X-Git-Url: http://andersk.mit.edu/gitweb/gssapi-openssh.git/blobdiff_plain/5ff39d34a50802bab296b50eb09d097062e07f03..196fbaad2b9568f127b7070b562f40ba71078d71:/openssh/gss-serv.c diff --git a/openssh/gss-serv.c b/openssh/gss-serv.c index 39cdb3f..ca1370f 100644 --- a/openssh/gss-serv.c +++ b/openssh/gss-serv.c @@ -1,5 +1,7 @@ +/* $OpenBSD: gss-serv.c,v 1.22 2008/05/08 12:02:23 djm Exp $ */ + /* - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -26,355 +28,476 @@ #ifdef GSSAPI -#include "ssh.h" -#include "ssh2.h" +#include +#include + +#include +#include +#include + +#include "openbsd-compat/sys-queue.h" #include "xmalloc.h" #include "buffer.h" -#include "bufaux.h" -#include "packet.h" -#include "compat.h" -#include -#include "cipher.h" -#include "kex.h" +#include "key.h" +#include "hostfile.h" #include "auth.h" #include "log.h" #include "channels.h" #include "session.h" -#include "dispatch.h" +#include "misc.h" #include "servconf.h" -#include "compat.h" -#include "monitor_wrap.h" +#include "uidswap.h" +#include "xmalloc.h" #include "ssh-gss.h" +#include "monitor_wrap.h" extern ServerOptions options; -extern u_char *session_id2; -extern int session_id2_len; +extern Authctxt *the_authctxt; static ssh_gssapi_client gssapi_client = - { {0,NULL}, GSS_C_NO_CREDENTIAL, NULL, {NULL,NULL,NULL}}; + { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, + GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, NULL, {NULL, NULL, NULL}, 0, 0}; -ssh_gssapi_mech gssapi_null_mech - = {NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL}; +ssh_gssapi_mech gssapi_null_mech = + { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL}; #ifdef KRB5 extern ssh_gssapi_mech gssapi_kerberos_mech; -extern ssh_gssapi_mech gssapi_kerberos_mech_old; #endif #ifdef GSI extern ssh_gssapi_mech gssapi_gsi_mech; -extern ssh_gssapi_mech gssapi_gsi_mech_old; #endif ssh_gssapi_mech* supported_mechs[]= { #ifdef KRB5 - &gssapi_kerberos_mech, - &gssapi_kerberos_mech_old, /* Support for legacy clients */ + &gssapi_kerberos_mech, #endif #ifdef GSI - &gssapi_gsi_mech, - &gssapi_gsi_mech_old, /* Support for legacy clients */ + &gssapi_gsi_mech, #endif - &gssapi_null_mech, + &gssapi_null_mech, }; -/* Return a list of the gss-group1-sha1-x mechanisms supported by this - * program. - * - * We only support the mechanisms that we've indicated in the list above, - * but we check that they're supported by the GSSAPI mechanism on the - * machine. We also check, before including them in the list, that - * we have the necesary information in order to carry out the key exchange - * (that is, that the user has credentials, the server's creds are accessible, - * etc) - * - * The way that this is done is fairly nasty, as we do a lot of work that - * is then thrown away. This should possibly be implemented with a cache - * that stores the results (in an expanded Gssctxt structure), which are - * then used by the first calls if that key exchange mechanism is chosen. +#ifdef GSS_C_GLOBUS_LIMITED_PROXY_FLAG +static int limited = 0; +#endif + +/* + * Acquire credentials for a server running on the current host. + * Requires that the context structure contains a valid OID */ -/* Unpriviledged */ -char * -ssh_gssapi_server_mechanisms() { - gss_OID_set supported; - Gssctxt *ctx = NULL; - OM_uint32 maj_status, min_status; - Buffer buf; - int i = 0; - int first = 0; - int present; - char * mechs; - - if (datafellows & SSH_OLD_GSSAPI) return NULL; - - ssh_gssapi_supported_oids(&supported); - - buffer_init(&buf); - - while(supported_mechs[i]->name != NULL) { - if ((maj_status=gss_test_oid_set_member(&min_status, - &supported_mechs[i]->oid, - supported, - &present))) { - present=0; +/* Returns