X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/7364bd04fc18484f99f74b901c4581795bcf2787..495795e1042da83d07e68e13e0b570c8cc619d24:/gss-serv-krb5.c

diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index d8687225..91d87f79 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gss-serv-krb5.c,v 1.1 2003/08/22 10:56:09 markus Exp $	*/
+/*	$OpenBSD: gss-serv-krb5.c,v 1.3 2004/07/21 10:36:23 djm Exp $	*/
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -38,14 +38,22 @@
 
 extern ServerOptions options;
 
-#include <krb5.h>
+#ifdef HEIMDAL
+# include <krb5.h>
+#else
+# ifdef HAVE_GSSAPI_KRB5
+#  include <gssapi_krb5.h>
+# elif HAVE_GSSAPI_GSSAPI_KRB5
+#  include <gssapi/gssapi_krb5.h>
+# endif
+#endif
 
 static krb5_context krb_context = NULL;
 
 /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
 
-static int 
-ssh_gssapi_krb5_init()
+static int
+ssh_gssapi_krb5_init(void)
 {
 	krb5_error_code problem;
 
@@ -57,7 +65,9 @@ ssh_gssapi_krb5_init()
 		logit("Cannot initialize krb5 context");
 		return 0;
 	}
+#ifdef KRB5_INIT_ETS
 	krb5_init_ets(krb_context);
+#endif
 
 	return 1;
 }
@@ -104,6 +114,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 	krb5_error_code problem;
 	krb5_principal princ;
 	OM_uint32 maj_status, min_status;
+	int len;
 
 	if (client->creds == NULL) {
 		debug("No credentials stored");
@@ -113,13 +124,45 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 	if (ssh_gssapi_krb5_init() == 0)
 		return;
 
+#ifdef HEIMDAL
 	if ((problem = krb5_cc_gen_new(krb_context, &krb5_fcc_ops, &ccache))) {
 		logit("krb5_cc_gen_new(): %.100s",
 		    krb5_get_err_text(krb_context, problem));
 		return;
 	}
+#else
+	{
+		int tmpfd;
+		char ccname[40];
+		mode_t old_umask;
+
+		snprintf(ccname, sizeof(ccname),
+		    "FILE:/tmp/krb5cc_%d_XXXXXX", geteuid());
+
+		old_umask = umask(0177);
+		tmpfd = mkstemp(ccname + strlen("FILE:"));
+		umask(old_umask);
+		if (tmpfd == -1) {
+			logit("mkstemp(): %.100s", strerror(errno));
+			problem = errno;
+			return;
+		}
+		if (fchmod(tmpfd, S_IRUSR | S_IWUSR) == -1) {
+			logit("fchmod(): %.100s", strerror(errno));
+			close(tmpfd);
+			problem = errno;
+			return;
+		}
+		close(tmpfd);
+		if ((problem = krb5_cc_resolve(krb_context, ccname, &ccache))) {
+			logit("krb5_cc_resolve(): %.100s",
+			    krb5_get_err_text(krb_context, problem));
+			return;
+		}
+	}
+#endif	/* #ifdef HEIMDAL */
 
-	if ((problem = krb5_parse_name(krb_context, 
+	if ((problem = krb5_parse_name(krb_context,
 	    client->exportedname.value, &princ))) {
 		logit("krb5_parse_name(): %.100s",
 		    krb5_get_err_text(krb_context, problem));
@@ -137,7 +180,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 
 	krb5_free_principal(krb_context, princ);
 
-	if ((maj_status = gss_krb5_copy_ccache(&min_status, 
+	if ((maj_status = gss_krb5_copy_ccache(&min_status,
 	    client->creds, ccache))) {
 		logit("gss_krb5_copy_ccache() failed");
 		krb5_cc_destroy(krb_context, ccache);
@@ -146,7 +189,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 
 	client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
 	client->store.envvar = "KRB5CCNAME";
-	client->store.envval = xstrdup(client->store.filename);
+	len = strlen(client->store.filename) + 6;
+	client->store.envval = xmalloc(len);
+	snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
+
+#ifdef USE_PAM
+	if (options.use_pam)
+		do_pam_putenv(client->store.envvar, client->store.envval);
+#endif
 
 	krb5_cc_close(krb_context, ccache);