- djm@cvs.openbsd.org 2010/01/30 02:54:53

[openssh.git] / gss-serv-krb5.c

diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index d868722589a765ecbcf38666b057fa6b3e386f9f..5a625acb89a6bad1f4c45d452376c9de0c318aca 100644 (file)
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: gss-serv-krb5.c,v 1.1 2003/08/22 10:56:09 markus Exp $        */
+/* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -29,23 +29,39 @@
 #ifdef GSSAPI
 #ifdef KRB5
 
-#include "auth.h"
+#include <sys/types.h>
+
+#include <stdarg.h>
+#include <string.h>
+
 #include "xmalloc.h"
+#include "key.h"
+#include "hostfile.h"
+#include "auth.h"
 #include "log.h"
 #include "servconf.h"
 
+#include "buffer.h"
 #include "ssh-gss.h"
 
 extern ServerOptions options;
 
-#include <krb5.h>
+#ifdef HEIMDAL
+# include <krb5.h>
+#else
+# ifdef HAVE_GSSAPI_KRB5_H
+#  include <gssapi_krb5.h>
+# elif HAVE_GSSAPI_GSSAPI_KRB5_H
+#  include <gssapi/gssapi_krb5.h>
+# endif
+#endif
 
 static krb5_context krb_context = NULL;
 
 /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
 
-static int 
-ssh_gssapi_krb5_init()
+static int
+ssh_gssapi_krb5_init(void)
 {
        krb5_error_code problem;
 
@@ -57,7 +73,6 @@ ssh_gssapi_krb5_init()
                logit("Cannot initialize krb5 context");
                return 0;
        }
-       krb5_init_ets(krb_context);
 
        return 1;
 }
@@ -104,6 +119,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
        krb5_error_code problem;
        krb5_principal princ;
        OM_uint32 maj_status, min_status;
+       int len;
 
        if (client->creds == NULL) {
                debug("No credentials stored");
@@ -113,13 +129,21 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
        if (ssh_gssapi_krb5_init() == 0)
                return;
 
+#ifdef HEIMDAL
        if ((problem = krb5_cc_gen_new(krb_context, &krb5_fcc_ops, &ccache))) {
                logit("krb5_cc_gen_new(): %.100s",
                    krb5_get_err_text(krb_context, problem));
                return;
        }
+#else
+       if ((problem = ssh_krb5_cc_gen(krb_context, &ccache))) {
+               logit("ssh_krb5_cc_gen(): %.100s",
+                   krb5_get_err_text(krb_context, problem));
+               return;
+       }
+#endif /* #ifdef HEIMDAL */
 
-       if ((problem = krb5_parse_name(krb_context, 
+       if ((problem = krb5_parse_name(krb_context,
            client->exportedname.value, &princ))) {
                logit("krb5_parse_name(): %.100s",
                    krb5_get_err_text(krb_context, problem));
@@ -137,7 +161,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 
        krb5_free_principal(krb_context, princ);
 
-       if ((maj_status = gss_krb5_copy_ccache(&min_status, 
+       if ((maj_status = gss_krb5_copy_ccache(&min_status,
            client->creds, ccache))) {
                logit("gss_krb5_copy_ccache() failed");
                krb5_cc_destroy(krb_context, ccache);
@@ -146,7 +170,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 
        client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
        client->store.envvar = "KRB5CCNAME";
-       client->store.envval = xstrdup(client->store.filename);
+       len = strlen(client->store.filename) + 6;
+       client->store.envval = xmalloc(len);
+       snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
+
+#ifdef USE_PAM
+       if (options.use_pam)
+               do_pam_putenv(client->store.envvar, client->store.envval);
+#endif
 
        krb5_cc_close(krb_context, ccache);