RDONLY);
+	if (clntfd < 0) {
+		printerr(0, "ERROR: can't openat %s: %s\n",
+			 clp->relpath, strerror(errno));
+		return -1;
+	}
+
+	if (clp->gssd_fd == -1)
+		clp->gssd_fd = openat(clntfd, "gssd", O_RDWR | O_NONBLOCK);
+
+	if (clp->gssd_fd == -1 && clp->krb5_fd == -1)
+		clp->krb5_fd = openat(clntfd, "krb5", O_RDWR | O_NONBLOCK);
+
+	if (gssd_was_closed && clp->gssd_fd >= 0) {
+		event_set(&clp->gssd_ev, clp->gssd_fd, EV_READ | EV_PERSIST,
+			  gssd_clnt_gssd_cb, clp);
+		event_add(&clp->gssd_ev, NULL);
+	}
+
+	if (krb5_was_closed && clp->krb5_fd >= 0) {
+		event_set(&clp->krb5_ev, clp->krb5_fd, EV_READ | EV_PERSIST,
+			  gssd_clnt_krb5_cb, clp);
+		event_add(&clp->krb5_ev, NULL);
+	}
+
+	if (clp->krb5_fd == -1 && clp->gssd_fd == -1)
+		/* not fatal, files might appear later */
+		goto out;
+
+	if (clp->prog == 0)
+		gssd_read_service_info(clntfd, clp);
+
+out:
+	close(clntfd);
+	clp->scanned = true;
+	return 0;
+}
+
+static int
+gssd_create_clnt(struct topdir *tdi, const char *name)
+{
+	struct clnt_info *clp;
+
+	clp = gssd_get_clnt(tdi, name);
+	if (!clp)
+		return -1;
+
+	return gssd_scan_clnt(clp);
+}
 
-void
+static struct topdir *
+gssd_get_topdir(const char *name)
+{
+	struct topdir *tdi;
+
+	TAILQ_FOREACH(tdi, &topdir_list, list)
+		if (!strcmp(tdi->name, name))
+			return tdi;
+
+	tdi = malloc(sizeof(*tdi) + strlen(name) + 1);
+	if (!tdi) {
+		printerr(0, "ERROR: Couldn't allocate struct topdir\n");
+		return NULL;
+	}
+
+	tdi->wd = inotify_add_watch(inotify_fd, name, IN_CREATE);
+	if (tdi->wd < 0) {
+		printerr(0, "ERROR: inotify_add_watch failed for top dir %s: %s\n",
+			 tdi->name, strerror(errno));
+		free(tdi);
+		return NULL;
+	}
+
+	strcpy(tdi->name, name);
+	TAILQ_INIT(&tdi->clnt_list);
+
+	TAILQ_INSERT_HEAD(&topdir_list, tdi, list);
+	return tdi;
+}
+
+static void
+gssd_scan_topdir(const char *name)
+{
+	struct topdir *tdi;
+	int dfd;
+	DIR *dir;
+	struct clnt_info *clp;
+	struct dirent *d;
+
+	tdi = gssd_get_topdir(name);
+	if (!tdi)
+		return;
+
+	dfd = openat(pipefs_fd, tdi->name, O_RDONLY);
+	if (dfd < 0) {
+		printerr(0, "ERROR: can't openat %s: %s\n",
+			 tdi->name, strerror(errno));
+		return;
+	}
+
+	dir = fdopendir(dfd);
+	if (!dir) {
+		printerr(0, "ERROR: can't fdopendir %s: %s\n",
+			 tdi->name, strerror(errno));
+		return;
+	}
+
+	TAILQ_FOREACH(clp, &tdi->clnt_list, list)
+		clp->scanned = false;
+
+	while ((d = readdir(dir))) {
+		if (d->d_type != DT_DIR)
+			continue;
+
+		if (strncmp(d->d_name, "clnt", strlen("clnt")))
+			continue;
+
+		gssd_create_clnt(tdi, d->d_name);
+	}
+
+	closedir(dir);
+
+	TAILQ_FOREACH(clp, &tdi->clnt_list, list) {
+		void *saveprev;
+
+		if (clp->scanned)
+			continue;
+
+		printerr(3, "destroying client %s\n", clp->relpath);
+		saveprev = clp->list.tqe_prev;
+		TAILQ_REMOVE(&tdi->clnt_list, clp, list);
+		gssd_destroy_client(clp);
+		clp = saveprev;
+	}
+}
+
+static void
+gssd_scan(void)
+{
+	struct dirent *d;
+
+	printerr(3, "doing a full rescan\n");
+	rewinddir(pipefs_dir);
+
+	while ((d = readdir(pipefs_dir))) {
+		if (d->d_type != DT_DIR)
+			continue;
+
+		if (d->d_name[0] == '.')
+			continue;
+
+		gssd_scan_topdir(d->d_name);
+	}
+
+	if (TAILQ_EMPTY(&topdir_list)) {
+		printerr(0, "ERROR: the rpc_pipefs directory is empty!\n");
+		exit(EXIT_FAILURE);
+	}
+}
+
+static void
+gssd_scan_cb(int UNUSED(fd), short UNUSED(which), void *UNUSED(data))
+{
+	gssd_scan();
+}
+
+static bool
+gssd_inotify_topdir(struct topdir *tdi, const struct inotify_event *ev)
+{
+	printerr(5, "inotify event for topdir (%s) - "
+		 "ev->wd (%d) ev->name (%s) ev->mask (0x%08x)\n",
+		 tdi->name, ev->wd, ev->len > 0 ? ev->name : "<?>", ev->mask);
+
+	if (ev->mask & IN_IGNORED) {
+		printerr(0, "ERROR: topdir disappeared!\n");
+		return false;
+	}
+
+	if (ev->len == 0)
+		return false;
+
+	if (ev->mask & IN_CREATE) {
+		if (!(ev->mask & IN_ISDIR))
+			return true;
+
+		if (strncmp(ev->name, "clnt", strlen("clnt")))
+			return true;
+
+		if (gssd_create_clnt(tdi, ev->name))
+			return false;
+
+		return true;
+	} 
+
+	return false;
+}
+
+static bool
+gssd_inotify_clnt(struct topdir *tdi, struct clnt_info *clp, const struct inotify_event *ev)
+{
+	printerr(5, "inotify event for clntdir (%s) - "
+		 "ev->wd (%d) ev->name (%s) ev->mask (0x%08x)\n",
+		 clp->relpath, ev->wd, ev->len > 0 ? ev->name : "<?>", ev->mask);
+
+	if (ev->mask & IN_IGNORED) {
+		TAILQ_REMOVE(&tdi->clnt_list, clp, list);
+		gssd_destroy_client(clp);
+		return true;
+	}
+
+	if (ev->len == 0)
+		return false;
+
+	if (ev->mask & IN_CREATE) {
+		if (!strcmp(ev->name, "gssd") ||
+		    !strcmp(ev->name, "krb5") ||
+		    !strcmp(ev->name, "info"))
+			if (gssd_scan_clnt(clp))
+				return false;
+
+		return true;
+
+	} else if (ev->mask & IN_DELETE) {
+		if (!strcmp(ev->name, "gssd") && clp->gssd_fd >= 0) {
+			close(clp->gssd_fd);
+			event_del(&clp->gssd_ev);
+			clp->gssd_fd = -1;
+
+		} else if (!strcmp(ev->name, "krb5") && clp->krb5_fd >= 0) {
+			close(clp->krb5_fd);
+			event_del(&clp->krb5_ev);
+			clp->krb5_fd = -1;
+		}
+
+		return true;
+	}
+
+	return false;
+}
+
+static void
+gssd_inotify_cb(int ifd, short UNUSED(which), void *UNUSED(data))
+{
+	bool rescan = false;
+	struct topdir *tdi;
+	struct clnt_info *clp;
+
+	while (true) {
+		char buf[4096] __attribute__ ((aligned(__alignof__(struct inotify_event))));
+		const struct inotify_event *ev;
+		ssize_t len;
+		char *ptr;
+
+		len = read(ifd, buf, sizeof(buf));
+		if (len == -1 && errno == EINTR)
+			continue;
+
+		if (len <= 0)
+			break;
+
+		for (ptr = buf; ptr < buf + len;
+		     ptr += sizeof(struct inotify_event) + ev->len) {
+			ev = (const struct inotify_event *)ptr;
+
+			if (ev->mask & IN_Q_OVERFLOW) {
+				printerr(0, "ERROR: inotify queue overflow\n");
+				rescan = true;
+				break;
+			}
+
+			TAILQ_FOREACH(tdi, &topdir_list, list) {
+				if (tdi->wd == ev->wd) {
+					if (!gssd_inotify_topdir(tdi, ev))
+						rescan = true;
+					goto found;
+				}
+
+				TAILQ_FOREACH(clp, &tdi->clnt_list, list) {
+					if (clp->wd == ev->wd) {
+						if (!gssd_inotify_clnt(tdi, clp, ev))
+							rescan = true;
+						goto found;
+					}
+				}
+			}
+
+found:
+			if (!tdi) {
+				printerr(5, "inotify event for unknown wd!!! - "
+					 "ev->wd (%d) ev->name (%s) ev->mask (0x%08x)\n",
+					 ev->wd, ev->len > 0 ? ev->name : "<?>", ev->mask);
+				rescan = true;
+			}
+		}
+	}
+
+	if (rescan)
+		gssd_scan();
+}
+
+static void
 sig_die(int signal)
 {
-	/* destroy krb5 machine creds */
 	if (root_uses_machine_creds)
 		gssd_destroy_krb5_machine_creds();
 	printerr(1, "exiting on signal %d\n", signal);
 	exit(0);
 }
 
