Attachment 612140 Details for Bug 848228 – use kerberos5 DIR cache storage

[patch] use kerberos5 DIR cache storage

openssh-krb5-dir-cache.patch (text/plain), 4.47 KB, created by Petr Lautrbach on 2012-09-12 14:57:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Petr Lautrbach

Created: 2012-09-12 14:57:38 UTC

Size: 4.47 KB

patch

obsolete

>diff --git a/auth-krb5.c b/auth-krb5.c
>index 8219133..58bc96b 100644
>--- a/auth-krb5.c
>+++ b/auth-krb5.c
>@@ -50,6 +50,7 @@
> #include <errno.h>
> #include <unistd.h>
> #include <string.h>
>+#include <sys/stat.h>
> #include <krb5.h>
> 
> extern ServerOptions	 options;
>@@ -174,7 +175,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
> 	snprintf(authctxt->krb5_ccname, len, "API:%s",
> 	    authctxt->krb5_ticket_file);
> #else
>-	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
>+	snprintf(authctxt->krb5_ccname, len, "DIR:%s",
> 	    authctxt->krb5_ticket_file);
> #endif
> 
>@@ -213,10 +214,33 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
> void
> krb5_cleanup_proc(Authctxt *authctxt)
> {
>+	struct stat krb5_ccname_stat;
>+	char krb5_ccname[128], *krb5_ccname_dir_end;
>+
> 	debug("krb5_cleanup_proc called");
> 	if (authctxt->krb5_fwd_ccache) {
> 		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
> 		authctxt->krb5_fwd_ccache = NULL;
>+
>+		/* assume ticket cache type DIR - DIR::/tmp/krb5cc_876600005_T9eDKSQvzb/tkt */
>+		strncpy(krb5_ccname, authctxt->krb5_ccname + strlen("DIR::"), sizeof(krb5_ccname) - 10);
>+
>+		krb5_ccname_dir_end = strrchr(krb5_ccname, '/');
>+		if (krb5_ccname_dir_end != NULL) {
>+			strcpy(krb5_ccname_dir_end, "/primary");
>+
>+			if (stat(krb5_ccname, &krb5_ccname_stat) == 0) {
>+				if (unlink(krb5_ccname) == 0) {
>+					*krb5_ccname_dir_end = '\0';
>+					if (rmdir(krb5_ccname) == -1)
>+						debug("cache dir '%s' remove failed: %s", krb5_ccname, strerror(errno));
>+				}
>+				else
>+					debug("cache primary file '%s', remove failed: %s",
>+						krb5_ccname, strerror(errno)
>+					);
>+			}
>+		}
> 	}
> 	if (authctxt->krb5_user) {
> 		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
>@@ -237,8 +261,8 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
> #ifdef USE_CCAPI
> 	char cctemplate[] = "API:krb5cc_%d";
> #else
>-	char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";
>-	int tmpfd;
>+	char cctemplate[] = "DIR:/tmp/krb5cc_%d_XXXXXXXXXX";
>+	char *tmpdir;
> #endif
> 
> 	ret = snprintf(ccname, sizeof(ccname),
>@@ -247,20 +271,18 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
> 		return ENOMEM;
> 
> #ifndef USE_CCAPI
>-	old_umask = umask(0177);
>-	tmpfd = mkstemp(ccname + strlen("FILE:"));
>+	old_umask = umask(0077);
>+	tmpdir = mkdtemp(ccname + strlen("DIR:"));
> 	umask(old_umask);
>-	if (tmpfd == -1) {
>-		logit("mkstemp(): %.100s", strerror(errno));
>+	if (tmpdir == NULL) {
>+		logit("mkdtemp(): %.100s", strerror(errno));
> 		return errno;
> 	}
>-
>-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
>-		logit("fchmod(): %.100s", strerror(errno));
>-		close(tmpfd);
>+	if (chmod(tmpdir, S_IRUSR | S_IWUSR | S_IXUSR) == -1) {
>+		logit("chmod(): %.100s", strerror(errno));
> 		return errno;
> 	}
>-	close(tmpfd);
>+
> #endif
> 
> 	return (krb5_cc_resolve(ctx, ccname, ccache));
>diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
>index e7170ee..066dddc 100644
>--- a/gss-serv-krb5.c
>+++ b/gss-serv-krb5.c
>@@ -176,7 +176,9 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
> 	xasprintf(&client->store.envval, "API:%s", new_ccname);
> 	client->store.filename = NULL;
> #else
>-	xasprintf(&client->store.envval, "FILE:%s", new_ccname);
>+	xasprintf(&client->store.envval, "DIR:%s", new_ccname);
>+	if (new_ccname[0] == ':')
>+		new_ccname++;
> 	client->store.filename = xstrdup(new_ccname);
> #endif
> 
>diff --git a/gss-serv.c b/gss-serv.c
>index d15e5e6..f45a7fe 100644
>--- a/gss-serv.c
>+++ b/gss-serv.c
>@@ -378,11 +378,33 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
> void
> ssh_gssapi_cleanup_creds(void)
> {
>+	struct stat krb5_ccname_stat;
>+	char krb5_ccname[128], *krb5_ccname_dir_end;
>+
> 	if (gssapi_client.store.filename != NULL) {
> 		/* Unlink probably isn't sufficient */
> 		debug("removing gssapi cred file\"%s\"",
> 		    gssapi_client.store.filename);
> 		unlink(gssapi_client.store.filename);
>+
>+		/* Ticket cache: DIR::/tmp/krb5cc_876600005_T9eDKSQvzb/tkt */
>+		/* same code as in auth-krb5.c:krb5_cleanup_proc */
>+		strncpy(krb5_ccname, gssapi_client.store.filename, sizeof(krb5_ccname) - 10);
>+		krb5_ccname_dir_end = strrchr(krb5_ccname, '/');
>+		if (krb5_ccname_dir_end != NULL)
>+			strcpy(krb5_ccname_dir_end, "/primary");
>+
>+		if (stat(krb5_ccname, &krb5_ccname_stat) == 0) {
>+			if (unlink(krb5_ccname) == 0) {
>+				*krb5_ccname_dir_end = '\0';
>+				if (rmdir(krb5_ccname) == -1)
>+					debug("cache dir '%s' remove failed: %s", krb5_ccname, strerror(errno));
>+			}
>+			else
>+				debug("cache primary file '%s', remove failed: %s",
>+					krb5_ccname, strerror(errno)
>+				);
>+		}
> 	}
> }
>

Actions: View | Diff

Attachments on bug 848228: 612140