a GSSAPI error code */ +/* Privileged (called from ssh_gssapi_server_ctx) */ +static OM_uint32 +ssh_gssapi_acquire_cred(Gssctxt *ctx) +{ + OM_uint32 status; + char lname[MAXHOSTNAMELEN]; + gss_OID_set oidset; + + if (options.gss_strict_acceptor) { + gss_create_empty_oid_set(&status, &oidset); + gss_add_oid_set_member(&status, ctx->oid, &oidset); + + if (gethostname(lname, MAXHOSTNAMELEN)) { + gss_release_oid_set(&status, &oidset); + return (-1); } - if (present) { - if (!GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, - &supported_mechs[i]->oid)))) { - /* Append gss_group1_sha1_x to our list */ - if (first++!=0) - buffer_put_char(&buf,','); - buffer_append(&buf, KEX_GSS_SHA1, - sizeof(KEX_GSS_SHA1)-1); - buffer_append(&buf, - supported_mechs[i]->enc_name, - strlen(supported_mechs[i]->enc_name)); - debug("GSSAPI mechanism %s (%s%s) supported", - supported_mechs[i]->name, KEX_GSS_SHA1, - supported_mechs[i]->enc_name); - } else { - debug("no credentials for GSSAPI mechanism %s", - supported_mechs[i]->name); - } - } else { - debug("GSSAPI mechanism %s not supported", - supported_mechs[i]->name); + if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) { + gss_release_oid_set(&status, &oidset); + return (ctx->major); } - ssh_gssapi_delete_ctx(&ctx); - i++; + + if ((ctx->major = gss_acquire_cred(&ctx->minor, + ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, + NULL, NULL))) + ssh_gssapi_error(ctx); + + gss_release_oid_set(&status, &oidset); + return (ctx->major); + } else { + ctx->name = GSS_C_NO_NAME; + ctx->creds = GSS_C_NO_CREDENTIAL; } - - buffer_put_char(&buf,'\0'); - - mechs=xmalloc(buffer_len(&buf)); - buffer_get(&buf,mechs,buffer_len(&buf)); - buffer_free(&buf); - if (strlen(mechs)==0) - return(NULL); - else - return(mechs); + return GSS_S_COMPLETE; } -/* Unpriviledged */ -void ssh_gssapi_supported_oids(gss_OID_set *oidset) { - int i =0; - OM_uint32 maj_status,min_status; +/* Privileged */ +OM_uint32 +ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) +{ + if (*ctx) + ssh_gssapi_delete_ctx(ctx); + ssh_gssapi_build_ctx(ctx); + ssh_gssapi_set_oid(*ctx, oid); + return (ssh_gssapi_acquire_cred(*ctx)); +} + +/* Unprivileged */ +char * +ssh_gssapi_server_mechanisms() { + gss_OID_set supported; + + ssh_gssapi_supported_oids(&supported); + return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech, + NULL, NULL)); +} + +/* Unprivileged */ +int +ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data, + const char *dummy) { + Gssctxt *ctx = NULL; + int res; + + res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid))); + ssh_gssapi_delete_ctx(&ctx); + + return (res); +} + +/* Unprivileged */ +void +ssh_gssapi_supported_oids(gss_OID_set *oidset) +{ + int i = 0; + OM_uint32 min_status; int present; gss_OID_set supported; - - gss_create_empty_oid_set(&min_status,oidset); - PRIVSEP(gss_indicate_mechs(&min_status, &supported)); - - while (supported_mechs[i]->name!=NULL) { - if ((maj_status=gss_test_oid_set_member(&min_status, - &supported_mechs[i]->oid, - supported, - &present))) { - present=0; - } - if (present) { + + gss_create_empty_oid_set(&min_status, oidset); + + /* Ask privileged process what mechanisms it supports. */ + if (GSS_ERROR(PRIVSEP(gss_indicate_mechs(&min_status, &supported)))) + return; + + while (supported_mechs[i]->name != NULL) { + if (GSS_ERROR(gss_test_oid_set_member(&min_status, + &supported_mechs[i]->oid, supported, &present))) + present = 0; + if (present) gss_add_oid_set_member(&min_status, - &supported_mechs[i]->oid, - oidset); - } + &supported_mechs[i]->oid, oidset); i++; } -} -/* Find out which GSS type (out of the list we define in ssh-gss.h) a - * particular connection is using - */ - -/* Priviledged (called ssh_gssapi_accept_ctx -> ssh_gssapi_getclient ->) */ -ssh_gssapi_mech * -ssh_gssapi_get_ctype(Gssctxt *ctxt) { - int i=0; - - while(supported_mechs[i]->name!