-void
-sig_hup(int signal)
-{
-	/* don't exit on SIGHUP */
-	printerr(1, "Received SIGHUP(%d)... Ignoring.\n", signal);
-	return;
-}
-
 static void
 usage(char *progname)
 {
@@ -104,8 +756,9 @@ main(int argc, char *argv[])
 	int i;
 	extern char *optarg;
 	char *progname;
+	char *ccachedir = NULL;
+	struct event sighup_ev;
 
-	memset(ccachesearch, 0, sizeof(ccachesearch));
 	while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:T:R:")) != -1) {
 		switch (opt) {
 			case 'f':
@@ -127,19 +780,13 @@ main(int argc, char *argv[])
 				rpc_verbosity++;
 				break;
 			case 'p':
-				strncpy(pipefs_dir, optarg, sizeof(pipefs_dir));
-				if (pipefs_dir[sizeof(pipefs_dir)-1] != '\0')
-					errx(1, "pipefs path name too long");
+				pipefs_path = optarg;
 				break;
 			case 'k':
-				strncpy(keytabfile, optarg, sizeof(keytabfile));
-				if (keytabfile[sizeof(keytabfile)-1] != '\0')
-					errx(1, "keytab path name too long");
+				keytabfile = optarg;
 				break;
 			case 'd':
-				strncpy(ccachedir, optarg, sizeof(ccachedir));
-				if (ccachedir[sizeof(ccachedir)-1] != '\0')
-					errx(1, "ccachedir path name too long");
+				ccachedir = optarg;
 				break;
 			case 't':
 				context_timeout = atoi(optarg);
@@ -158,7 +805,7 @@ main(int argc, char *argv[])
 #endif
 				break;
 			case 'D':
-				avoid_dns = 0;
+				avoid_dns = false;
 				break;
 			default:
 				usage(argv[0]);
@@ -174,15 +821,41 @@ main(int argc, char *argv[])
 	 * the results of getpw*.
 	 */
 	if (setenv("HOME", "/", 1)) {
-		printerr(1, "Unable to set $HOME: %s\n", strerror(errno));
+		printerr(0, "gssd: Unable to set $HOME: %s\n", strerror(errno));
 		exit(1);
 	}
 
-	i = 0;
-	ccachesearch[i++] = strtok(ccachedir, ":");
-	do {
-		ccachesearch[i++] = strtok(NULL, ":");
-	} while (ccachesearch[i-1] != NULL && i < GSSD_MAX_CCACHE_SEARCH);
+	if (ccachedir) {
+		char *ccachedir_copy;
+		char *ptr;
+
+		for (ptr = ccachedir, i = 2; *ptr; ptr++)
+			if (*ptr == ':')
+				i++;
+
+		ccachesearch = malloc(i * sizeof(char *));
+	       	ccachedir_copy = strdup(ccachedir);
+		if (!ccachedir_copy || !ccachesearch) {
+			printerr(0, "malloc failure\n");
+			exit(EXIT_FAILURE);
+		}
+
+		i = 0;
+		ccachesearch[i++] = strtok(ccachedir, ":");
+		while(ccachesearch[i - 1])
+			ccachesearch[i++] = strtok(NULL, ":");
+
+	} else {
+		ccachesearch = malloc(3 * sizeof(char *));
+		if (!ccachesearch) {
+			printerr(0, "malloc failure\n");
+			exit(EXIT_FAILURE);
+		}
+
+		ccachesearch[0] = GSSD_DEFAULT_CRED_DIR;
+		ccachesearch[1] = GSSD_USER_CRED_DIR;
+		ccachesearch[2] = NULL;
+	}
 
 	if (preferred_realm == NULL)
 		gssd_k5_get_default_realm(&preferred_realm);
@@ -197,6 +870,13 @@ main(int argc, char *argv[])
 	if (verbosity && rpc_verbosity == 0)
 		rpc_verbosity = verbosity;
 	authgss_set_debug_level(rpc_verbosity);
+#elif HAVE_LIBTIRPC_SET_DEBUG
+	/*
+	 * Only set the libtirpc debug level if explicitly requested via -r...
+	 * gssd is chatty enough as it is.
+	 */
+	if (rpc_verbosity > 0)
+		libtirpc_set_debug(progname, rpc_verbosity, fg);
 #else
         if (rpc_verbosity > 0)
 		printerr(0, "Warning: rpcsec_gss library does not "
@@ -206,14 +886,42 @@ main(int argc, char *argv[])
 	if (gssd_check_mechs() != 0)
 		errx(1, "Problem with gssapi library");
 
-	if (!fg)
-		mydaemon(0, 0, pipefds);
+	daemon_init(fg);
+
+	event_init();
+
+	pipefs_dir = opendir(pipefs_path);
+	if (!pipefs_dir) {
+		printerr(0, "ERROR: opendir(%s) failed: %s\n", pipefs_path, strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+
+	pipefs_fd = dirfd(pipefs_dir);
+	if (fchdir(pipefs_fd)) {
+		printerr(0, "ERROR: fchdir(%s) failed: %s\n", pipefs_path, strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+
+	inotify_fd = inotify_init1(IN_NONBLOCK);
+	if (inotify_fd == -1) {
+		printerr(0, "ERROR: inotify_init1 failed: %s\n", strerror(errno));
+		exit(EXIT_FAILURE);
+	}
 
 	signal(SIGINT, sig_die);
 	signal(SIGTERM, sig_die);
-	signal(SIGHUP, sig_hup);
+	signal_set(&sighup_ev, SIGHUP, gssd_scan_cb, NULL);
+	signal_add(&sighup_ev, NULL);
+	event_set(&inotify_ev, inotify_fd, EV_READ | EV_PERSIST, gssd_inotify_cb, NULL);
+	event_add(&inotify_ev, NULL);
+
+	TAILQ_INIT(&topdir_list);
+	gssd_scan();
+	daemon_ready();
 
