- (dtucker) [configure.ac openbsd-compat/bsd-getpeereid.c] Bug #1287: Use

   getpeerucred to implement getpeereid (currently only Solaris 10 and up).
   Patch by Jan.Pechanec at Sun.

diff --git a/ChangeLog b/ChangeLog
index ee09b1d83c6e91b6e32dda5a13fd8a0a7d659259..2431f8934b0262eae9352702312f52901548fdf9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -29,6 +29,9 @@
      - sort FILES
      - +.Xr ssh-keyscan 1 ,
      from Igor Sobrado
+ - (dtucker) [configure.ac openbsd-compat/bsd-getpeereid.c] Bug #1287: Use
+   getpeerucred to implement getpeereid (currently only Solaris 10 and up).
+   Patch by Jan.Pechanec at Sun.
 
 20070313
  - (dtucker) [entropy.c scard-opensc.c ssh-rand-helper.c] Bug #1294: include

diff --git a/configure.ac b/configure.ac
index a07aa3c3d75705795abf765a2193e27fb8c1158b..73aa8999669cd7b5a0fff9021389b1cb4cc35955 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1241,6 +1241,7 @@ AC_CHECK_FUNCS( \
        getnameinfo \
        getopt \
        getpeereid \
+       getpeerucred \
        _getpty \
        getrlimit \
        getttyent \
@@ -1489,7 +1490,7 @@ AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
 
 # Check for missing getpeereid (or equiv) support
 NO_PEERCHECK=""
-if test "x$ac_cv_func_getpeereid" != "xyes" ; then
+if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
        AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
        AC_TRY_COMPILE(
                [#include <sys/types.h>
@@ -4030,12 +4031,12 @@ if test ! -z "$RAND_HELPER_CMDHASH" ; then
 fi
 
 if test ! -z "$NO_PEERCHECK" ; then
-       echo "WARNING: the operating system that you are using does not "
-       echo "appear to support either the getpeereid() API nor the "
-       echo "SO_PEERCRED getsockopt() option. These facilities are used to "
-       echo "enforce security checks to prevent unauthorised connections to "
-       echo "ssh-agent. Their absence increases the risk that a malicious "
-       echo "user can connect to your agent. "
+       echo "WARNING: the operating system that you are using does not"
+       echo "appear to support getpeereid(), getpeerucred() or the"
+       echo "SO_PEERCRED getsockopt() option. These facilities are used to"
+       echo "enforce security checks to prevent unauthorised connections to"
+       echo "ssh-agent. Their absence increases the risk that a malicious"
+       echo "user can connect to your agent."
        echo ""
 fi
 

diff --git a/openbsd-compat/bsd-getpeereid.c b/openbsd-compat/bsd-getpeereid.c
index bdae8b637f47f26c49ca95ca04f961628b075723..5f7e677e5cdf3e75fc73d3b6c462346aae4ec572 100644 (file)
--- a/openbsd-compat/bsd-getpeereid.c
+++ b/openbsd-compat/bsd-getpeereid.c
@@ -37,6 +37,28 @@ getpeereid(int s, uid_t *euid, gid_t *gid)
 
        return (0);
 }
+#elif defined(HAVE_GETPEERUCRED)
+
+#ifdef HAVE_UCRED_H
+# include <ucred.h>
+#endif
+
+int
+getpeereid(int s, uid_t *euid, gid_t *gid)
+{
+       ucred_t *ucred = NULL;
+
+       if (getpeerucred(s, &ucred) == -1)
+               return (-1);
+       if ((*euid = ucred_geteuid(ucred)) == -1)
+               return (-1);
+       if ((*gid = ucred_getrgid(ucred)) == -1)
+               return (-1);
+
+       ucred_free(ucred);
+
+       return (0);
+}
 #else
 int
 getpeereid(int s, uid_t *euid, gid_t *gid)