=NULL) { - if (supported_mechs[i]->oid.length == ctxt->oid->length && - (memcmp(supported_mechs[i]->oid.elements, - ctxt->oid->elements,ctxt->oid->length)==0)) { - return supported_mechs[i]; - } - i++; - } - return NULL; + gss_release_oid_set(&min_status, &supported); } -/* Return the OID that corresponds to the given context name */ - -/* Unpriviledged */ -gss_OID -ssh_gssapi_server_id_kex(char *name) { - int i=0; - - if (strncmp(name, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1) !=0) { - return(NULL); - } - - name+=sizeof(KEX_GSS_SHA1)-1; /* Move to the start of the MIME string */ - - while (supported_mechs[i]->name!=NULL && - strcmp(name,supported_mechs[i]->enc_name)!=0) { - i++; - } - - if (supported_mechs[i]->name==NULL) - return (NULL); - - debug("using GSSAPI mechanism %s (%s%s)", supported_mechs[i]->name, - KEX_GSS_SHA1, supported_mechs[i]->enc_name); - - return &supported_mechs[i]->oid; -} /* Wrapper around accept_sec_context * Requires that the context contains: - * oid + * oid * credentials (from ssh_gssapi_acquire_cred) */ -/* Priviledged */ -OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *ctx,gss_buffer_desc *recv_tok, - gss_buffer_desc *send_tok, OM_uint32 *flags) +/* Privileged */ +OM_uint32 +ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *recv_tok, + gss_buffer_desc *send_tok, OM_uint32 *flags) { OM_uint32 status; gss_OID mech; - - ctx->major=gss_accept_sec_context(&ctx->minor, - &ctx->context, - ctx->creds, - recv_tok, - GSS_C_NO_CHANNEL_BINDINGS, - &ctx->client, - &mech, /* read-only pointer */ - send_tok, - flags, - NULL, - &ctx->client_creds); - if (GSS_ERROR(ctx->major)) { + + ctx->major = gss_accept_sec_context(&ctx->minor, + &ctx->context, ctx->creds, recv_tok, + GSS_C_NO_CHANNEL_BINDINGS, &ctx->client, &mech, + send_tok, flags, NULL, &ctx->client_creds); + + if (GSS_ERROR(ctx->major)) ssh_gssapi_error(ctx); - } - - if (ctx->client_creds) { + + if (ctx->client_creds) debug("Received some client credentials"); - } else { + else debug("Got no client credentials"); - } - /* FIXME: We should check that the me - * the one that we asked for (in ctx->oid) */ + status = ctx->major; - status=ctx->major; - /* Now, if we're complete and we have the right flags, then * we flag the user as also having been authenticated */ - - if (((flags==NULL) || ((*flags & GSS_C_MUTUAL_FLAG) && - (*flags & GSS_C_INTEG_FLAG))) && - (ctx->major == GSS_S_COMPLETE)) { - if (ssh_gssapi_getclient(ctx,&gssapi_client.mech, - &gssapi_client.name, - &gssapi_client.creds)) - fatal("Couldn't convert client name"); + + if (((flags == NULL) || ((*flags & GSS_C_MUTUAL_FLAG) && + (*flags & GSS_C_INTEG_FLAG))) && (ctx->major == GSS_S_COMPLETE)) { + if (ssh_gssapi_getclient(ctx, &gssapi_client)) + fatal("Couldn't convert client name"); +#ifdef GSS_C_GLOBUS_LIMITED_PROXY_FLAG + if (flags && (*flags & GSS_C_GLOBUS_LIMITED_PROXY_FLAG)) + limited=1; +#endif } - /* Make sure that the getclient call hasn't stamped on this */ - return(status); + return (status); +} + +/* + * This parses an exported name, extracting the mechanism specific portion + * to use for ACL checking. It verifies that the name belongs the mechanism + * originally selected. + */ +static OM_uint32 +ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name) +{ + u_char *tok; + OM_uint32 offset; + OM_uint32 oidl; + + tok = ename->value; + +#ifdef GSI /* GSI gss_export_name() is broken. */ + if ((ctx->oid->length == gssapi_gsi_mech.oid.length) && + (memcmp(ctx->oid->elements, gssapi_gsi_mech.oid.elements, + gssapi_gsi_mech.oid.length) == 0)) { + name->length = ename->length; + name->value = xmalloc(ename->length+1); + memcpy(name->value, ename->value, ename->length); + return GSS_S_COMPLETE; + } +#endif + + /* + * Check that ename is long enough for all of the fixed length + * header, and that the initial ID bytes are correct + */ + + if (ename->length < 6 || memcmp(tok, "\x04\x01", 2) != 0) + return GSS_S_FAILURE; + + /* + * Extract the OID, and check it. Here GSSAPI breaks with tradition + * and does use the OID type and length bytes. To confuse things + * there are two lengths - the first including these, and the + * second without. + */ + + oidl = get_u16(tok+2); /* length including next two bytes */ + oidl = oidl-2; /* turn it into the _real_ length of the variable OID */ + + /* + * Check the BER encoding for correct type and length, that the + * string is long enough and that the OID matches that in our context + */ + if (tok[4] != 0x06 || tok[5] != oidl || + ename->length < oidl+6 || + !ssh_gssapi_check_oid(ctx, tok+6, oidl)) + return GSS_S_FAILURE; + + offset = oidl+6; + + if (ename->length < offset+4) + return GSS_S_FAILURE; + + name->length = get_u32(tok+offset); + offset += 4; + + if (ename->length < offset+name->length) + return GSS_S_FAILURE; + + name->value = xmalloc(name->length+1); + memcpy(name->value, tok+offset, name->length); + ((char *)name->value)[name->length] = 0; + + return GSS_S_COMPLETE; } /* Extract the client details from a given context. This can only reliably * be called once for a context */ -/* Priviledged (called from accept_secure_ctx) */ -OM_uint32 -ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_mech **type, - gss_buffer_desc *name, gss_cred_id_t *creds) { +/* Privileged (called from accept_secure_ctx) */ +OM_uint32 +ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) +{ + int i = 0; + int equal = 0; + gss_name_t new_name = GSS_C_NO_NAME; + gss_buffer_desc ename = GSS_C_EMPTY_BUFFER; + + if (options.gss_store_rekey && client->used && ctx->client_creds) { + if (client->mech->oid.length != ctx->oid->length || + (memcmp(client->mech->oid.elements, + ctx->oid->elements, ctx->oid->length) !=0)) { + debug("Rekeyed credentials have different mechanism"); + return GSS_S_COMPLETE; + } + + /* Call gss_inquire_cred rather than gss_inquire_cred_by_mech + because GSI doesn't support the latter. -jbasney */ + + if ((ctx->major = gss_inquire_cred(&ctx->minor, + ctx->client_creds, &new_name, + NULL, NULL, NULL))) { + ssh_gssapi_error(ctx); + return (ctx->major); + } + + ctx->major = gss_compare_name(&ctx->minor, client->name, + new_name, &equal); - *type=ssh_gssapi_get_ctype(ctx); - if ((ctx->major=gss_display_name(&ctx->minor,ctx->client,name,NULL))) { + if (GSS_ERROR(ctx->major)) { + ssh_gssapi_error(ctx); + return (ctx->major); + } + + if (!equal) { + debug("Rekeyed credentials have different name"); + return GSS_S_COMPLETE; + } + + debug("Marking rekeyed credentials for export"); + + gss_release_name(&ctx->minor, &client->name); + gss_release_cred(&ctx->minor, &client->creds); + client->name = new_name; + client->creds = ctx->client_creds; + ctx->client_creds = GSS_C_NO_CREDENTIAL; + client->updated = 1; + return GSS_S_COMPLETE; + } + + client->mech = NULL; + + while (supported_mechs[i]->name != NULL) { + if (supported_mechs[i]->oid.length == ctx->oid->length && + (memcmp(supported_mechs[i]->oid.elements, + ctx->oid->elements, ctx->oid->length) == 0)) + client->mech = supported_mechs[i]; + i++; + } + + if (client->mech == NULL) + return GSS_S_FAILURE; + + /* Call gss_inquire_cred rather than gss_inquire_cred_by_mech + because GSI doesn't support the latter. -jbasney */ + + if (ctx->client_creds && + (ctx->major = gss_inquire_cred(&ctx->minor, + ctx->client_creds, &client->name, NULL, NULL, NULL))) { ssh_gssapi_error(ctx); - return(ctx->major); + return (ctx->major); } - - /* This is icky. There appears to be no way to copy this structure, - * rather than the pointer to it, so we simply copy the pointer and - * mark the originator as empty so we don't destroy it. - */ - *creds=ctx->client_creds; - ctx->client_creds=GSS_C_NO_CREDENTIAL; - return(ctx->major); + + if ((ctx->major = gss_display_name(&ctx->minor, ctx->client, + &client->displayname, NULL))) { + ssh_gssapi_error(ctx); + return (ctx->major); + } + + if ((ctx->major = gss_export_name(&ctx->minor, ctx->client, + &ename))) { + ssh_gssapi_error(ctx); + return (ctx->major); + } + + if ((ctx->major = ssh_gssapi_parse_ename(ctx,&ename, + &client->exportedname))) { + return (ctx->major); + } + + gss_release_buffer(&ctx->minor, &ename); + + /* We can't copy this structure, so we just move the pointer to it */ + client->creds = ctx->client_creds; + ctx->client_creds = GSS_C_NO_CREDENTIAL; + + /* needed for globus_gss_assist_map_and_authorize() */ + client->context = ctx->context; + + return (ctx->major); } -/* As user - called through fatal cleanup hook */ +/* As user - called on fatal/exit */ void -ssh_gssapi_cleanup_creds(void *ignored) +ssh_gssapi_cleanup_creds(void) { - if (gssapi_client.store.filename!=NULL) { + if (gssapi_client.store.filename != NULL) { /* Unlink probably isn't sufficient */ - debug("removing gssapi cred file\"%s\"",gssapi_client.store.filename); + debug("removing gssapi cred file\"%s\"", + gssapi_client.store.filename); unlink(gssapi_client.store.filename); } } /* As user */ -void -ssh_gssapi_storecreds() +void +ssh_gssapi_storecreds(void) { if (gssapi_client.mech && gssapi_client.mech->storecreds) { + if (options.gss_creds_path) { + gssapi_client.store.filename = + expand_authorized_keys(options.gss_creds_path, + the_authctxt->pw); + } (*gssapi_client.mech->storecreds)(&gssapi_client); - if (options.gss_cleanup_creds) { - fatal_add_cleanup(ssh_gssapi_cleanup_creds, NULL); - } - } else { + } else debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism"); - } } /* This allows GSSAPI methods to do things to the childs environment based * on the passed authentication process and credentials. */ /* As user */ -void -ssh_gssapi_do_child(char ***envp, u_int *envsizep) +void +ssh_gssapi_do_child(char ***envp, u_int *envsizep) { - if (gssapi_client.store.envvar!=NULL && - gssapi_client.store.envval!=NULL) { - + if (gssapi_client.store.envvar != NULL && + gssapi_client.store.envval != NULL) { debug("Setting %s to %s", gssapi_client.store.envvar, - gssapi_client.store.envval); - child_set_env(envp, envsizep, gssapi_client.store.envvar, - gssapi_client.store.envval); + gssapi_client.store.envval); + child_set_env(envp, envsizep, gssapi_client.store.envvar, + gssapi_client.store.envval); } } -/* Priviledged */ +/* Privileged */ int -ssh_gssapi_userok(char *user) +ssh_gssapi_userok(char *user, struct passwd *pw, int gssapi_keyex) { - if (gssapi_client.name.length==0 || - gssapi_client.name.value==NULL) { + OM_uint32 lmin; + + if (gssapi_client.exportedname.length == 0 || + gssapi_client.exportedname.value == NULL) { debug("No suitable client data"); return 0; } - if (gssapi_client.mech && gssapi_client.mech->userok) { - return((*gssapi_client.mech->userok)(&gssapi_client,user)); - } else { - debug("ssh_gssapi_userok: Unknown GSSAPI mechanism"); +#ifdef GSS_C_GLOBUS_LIMITED_PROXY_FLAG + if (limited && options.gsi_allow_limited_proxy != 1) { + debug("limited