-	gssd_run();
-	printerr(0, "gssd_run returned!\n");
-	abort();
+	event_dispatch();
+
+	printerr(0, "ERROR: event_dispatch() returned!\n");
+	return EXIT_FAILURE;
 }
+
diff -up nfs-utils-1.3.0/utils/gssd/gssd.h.orig nfs-utils-1.3.0/utils/gssd/gssd.h
--- nfs-utils-1.3.0/utils/gssd/gssd.h.orig	2016-04-15 11:42:13.917460638 -0400
+++ nfs-utils-1.3.0/utils/gssd/gssd.h	2016-04-15 11:42:38.369938424 -0400
@@ -34,14 +34,12 @@
 #include <sys/types.h>
 #include <sys/queue.h>
 #include <gssapi/gssapi.h>
+#include <event.h>
+#include <stdbool.h>
 
-#define MAX_FILE_NAMELEN	32
-#define FD_ALLOC_BLOCK		256
 #ifndef GSSD_PIPEFS_DIR
 #define GSSD_PIPEFS_DIR		"/var/lib/nfs/rpc_pipefs"
 #endif
-#define INFO			"info"
-#define KRB5			"krb5"
 #define DNOTIFY_SIGNAL		(SIGRTMIN + 3)
 
 #define GSSD_DEFAULT_CRED_DIR			"/tmp"
@@ -50,60 +48,40 @@
 #define GSSD_DEFAULT_MACHINE_CRED_SUFFIX	"machine"
 #define GSSD_DEFAULT_KEYTAB_FILE		"/etc/krb5.keytab"
 #define GSSD_SERVICE_NAME			"nfs"
-#define GSSD_SERVICE_NAME_LEN			3
-#define GSSD_MAX_CCACHE_SEARCH			16
 
 /*
  * The gss mechanisms that we can handle
  */
 enum {AUTHTYPE_KRB5, AUTHTYPE_LIPKEY};
 
-
-
-extern char			pipefs_dir[PATH_MAX];
-extern char			keytabfile[PATH_MAX];
-extern char			*ccachesearch[];
+extern char		       *keytabfile;
+extern char		      **ccachesearch;
 extern int			use_memcache;
 extern int			root_uses_machine_creds;
 extern unsigned int 		context_timeout;
 extern unsigned int rpc_timeout;
 extern char			*preferred_realm;
-extern int			pipefds[2];
-
-TAILQ_HEAD(clnt_list_head, clnt_info) clnt_list;
 
 struct clnt_info {
 	TAILQ_ENTRY(clnt_info)	list;
-	char			*dirname;
-	char			*pdir;
-	int			dir_fd;
+	int			wd;
+	bool			scanned;
+	char			*name;
+	char			*relpath;
 	char			*servicename;
 	char			*servername;
 	int			prog;
 	int			vers;
 	char			*protocol;
 	int			krb5_fd;
-	int			krb5_poll_index;
-	int			krb5_close_me;
-	int                     gssd_fd;
-	int                     gssd_poll_index;
-	int			gssd_close_me;
-	struct sockaddr_storage addr;
-};
-
-TAILQ_HEAD(topdirs_list_head, topdirs_info) topdirs_list;
-
-struct topdirs_info {
-	TAILQ_ENTRY(topdirs_info)   list;
-	char			*dirname;
-	int			fd;
+	struct event		krb5_ev;
+	int			gssd_fd;
+	struct event		gssd_ev;
+	struct			sockaddr_storage addr;
 };
 
-void init_client_list(void);
-int update_client_list(void);
 void handle_krb5_upcall(struct clnt_info *clp);
 void handle_gssd_upcall(struct clnt_info *clp);
-void gssd_run(void);
 
 
 #endif /* _RPC_GSSD_H_ */
diff -up nfs-utils-1.3.0/utils/gssd/gssd_proc.c.orig nfs-utils-1.3.0/utils/gssd/gssd_proc.c
--- nfs-utils-1.3.0/utils/gssd/gssd_proc.c.orig	2016-04-15 11:42:13.949461263 -0400
+++ nfs-utils-1.3.0/utils/gssd/gssd_proc.c	2016-04-15 11:42:38.371938463 -0400
@@ -9,6 +9,7 @@
   Copyright (c) 2002 Marius Aamodt Eriksen <marius@UMICH.EDU>.
   Copyright (c) 2002 Bruce Fields <bfields@UMICH.EDU>
   Copyright (c) 2004 Kevin Coffman <kwc@umich.edu>
+  Copyright (c) 2014 David H?rdeman <david@hardeman.nu>
   All rights reserved, all wrongs reversed.
 
   Redistribution and use in source and binary forms, with or without
@@ -52,7 +53,6 @@
 #include <sys/socket.h>
 #include <arpa/inet.h>
 #include <sys/fsuid.h>
-#include <sys/resource.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -79,548 +79,6 @@
 #include "nfslib.h"
 #include "gss_names.h"
 
-/*
- * pollarray:
- *      array of struct pollfd suitable to pass to poll. initialized to
- *      zero - a zero struct is ignored by poll() because the events mask is 0.
- *
- * clnt_list:
- *      linked list of struct clnt_info which associates a clntXXX directory
- *	with an index into pollarray[], and other basic data about that client.
- *
- * Directory structure: created by the kernel
- *      {rpc_pipefs}/{dir}/clntXX         : one per rpc_clnt struct in the kernel
- *      {rpc_pipefs}/{dir}/clntXX/krb5    : read uid for which kernel wants
- *					    a context, write the resulting context
- *      {rpc_pipefs}/{dir}/clntXX/info    : stores info such as server name
- *      {rpc_pipefs}/{dir}/clntXX/gssd    : pipe for all gss mechanisms using
- *					    a text-based string of parameters
- *
- * Algorithm:
- *      Poll all {rpc_pipefs}/{dir}/clntXX/YYYY files.  When data is ready,
- *      read and process; performs rpcsec_gss context initialization protocol to
- *      get a cred for that user.  Writes result to corresponding krb5 file
- *      in a form the kernel code will understand.
- *      In addition, we make sure we are notified whenever anything is
- *      created or destroyed in {rpc_pipefs} or in any of the clntXX directories,
- *      and rescan the whole {rpc_pipefs} when this happens.
- */
-
-struct pollfd * pollarray;
-
-unsigned long pollsize;  /* the size of pollaray (in pollfd's) */
-
-/* Avoid DNS reverse lookups on server names */
-int avoid_dns = 1;
-
-/*
- * convert a presentation address string to a sockaddr_storage struct. Returns
- * true on success or false on failure.
- *
- * Note that we do not populate the sin6_scope_id field here for IPv6 addrs.
- * gssd nececessarily relies on hostname resolution and DNS AAAA records
- * do not generally contain scope-id's. This means that GSSAPI auth really
- * can't work with IPv6 link-local addresses.
- *
- * We *could* consider changing this if we did something like adopt the
- * Microsoft "standard" of using the ipv6-literal.net domainname, but it's
- * not really feasible at present.
- */
-static int
-addrstr_to_sockaddr(struct sockaddr *sa, const char *node, const char *port)
-{
-	int rc;
-	struct addrinfo *res;
-	struct addrinfo hints = { .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV };
-
-#ifndef IPV6_SUPPORTED
-	hints.ai_family = AF_INET;
-#endif /* IPV6_SUPPORTED */
-
-	rc = getaddrinfo(node, port, &hints, &res);
-	if (rc) {
-		printerr(0, "ERROR: unable to convert %s|%s to sockaddr: %s\n",
-			 node, port, rc == EAI_SYSTEM ? strerror(errno) :
-						gai_strerror(rc));
-		return 0;
-	}
-
-#ifdef IPV6_SUPPORTED
-	/*
-	 * getnameinfo ignores the scopeid. If the address turns out to have
-	 * a non-zero scopeid, we can't use it -- the resolved host might be
-	 * completely different from the one intended.
-	 */
-	if (res->ai_addr->sa_family == AF_INET6) {
-		struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)res->ai_addr;
-		if (sin6->sin6_scope_id) {
-			printerr(0, "ERROR: address %s has non-zero "
-				    "sin6_scope_id!\n", node);
-			freeaddrinfo(res);
-			return 0;
-		}
-	}
-#endif /* IPV6_SUPPORTED */
-
-	memcpy(sa, res->ai_addr, res->ai_addrlen);
-	freeaddrinfo(res);
-	return 1;
-}
-
-/*
- * convert a sockaddr to a hostname
- */
-static char *
-get_servername(const char *name, const struct sockaddr *sa, const char *addr)
-{
-	socklen_t		addrlen;
-	int			err;
-	char			*hostname;
-	char			hbuf[NI_MAXHOST];
-	unsigned char		buf[sizeof(struct in6_addr)];
-
-	if (avoid_dns) {
-		/*
-		 * Determine if this is a server name, or an IP address.
-		 * If it is an IP address, do the DNS lookup otherwise
-		 * skip the DNS lookup.
-		 */
-		int is_fqdn = 1;
-		if (strchr(name, '.') == NULL)
-			is_fqdn = 0; /* local name */
-		else if (inet_pton(AF_INET, name, buf) == 1)
-			is_fqdn = 0; /* IPv4 address */
-		else if (inet_pton(AF_INET6, name, buf) == 1)
-			is_fqdn = 0; /* IPv6 addrss */
-
-		if (is_fqdn) {
-			return strdup(name);
-		}
-		/* Sorry, cannot avoid dns after all */
-	}
-
-	switch (sa->sa_family) {
-	case AF_INET:
-		addrlen = sizeof(struct sockaddr_in);
-		break;
-#ifdef IPV6_SUPPORTED
-	case AF_INET6:
-		addrlen = sizeof(struct sockaddr_in6);
-		break;
-#endif /* IPV6_SUPPORTED */
-	default:
-		printerr(0, "ERROR: unrecognized addr family %d\n",
-			 sa->sa_family);
-		return NULL;
-	}
-
-	err = getnameinfo(sa, addrlen, hbuf, sizeof(hbuf), NULL, 0,
-			  NI_NAMEREQD);
-	if (err) {
-		printerr(0, "ERROR: unable to resolve %s to hostname: %s\n",
-			 addr, err == EAI_SYSTEM ? strerror(errno) :
-						   gai_strerror(err));
-		return NULL;
-	}
-
-	hostname = strdup(hbuf);
-
-	return hostname;
-}
-
-/* XXX buffer problems: */
-static int
-read_service_info(char *info_file_name, char **servicename, char **servername,
-		  int *prog, int *vers, char **protocol,
-		  struct sockaddr *addr) {
-#define INFOBUFLEN 256
-	char		buf[INFOBUFLEN + 1];
-	static char	server[128];
-	int		nbytes;
-	static char	service[128];
-	static char	address[128];
-	char		program[16];
-	char		version[16];
-	char		protoname[16];
-	char		port[128];
-	char		*p;
-	int		fd = -1;
-	int		numfields;
-
-	*servicename = *servername = *protocol = NULL;
-
-	if ((fd = open(info_file_name, O_RDONLY)) == -1) {
-		printerr(0, "ERROR: can't open %s: %s\n", info_file_name,
-			 strerror(errno));
-		goto fail;
-	}
-	if ((nbytes = read(fd, buf, INFOBUFLEN)) == -1)
-		goto fail;
-	close(fd);
-	fd = -1;
-	buf[nbytes] = '\0';
-
-	numfields = sscanf(buf,"RPC server: %127s\n"
-		   "service: %127s %15s version %15s\n"
-		   "address: %127s\n"
-		   "protocol: %15s\n",
-		   server,
-		   service, program, version,
-		   address,
-		   protoname);
-
-	if (numfields == 5) {
-		strcpy(protoname, "tcp");
-	} else if (numfields != 6) {
-		goto fail;
-	}
-
-	port[0] = '\0';
-	if ((p = strstr(buf, "port")) != NULL)
-		sscanf(p, "port: %127s\n", port);
-
-	/* get program, and version numbers */
-	*prog = atoi(program + 1); /* skip open paren */
-	*vers = atoi(version);
-
-	if (!addrstr_to_sockaddr(addr, address, port))
-		goto fail;
-
-	*servername = get_servername(server, addr, address);
-	if (*servername == NULL)
-		goto fail;
-
-	nbytes = snprintf(buf, INFOBUFLEN, "%s@%s", service, *servername);
-	if (nbytes > INFOBUFLEN)
-		goto fail;
-
-	if (!(*servicename = calloc(strlen(buf) + 1, 1)))
-		goto fail;
-	memcpy(*servicename, buf, strlen(buf));
-
-	if (!(*protocol = strdup(protoname)))
-		goto fail;
-	return 0;
-fail:
-	printerr(0, "ERROR: failed to read service info\n");
-	if (fd != -1) close(fd);
-	free(*servername);
-	free(*servicename);
-	free(*protocol);
-	*servicename = *servername = *protocol = NULL;
-	return -1;
-}
-
-static void
-destroy_client(struct clnt_info *clp)
-{
-	if (clp->krb5_poll_index != -1)
-		memset(&pollarray[clp->krb5_poll_index], 0,
-					sizeof(struct pollfd));
-	if (clp->gssd_poll_index != -1)
-		memset(&pollarray[clp->gssd_poll_index], 0,
-					sizeof(struct pollfd));
-	if (clp->dir_fd != -1) close(clp->dir_fd);
-	if (clp->krb5_fd != -1) close(clp->krb5_fd);
-	if (clp->gssd_fd != -1) close(clp->gssd_fd);
-	free(clp->dirname);
-	free(clp->pdir);
-	free(clp->servicename);
-	free(clp->servername);
-	free(clp->protocol);
-	free(clp);
-}
-
-static struct clnt_info *
-insert_new_clnt(void)
-{
-	struct clnt_info	*clp = NULL;