proxy not acceptable for remote login"); + return 0; } - return(0); +#endif + if (gssapi_client.mech && gssapi_client.mech->userok) + if ((*gssapi_client.mech->userok)(&gssapi_client, user)) { + gssapi_client.used = 1; + gssapi_client.store.owner = pw; + return 1; + } else { + /* Destroy delegated credentials if userok fails */ + gss_release_buffer(&lmin, &gssapi_client.displayname); + gss_release_buffer(&lmin, &gssapi_client.exportedname); + gss_release_cred(&lmin, &gssapi_client.creds); + memset(&gssapi_client, 0, sizeof(ssh_gssapi_client)); + return 0; + } + else + debug("ssh_gssapi_userok: Unknown GSSAPI mechanism"); + return (0); } +/* ssh_gssapi_checkmic() moved to gss-genr.c so it can be called by + kexgss_client(). */ + /* Priviledged */ int ssh_gssapi_localname(char **user) { *user = NULL; - if (gssapi_client.name.length==0 || - gssapi_client.name.value==NULL) { + if (gssapi_client.displayname.length==0 || + gssapi_client.displayname.value==NULL) { debug("No suitable client data"); return(0);; } @@ -385,4 +508,112 @@ ssh_gssapi_localname(char **user) } return(0); } + +/* These bits are only used for rekeying. The unpriviledged child is running + * as the user, the monitor is root. + * + * In the child, we want to : + * *) Ask the monitor to store our credentials into the store we specify + * *) If it succeeds, maybe do a PAM update + */ + +/* Stuff for PAM */ + +#ifdef USE_PAM +static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, + struct pam_response **resp, void *data) +{ + return (PAM_CONV_ERR); +} +#endif + +void +ssh_gssapi_rekey_creds() { + int ok; +#ifdef USE_PAM + int ret; + pam_handle_t *pamh = NULL; + struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL}; + char *envstr; + char **p;char **pw; +#endif + + if (gssapi_client.store.filename == NULL && + gssapi_client.store.envval == NULL && + gssapi_client.store.envvar == NULL) + return; + + ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store)); + + if (!ok) + return; + + debug("Rekeyed credentials stored successfully"); + + /* Actually managing to play with the ssh pam stack from here will + * be next to impossible. In any case, we may want different options + * for rekeying. So, use our own :) + */ +#ifdef USE_PAM + if (!use_privsep) { + debug("Not even going to try and do PAM with privsep disabled"); + return; + } + + ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name, + &pamconv, &pamh); + if (ret) + return; + + /* Put ssh pam stack env variables in this new pam stack env + * Using pam-pkinit, KRB5CCNAME is set during do_pam_session + * this addition enables pam-pkinit to access KRB5CCNAME if used + * in sshd-rekey stack too + */ + pw = p = fetch_pam_environment(); + while ( *pw != NULL ) { + pam_putenv(pamh,*pw); + pw++; + } + free_pam_environment(p); + + xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, + gssapi_client.store.envval); + + ret = pam_putenv(pamh, envstr); + if (!ret) + pam_setcred(pamh, PAM_REINITIALIZE_CRED); + pam_end(pamh, PAM_SUCCESS); +#endif +} + +int +ssh_gssapi_update_creds(ssh_gssapi_ccache *store) { + int ok = 0; + + /* Check we've got credentials to store */ + if (!gssapi_client.updated) + return 0; + + gssapi_client.updated = 0; + + temporarily_use_uid(gssapi_client.store.owner); + if (gssapi_client.mech && gssapi_client.mech->updatecreds) + ok = (*gssapi_client.mech->updatecreds)(store, &gssapi_client); + else + debug("No update function for this mechanism"); + + restore_uid(); + + return ok; +} + +void +ssh_gssapi_get_client_info(char **userdn, char **mech) { + *userdn = gssapi_client.displayname.value; + + if (gssapi_client.mech) + *mech = gssapi_client.mech->name; +} + #endif