-
-	if (!(clp = (struct clnt_info *)calloc(1,sizeof(struct clnt_info)))) {
-		printerr(0, "ERROR: can't malloc clnt_info: %s\n",
-			 strerror(errno));
-		goto out;
-	}
-	clp->krb5_poll_index = -1;
-	clp->gssd_poll_index = -1;
-	clp->krb5_fd = -1;
-	clp->gssd_fd = -1;
-	clp->dir_fd = -1;
-
-	TAILQ_INSERT_HEAD(&clnt_list, clp, list);
-out:
-	return clp;
-}
-
-static int
-process_clnt_dir_files(struct clnt_info * clp)
-{
-	char	name[PATH_MAX];
-	char	gname[PATH_MAX];
-	char	info_file_name[PATH_MAX];
-
-	if (clp->gssd_close_me) {
-		printerr(2, "Closing 'gssd' pipe for %s\n", clp->dirname);
-		close(clp->gssd_fd);
-		memset(&pollarray[clp->gssd_poll_index], 0,
-			sizeof(struct pollfd));
-		clp->gssd_fd = -1;
-		clp->gssd_poll_index = -1;
-		clp->gssd_close_me = 0;
-	}
-	if (clp->krb5_close_me) {
-		printerr(2, "Closing 'krb5' pipe for %s\n", clp->dirname);
-		close(clp->krb5_fd);
-		memset(&pollarray[clp->krb5_poll_index], 0,
-			sizeof(struct pollfd));
-		clp->krb5_fd = -1;
-		clp->krb5_poll_index = -1;
-		clp->krb5_close_me = 0;
-	}
-
-	if (clp->gssd_fd == -1) {
-		snprintf(gname, sizeof(gname), "%s/gssd", clp->dirname);
-		clp->gssd_fd = open(gname, O_RDWR);
-	}
-	if (clp->gssd_fd == -1) {
-		if (clp->krb5_fd == -1) {
-			snprintf(name, sizeof(name), "%s/krb5", clp->dirname);
-			clp->krb5_fd = open(name, O_RDWR);
-		}
-
-		/* If we opened a gss-specific pipe, let's try opening
-		 * the new upcall pipe again. If we succeed, close
-		 * gss-specific pipe(s).
-		 */
-		if (clp->krb5_fd != -1) {
-			clp->gssd_fd = open(gname, O_RDWR);
-			if (clp->gssd_fd != -1) {
-				if (clp->krb5_fd != -1)
-					close(clp->krb5_fd);
-				clp->krb5_fd = -1;
-			}
-		}
-	}
-
-	if ((clp->krb5_fd == -1) && (clp->gssd_fd == -1))
-		return -1;
-	snprintf(info_file_name, sizeof(info_file_name), "%s/info",
-			clp->dirname);
-	if (clp->prog == 0)
-		read_service_info(info_file_name, &clp->servicename,
-				  &clp->servername, &clp->prog, &clp->vers,
-				  &clp->protocol, (struct sockaddr *) &clp->addr);
-	return 0;
-}
-
-static int
-get_poll_index(int *ind)
-{
-	unsigned int i;
-
-	*ind = -1;
-	for (i=0; i<pollsize; i++) {
-		if (pollarray[i].events == 0) {
-			*ind = i;
-			break;
-		}
-	}
-	if (*ind == -1) {
-		printerr(0, "ERROR: No pollarray slots open\n");
-		return -1;
-	}
-	return 0;
-}
-
-
-static int
-insert_clnt_poll(struct clnt_info *clp)
-{
-	if ((clp->gssd_fd != -1) && (clp->gssd_poll_index == -1)) {
-		if (get_poll_index(&clp->gssd_poll_index)) {
-			printerr(0, "ERROR: Too many gssd clients\n");
-			return -1;
-		}
-		pollarray[clp->gssd_poll_index].fd = clp->gssd_fd;
-		pollarray[clp->gssd_poll_index].events |= POLLIN;
-	}
-
-	if ((clp->krb5_fd != -1) && (clp->krb5_poll_index == -1)) {
-		if (get_poll_index(&clp->krb5_poll_index)) {
-			printerr(0, "ERROR: Too many krb5 clients\n");
-			return -1;
-		}
-		pollarray[clp->krb5_poll_index].fd = clp->krb5_fd;
-		pollarray[clp->krb5_poll_index].events |= POLLIN;
-	}
-
-	return 0;
-}
-
-static void
-process_clnt_dir(char *dir, char *pdir)
-{
-	struct clnt_info *	clp;
-
-	if (!(clp = insert_new_clnt()))
-		goto fail_destroy_client;
-
-	if (!(clp->pdir = strdup(pdir)))
-		goto fail_destroy_client;
-
-	/* An extra for the '/', and an extra for the null */
-	if (!(clp->dirname = calloc(strlen(dir) + strlen(pdir) + 2, 1))) {
-		goto fail_destroy_client;
-	}
-	sprintf(clp->dirname, "%s/%s", pdir, dir);
-	if ((clp->dir_fd = open(clp->dirname, O_RDONLY)) == -1) {
-		if (errno != ENOENT)
-			printerr(0, "ERROR: can't open %s: %s\n",
-				 clp->dirname, strerror(errno));
-		goto fail_destroy_client;
-	}
-	fcntl(clp->dir_fd, F_SETSIG, DNOTIFY_SIGNAL);
-	fcntl(clp->dir_fd, F_NOTIFY, DN_CREATE | DN_DELETE | DN_MULTISHOT);
-
-	if (process_clnt_dir_files(clp))
-		goto fail_keep_client;
-
-	if (insert_clnt_poll(clp))
-		goto fail_destroy_client;
-
-	return;
-
-fail_destroy_client:
-	if (clp) {
-		TAILQ_REMOVE(&clnt_list, clp, list);
-		destroy_client(clp);
-	}
-fail_keep_client:
-	/* We couldn't find some subdirectories, but we keep the client
-	 * around in case we get a notification on the directory when the
-	 * subdirectories are created. */
-	return;
-}
-
-void
-init_client_list(void)
-{
-	struct rlimit rlim;
-	TAILQ_INIT(&clnt_list);
-	/* Eventually plan to grow/shrink poll array: */
-	pollsize = FD_ALLOC_BLOCK;
-	if (getrlimit(RLIMIT_NOFILE, &rlim) == 0 &&
-	    rlim.rlim_cur != RLIM_INFINITY)
-		pollsize = rlim.rlim_cur;
-	pollarray = calloc(pollsize, sizeof(struct pollfd));
-}
-
-/*
- * This is run after a DNOTIFY signal, and should clear up any
- * directories that are no longer around, and re-scan any existing
- * directories, since the DNOTIFY could have been in there.
- */
-static void
-update_old_clients(struct dirent **namelist, int size, char *pdir)
-{
-	struct clnt_info *clp;
-	void *saveprev;
-	int i, stillhere;
-	char fname[PATH_MAX];
-
-	for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
-		/* only compare entries in the global list that are from the
-		 * same pipefs parent directory as "pdir"
-		 */
-		if (strcmp(clp->pdir, pdir) != 0) continue;
-
-		stillhere = 0;
-		for (i=0; i < size; i++) {
-			snprintf(fname, sizeof(fname), "%s/%s",
-				 pdir, namelist[i]->d_name);
-			if (strcmp(clp->dirname, fname) == 0) {
-				stillhere = 1;
-				break;
-			}
-		}
-		if (!stillhere) {
-			printerr(2, "destroying client %s\n", clp->dirname);
-			saveprev = clp->list.tqe_prev;
-			TAILQ_REMOVE(&clnt_list, clp, list);
-			destroy_client(clp);
-			clp = saveprev;
-		}
-	}
-	for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
-		if (!process_clnt_dir_files(clp))
-			insert_clnt_poll(clp);
-	}
-}
-
-/* Search for a client by directory name, return 1 if found, 0 otherwise */
-static int
-find_client(char *dirname, char *pdir)
-{
-	struct clnt_info	*clp;
-	char fname[PATH_MAX];
-
-	for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
-		snprintf(fname, sizeof(fname), "%s/%s", pdir, dirname);
-		if (strcmp(clp->dirname, fname) == 0)
-			return 1;
-	}
-	return 0;
-}
-
-static int
-process_pipedir(char *pipe_name)
-{
-	struct dirent **namelist;
-	int i, j;
-
-	if (chdir(pipe_name) < 0) {
-		printerr(0, "ERROR: can't chdir to %s: %s\n",
-			 pipe_name, strerror(errno));
-		return -1;
-	}
-
-	j = scandir(pipe_name, &namelist, NULL, alphasort);
-	if (j < 0) {
-		printerr(0, "ERROR: can't scandir %s: %s\n",
-			 pipe_name, strerror(errno));
-		return -1;
-	}
-
-	update_old_clients(namelist, j, pipe_name);
-	for (i=0; i < j; i++) {
-		if (!strncmp(namelist[i]->d_name, "clnt", 4)
-		    && !find_client(namelist[i]->d_name, pipe_name))
-			process_clnt_dir(namelist[i]->d_name, pipe_name);
-		free(namelist[i]);
-	}
-
-	free(namelist);
-
-	return 0;
-}
-
-/* Used to read (and re-read) list of clients, set up poll array. */
-int
-update_client_list(void)
-{
-	int retval = -1;
-	struct topdirs_info *tdi;
-
-	TAILQ_FOREACH(tdi, &topdirs_list, list) {
-		retval = process_pipedir(tdi->dirname);
-		if (retval)
-			printerr(1, "WARNING: error processing %s\n",
-				 tdi->dirname);
-
-	}
-	return retval;
-}
-
 /* Encryption types supported by the kernel rpcsec_gss code */
 int num_krb5_enctypes = 0;
 krb5_enctype *krb5_enctypes = NULL;
@@ -691,7 +149,7 @@ do_downcall(int k5_fd, uid_t uid, struct
 	unsigned int timeout = context_timeout;
 	unsigned int buf_size = 0;
 
-	printerr(1, "doing downcall: lifetime_rec=%u acceptor=%.*s\n",
+	printerr(2, "doing downcall: lifetime_rec=%u acceptor=%.*s\n",
 		lifetime_rec, acceptor->length, acceptor->value);
 	buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) +
 		sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length +
@@ -730,7 +188,7 @@ do_error_downcall(int k5_fd, uid_t uid,
 	unsigned int timeout = 0;
 	int	zero = 0;
 
-	printerr(1, "doing error downcall\n");
+	printerr(2, "doing error downcall\n");
 
 	if (WRITE_BYTES(&p, end, uid)) goto out_err;
 	if (WRITE_BYTES(&p, end, timeout)) goto out_err;
@@ -772,7 +230,7 @@ populate_port(struct sockaddr *sa, const
 	switch (sa->sa_family) {
 	case AF_INET:
 		if (s4->sin_port != 0) {
-			printerr(2, "DEBUG: port already set to %d\n",
+			printerr(4, "DEBUG: port already set to %d\n",
 				 ntohs(s4->sin_port));
 			return 1;
 		}
@@ -780,7 +238,7 @@ populate_port(struct sockaddr *sa, const
 #ifdef IPV6_SUPPORTED
 	case AF_INET6:
 		if (s6->sin6_port != 0) {
-			printerr(2, "DEBUG: port already set to %d\n",
+			printerr(4, "DEBUG: port already set to %d\n",
 				 ntohs(s6->sin6_port));
 			return 1;
 		}
@@ -941,7 +399,7 @@ create_auth_rpc_client(struct clnt_info
 	auth = authgss_create_default(rpc_clnt, tgtname, &sec);
 	if (!auth) {
 		/* Our caller should print appropriate message */
-		printerr(2, "WARNING: Failed to create krb5 context for "
+		printerr(1, "WARNING: Failed to create krb5 context for "
 			    "user with uid %d for server %s\n",
 			 uid, tgtname);
 		goto out_fail;
@@ -1032,7 +490,7 @@ krb5_not_machine_creds(struct clnt_info
 	char		**dname;
 	int		err, resp = -1;
 
-	printerr(1, "krb5_not_machine_creds: uid %d tgtname %s\n", 
+	printerr(2, "krb5_not_machine_creds: uid %d tgtname %s\n", 
 		uid, tgtname);
 
 	*chg_err = change_identity(uid);
@@ -1079,7 +537,7 @@ krb5_use_machine_creds(struct clnt_info
 	int	nocache = 0;
 	int	success = 0;
 
-	printerr(1, "krb5_use_machine_creds: uid %d tgtname %s\n", 
+	printerr(2, "krb5_use_machine_creds: uid %d tgtname %s\n", 
 		uid, tgtname);
 
 	do {
@@ -1149,8 +607,6 @@ process_krb5_upcall(struct clnt_info *cl
 	gss_OID			mech;
 	gss_buffer_desc		acceptor  = {0};
 
-	printerr(1, "handling krb5 upcall (%s)\n", clp->dirname);
-
 	token.length = 0;
 	token.value = NULL;
 	memset(&pd, 0, sizeof(struct authgss_private_data));
@@ -1176,8 +632,6 @@ process_krb5_upcall(struct clnt_info *cl
 	 * used for this case is not important.
 	 *
 	 */
-	printerr(2, "%s: service is '%s'\n", __func__,
-		 service ? service : "<null>");
 	if (uid != 0 || (uid == 0 && root_uses_machine_creds == 0 &&
 				service == NULL)) {
 
@@ -1191,7 +645,7 @@ process_krb5_upcall(struct clnt_info *cl
 			/* Child: fall through to rest of function */
 			childpid = getpid();
 			unsetenv("KRB5CCNAME");
-			printerr(1, "CHILD forked pid %d \n", childpid);
+			printerr(2, "CHILD forked pid %d \n", childpid);
 			break;
 		case -1:
 			/* fork() failed! */
@@ -1224,9 +678,7 @@ no_fork:
 			if (auth == NULL)
 				goto out_return_error;
 		} else {
-			printerr(1, "WARNING: Failed to create krb5 context "
-				 "for user with uid %d for server %s\n",
-				 uid, clp->servername);
+			/* krb5_not_machine_creds logs the error */
 			goto out_return_error;
 		}
 	}
@@ -1257,7 +709,7 @@ no_fork:
 	 * try to use it after this point.
 	 */
 	if (serialize_context_for_kernel(&pd.pd_ctx, &token, &krb5oid, NULL)) {
-		printerr(0, "WARNING: Failed to serialize krb5 context for "
+		printerr(1, "WARNING: Failed to serialize krb5 context for "
 			    "user with uid %d for server %s\n",
 			 uid, clp->servername);
 		goto out_return_error;
@@ -1300,6 +752,8 @@ handle_krb5_upcall(struct clnt_info *clp
 		return;
 	}
 
+	printerr(2, "\n%s: uid %d (%s)\n", __func__, uid, clp->relpath);
+
 	process_krb5_upcall(clp, uid, clp->krb5_fd, NULL, NULL);
 }
 
@@ -1311,85 +765,66 @@ handle_gssd_upcall(struct clnt_info *clp
 	int			lbuflen = 0;
 	char			*p;
 	char			*mech = NULL;
+	char			*uidstr = NULL;
 	char			*target = NULL;
 	char			*service = NULL;
 	char			*enctypes = NULL;
 
-	printerr(1, "handling gssd upcall (%s)\n", clp->dirname);
-
 	if (readline(clp->gssd_fd, &lbuf, &lbuflen) != 1) {
 		printerr(0, "WARNING: handle_gssd_upcall: "
 			    "failed reading request\n");
 		return;
 	}
-	printerr(2, "%s: '%s'\n", __func__, lbuf);
 
-	/* find the mechanism name */
-	if ((p = strstr(lbuf, "mech=")) != NULL) {
-		mech = malloc(lbuflen);
-		if (!mech)
-			goto out;
-		if (sscanf(p, "mech=%s", mech) != 1) {
-			printerr(0, "WARNING: handle_gssd_upcall: "
-				    "failed to parse gss mechanism name "
-				    "in upcall string '%s'\n", lbuf);
-			goto out;
-		}
-	} else {
+	printerr(2, "\n%s: '%s' (%s)\n", __func__, lbuf, clp->relpath);
+
+	for (p = strtok(lbuf, " "); p; p = strtok(NULL, " ")) {
+		if (!strncmp(p, "mech=", strlen("mech=")))
+			mech = p + strlen("mech=");
+		else if (!strncmp(p, "uid=", strlen("uid=")))
+			uidstr = p + strlen("uid=");
+		else if (!strncmp(p, "enctypes=", strlen("enctypes=")))
+			enctypes = p + strlen("enctypes=");
+		else if (!strncmp(p, "target=", strlen("target=")))
+			target = p + strlen("target=");
+		else if (!strncmp(p, "service=", strlen("service=")))
+			service = p + strlen("service=");
+	}
+
+	if (!mech || strlen(mech) < 1) {
 		printerr(0, "WARNING: handle_gssd_upcall: "
 			    "failed to find gss mechanism name "
 			    "in upcall string '%s'\n", lbuf);
-		goto out;
+		return;
 	}
 
-	/* read uid */
-	if ((p = strstr(lbuf, "uid=")) != NULL) {
-		if (sscanf(p, "uid=%d", &uid) != 1) {
-			printerr(0, "WARNING: handle_gssd_upcall: "
-				    "failed to parse uid "
-				    "in upcall string '%s'\n", lbuf);
-			goto out;
-		}
-	} else {
+	if (uidstr) {
+		uid = (uid_t)strtol(uidstr, &p, 10);
+		if (p == uidstr || *p != '\0')
+			uidstr = NULL;
+	}
+
+	if (!uidstr) {
 		printerr(0, "WARNING: handle_gssd_upcall: "
 			    "failed to find uid "
 			    "in upcall string '%s'\n", lbuf);
-		goto out;
+		return;
 	}
 
-	/* read supported encryption types if supplied */
-	if ((p = strstr(lbuf, "enctypes=")) != NULL) {
-		enctypes = malloc(lbuflen);
-		if (!enctypes)
-			goto out;
-		if (sscanf(p, "enctypes=%s", enctypes) != 1) {
-			printerr(0, "WARNING: handle_gssd_upcall: "
-				    "failed to parse encryption types "
-				    "in upcall string '%s'\n", lbuf);
-			goto out;
-		}
-		if (parse_enctypes(enctypes) != 0) {
-			printerr(0, "WARNING: handle_gssd_upcall: "
-				"parsing encryption types failed: errno %d\n", errno);
-		}
+	if (enctypes && parse_enctypes(enctypes) != 0) {
+		printerr(0, "WARNING: handle_gssd_upcall: "
+			 "parsing encryption types failed: errno %d\n", errno);
+		return;
 	}
 
-	/* read target name */
-	if ((p = strstr(lbuf, "target=")) != NULL) {
-		target = malloc(lbuflen);
-		if (!target)
-			goto out;
-		if (sscanf(p, "target=%s", target) != 1) {
-			printerr(0, "WARNING: handle_gssd_upcall: "
-				    "failed to parse target name "
-				    "in upcall string '%s'\n", lbuf);
-			goto out;
-		}
+	if (target && strlen(target) < 1) {
+		printerr(0, "WARNING: handle_gssd_upcall: "
+			 "failed to parse target name "
+			 "in upcall string '%s'\n", lbuf);
+		return;
 	}
 
 	/*
-	 * read the service name
-	 *
 	 * The presence of attribute "service=" indicates that machine
 	 * credentials should be used for this request.  If the value
 	 * is "*", then any machine credentials available can be used.
@@ -1397,16 +832,11 @@ handle_gssd_upcall(struct clnt_info *clp
 	 * the specified service name (always "nfs" for now) should be
 	 * used.
 	 */
-	if ((p = strstr(lbuf, "service=")) != NULL) {
-		service = malloc(lbuflen);
-		if (!service)
-			goto out;
-		if (sscanf(p, "service=%s", service) != 1) {
-			printerr(0, "WARNING: handle_gssd_upcall: "
-				    "failed to parse service type "
-				    "in upcall string '%s'\n", lbuf);
-			goto out;
-		}
+	if (service && strlen(service) < 1) {
+		printerr(0, "WARNING: handle_gssd_upcall: "
+			 "failed to parse service type "
+			 "in upcall string '%s'\n", lbuf);
+		return;
 	}
 
 	if (strcmp(mech, "krb5") == 0 && clp->servername)
@@ -1417,13 +847,5 @@ handle_gssd_upcall(struct clnt_info *clp
 				 "received unknown gss mech '%s'\n", mech);
 		do_error_downcall(clp->gssd_fd, uid, -EACCES);
 	}
-
-out:
-	free(lbuf);
-	free(mech);
-	free(enctypes);
-	free(target);
-	free(service);
-	return;
 }
 
diff -up nfs-utils-1.3.0/utils/gssd/gss_util.h.orig nfs-utils-1.3.0/utils/gssd/gss_util.h
--- nfs-utils-1.3.0/utils/gssd/gss_util.h.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/utils/gssd/gss_util.h	2016-04-15 11:42:38.368938404 -0400
@@ -52,6 +52,4 @@ int gssd_check_mechs(void);
 		gss_krb5_set_allowable_enctypes(min, cred, num, types)
 #endif
 
-extern int avoid_dns;
-
 #endif /* _GSS_UTIL_H_ */
diff -up nfs-utils-1.3.0/utils/gssd/krb5_util.c.orig nfs-utils-1.3.0/utils/gssd/krb5_util.c
--- nfs-utils-1.3.0/utils/gssd/krb5_util.c.orig	2016-04-15 11:42:13.953461341 -0400
+++ nfs-utils-1.3.0/utils/gssd/krb5_util.c	2016-04-15 11:42:38.372938482 -0400
@@ -356,7 +356,7 @@ gssd_get_single_krb5_cred(krb5_context c
 	 */
 	now += 300;
 	if (ple->ccname && ple->endtime > now && !nocache) {
-		printerr(2, "INFO: Credentials in CC '%s' are good until %d\n",
+		printerr(3, "INFO: Credentials in CC '%s' are good until %d\n",
 			 ple->ccname, ple->endtime);
 		code = 0;
 		goto out;
@@ -383,7 +383,7 @@ gssd_get_single_krb5_cred(krb5_context c
 			 "tickets.  May have problems behind a NAT.\n");
 #ifdef TEST_SHORT_LIFETIME
 	/* set a short lifetime (for debugging only!) */
-	printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n");
+	printerr(1, "WARNING: Using (debug) short machine cred lifetime!\n");
 	krb5_get_init_creds_opt_set_tkt_life(init_opts, 5*60);
 #endif
 	opts = init_opts;
@@ -451,8 +451,7 @@ gssd_get_single_krb5_cred(krb5_context c
 	}
 
 	code = 0;
-	printerr(2, "Successfully obtained machine credentials for "
-		 "principal '%s' stored in ccache '%s'\n", pname, cc_name);
+	printerr(2, "%s: principal '%s' ccache:'%s'\n", __func__, pname, cc_name);
   out:
 #if HAVE_KRB5_GET_INIT_CREDS_OPT_SET_ADDRESSLESS
 	if (init_opts)
@@ -477,7 +476,7 @@ gssd_set_krb5_ccache_name(char *ccname)
 #ifdef USE_GSS_KRB5_CCACHE_NAME
 	u_int	maj_stat, min_stat;
 
-	printerr(2, "using gss_krb5_ccache_name to select krb5 ccache %s\n",
+	printerr(3, "using gss_krb5_ccache_name to select krb5 ccache %s\n",
 		 ccname);
 	maj_stat = gss_krb5_ccache_name(&min_stat, ccname, NULL);
 	if (maj_stat != GSS_S_COMPLETE) {
@@ -492,7 +491,7 @@ gssd_set_krb5_ccache_name(char *ccname)
 	 * function above for which there is no generic gssapi
 	 * equivalent.)
 	 */
-	printerr(2, "using environment variable to select krb5 ccache %s\n",
+	printerr(3, "using environment variable to select krb5 ccache %s\n",
 		 ccname);
 	setenv("KRB5CCNAME", ccname, 1);
 #endif
@@ -1093,8 +1092,8 @@ gssd_setup_krb5_user_gss_ccache(uid_t ui
 	struct dirent		*d;
 	int			err, i, j;
 
-	printerr(2, "getting credentials for client with uid %u for "
-		    "server %s\n", uid, servername);
+	printerr(3, "looking for client creds with uid %u for "
+		    "server %s in %s\n", uid, servername, dirpattern);
 
 	for (i = 0, j = 0; dirpattern[i] != '\0'; i++) {
 		switch (dirpattern[i]) {
@@ -1410,16 +1409,21 @@ gssd_acquire_krb5_cred(gss_cred_id_t *gs
 int
 gssd_acquire_user_cred(gss_cred_id_t *gss_cred)
 {
-	OM_uint32 min_stat;
+	OM_uint32 maj_stat, min_stat;
 	int ret;
 
 	ret = gssd_acquire_krb5_cred(gss_cred);
 
 	/* force validation of cred to check for expiry */
 	if (ret == 0) {
-		if (gss_inquire_cred(&min_stat, *gss_cred, NULL, NULL,
-				     NULL, NULL) != GSS_S_COMPLETE)
-			ret = -1;
+		maj_stat = gss_inquire_cred(&min_stat, *gss_cred, 
+			NULL, NULL, NULL, NULL);
+		if (maj_stat != GSS_S_COMPLETE) {
+			if (get_verbosity() > 0)
+				pgsserr("gss_inquire_cred",
+					maj_stat, min_stat, &krb5oid);
+				ret = -1;
+			}
 	}
 
 	return ret;
diff -up nfs-utils-1.3.0/utils/gssd/Makefile.am.orig nfs-utils-1.3.0/utils/gssd/Makefile.am
--- nfs-utils-1.3.0/utils/gssd/Makefile.am.orig	2016-04-15 11:42:13.942461126 -0400
+++ nfs-utils-1.3.0/utils/gssd/Makefile.am	2016-04-15 11:42:38.367938385 -0400
@@ -29,7 +29,6 @@ COMMON_SRCS = \
 gssd_SOURCES = \
 	$(COMMON_SRCS) \
 	gssd.c \
-	gssd_main_loop.c \
 	gssd_proc.c \
 	krb5_util.c \
 	\
@@ -37,12 +36,23 @@ gssd_SOURCES = \
 	krb5_util.h \
 	write_bytes.h
 
-gssd_LDADD =	../../support/nfs/libnfs.a \
-		$(RPCSECGSS_LIBS) $(KRBLIBS) $(GSSAPI_LIBS)
-gssd_LDFLAGS = $(KRBLDFLAGS) $(LIBTIRPC)
+gssd_LDADD = \
+	../../support/nfs/libnfs.a \
+	$(LIBEVENT) \
+	$(RPCSECGSS_LIBS) \
+	$(KRBLIBS) \
+	$(GSSAPI_LIBS) \
+	$(LIBTIRPC)
 
-gssd_CFLAGS = $(AM_CFLAGS) $(CFLAGS) \
-	      $(RPCSECGSS_CFLAGS) $(KRBCFLAGS) $(GSSAPI_CFLAGS)
+gssd_LDFLAGS = \
+	$(KRBLDFLAGS)
+
+gssd_CFLAGS = \
+	$(AM_CFLAGS) \
+	$(CFLAGS) \
+	$(RPCSECGSS_CFLAGS) \
+	$(KRBCFLAGS) \
+	$(GSSAPI_CFLAGS)
 
 svcgssd_SOURCES = \
 	$(COMMON_SRCS) \
diff -up nfs-utils-1.3.0/utils/gssd/svcgssd.c.orig nfs-utils-1.3.0/utils/gssd/svcgssd.c
--- nfs-utils-1.3.0/utils/gssd/svcgssd.c.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/utils/gssd/svcgssd.c	2016-04-15 11:42:38.372938482 -0400
@@ -62,8 +62,6 @@
 #include "gss_util.h"
 #include "err_util.h"
 
-static int pipefds[2] = { -1, -1 };
-
 void
 sig_die(int signal)
 {
@@ -137,6 +135,13 @@ main(int argc, char *argv[])
 	if (verbosity && rpc_verbosity == 0)
 		rpc_verbosity = verbosity;
 	authgss_set_debug_level(rpc_verbosity);
+#elif HAVE_LIBTIRPC_SET_DEBUG
+        /*
+	 * Only set the libtirpc debug level if explicitly requested via -r...
+	 * svcgssd is chatty enough as it is.
+	 */
+        if (rpc_verbosity > 0)
+                libtirpc_set_debug(progname, rpc_verbosity, fg);
 #else
 	if (rpc_verbosity > 0)
 		printerr(0, "Warning: rpcsec_gss library does not "
@@ -157,8 +162,7 @@ main(int argc, char *argv[])
 		exit(1);
 	}
 
-	if (!fg)
-		mydaemon(0, 0, pipefds);
+	daemon_init(fg);
 
 	signal(SIGINT, sig_die);
 	signal(SIGTERM, sig_die);
@@ -187,8 +191,7 @@ main(int argc, char *argv[])
 		}
 	}
 
-	if (!fg)
-		release_parent(pipefds);
+	daemon_ready();
 
 	nfs4_init_name_mapping(NULL); /* XXX: should only do this once */
 	gssd_run();
diff -up nfs-utils-1.3.0/utils/idmapd/idmapd.c.orig nfs-utils-1.3.0/utils/idmapd/idmapd.c
--- nfs-utils-1.3.0/utils/idmapd/idmapd.c.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/utils/idmapd/idmapd.c	2016-04-15 11:42:38.373938502 -0400
@@ -164,7 +164,6 @@ static char pipefsdir[PATH_MAX];
 static char *nobodyuser, *nobodygroup;
 static uid_t nobodyuid;
 static gid_t nobodygid;
-static int pipefds[2] = { -1, -1 };
 
 /* Used by conffile.c in libnfs.a */
 char *conf_path;
@@ -302,8 +301,7 @@ main(int argc, char **argv)
 	if (nfs4_init_name_mapping(conf_path))
 		errx(1, "Unable to create name to user id mappings.");
 
-	if (!fg)
-		mydaemon(0, 0, pipefds);
+	daemon_init(fg);
 
 	event_init();
 
@@ -380,7 +378,7 @@ main(int argc, char **argv)
 	if (nfsdret != 0 && fd == 0)
 		xlog_err("main: Neither NFS client nor NFSd found");
 
-	release_parent(pipefds);
+	daemon_ready();
 
 	if (event_dispatch() < 0)
 		xlog_err("main: event_dispatch returns errno %d (%s)",
diff -up nfs-utils-1.3.0/utils/statd/statd.c.orig nfs-utils-1.3.0/utils/statd/statd.c
--- nfs-utils-1.3.0/utils/statd/statd.c.orig	2014-03-25 11:12:07.000000000 -0400
+++ nfs-utils-1.3.0/utils/statd/statd.c	2016-04-15 11:42:38.373938502 -0400
@@ -248,13 +248,12 @@ int main (int argc, char **argv)
 	int nlm_udp = 0, nlm_tcp = 0;
 	struct rlimit rlim;
 
-	int pipefds[2] = { -1, -1};
-	char status;
-
 	/* Default: daemon mode, no other options */
 	run_mode = 0;
-	xlog_stderr(0);
-	xlog_syslog(1);
+
+	/* Log to stderr if there's an error during startup */
+	xlog_stderr(1);
+	xlog_syslog(0);
 
 	/* Set the basename */
 	if ((name_p = strrchr(argv[0],'/')) != NULL) {
@@ -394,52 +393,17 @@ int main (int argc, char **argv)
 		simulator (--argc, ++argv);	/* simulator() does exit() */
 #endif
 
-	if (!(run_mode & MODE_NODAEMON)) {
-		int tempfd;
-
-		if (pipe(pipefds)<0) {
-			perror("statd: unable to create pipe");
-			exit(1);
-		}
-		if ((pid = fork ()) < 0) {
-			perror ("statd: Could not fork");
-			exit (1);
-		} else if (pid != 0) {
-			/* Parent.
-			 * Wait for status from child.
-			 */
-			close(pipefds[1]);
-			if (read(pipefds[0], &status, 1) != 1)
-				exit(1);
-			exit (0);
-		}
-		/* Child.	*/
-		close(pipefds[0]);
-		setsid ();
-
-		while (pipefds[1] <= 2) {
-			pipefds[1] = dup(pipefds[1]);
-			if (pipefds[1]<0) {
-				perror("statd: dup");
-				exit(1);
-			}
-		}
-		tempfd = open("/dev/null", O_RDWR);
-		dup2(tempfd, 0);
-		dup2(tempfd, 1);
-		dup2(tempfd, 2);
-		dup2(pipefds[1], 3);
-		pipefds[1] = 3;
-		closeall(4);
-	}
-
-	/* Child. */
+	daemon_init((run_mode & MODE_NODAEMON));
 
 	if (run_mode & MODE_LOG_STDERR) {
 		xlog_syslog(0);
 		xlog_stderr(1);
 		xlog_config(D_ALL, 1);
+	} else {
+		xlog_syslog(1);
+		xlog_stderr(0);
 	}
+
 	xlog_open(name_p);
 	xlog(L_NOTICE, "Version " VERSION " starting");
 
@@ -512,16 +476,8 @@ int main (int argc, char **argv)
 	}
 	atexit(statd_unregister);
 
-	/* If we got this far, we have successfully started, so notify parent */
-	if (pipefds[1] > 0) {
-		status = 0;
-		if (write(pipefds[1], &status, 1) != 1) {
-			xlog_warn("writing to parent pipe failed: errno %d (%s)\n",
-				errno, strerror(errno));
-		}
-		close(pipefds[1]);
-		pipefds[1] = -1;
-	}
+	/* If we got this far, we have successfully started */
+	daemon_ready();
 
 	for (;;) {
 		/*