Attachment #1197 for bug #1245

View | Details | Raw Unified | Return to bug 1245
Collapse All | Expand All

Lines 166-173 Link Here

(-)auth-krb5.c (-2 / +15 lines)
166		166
167	len = strlen(authctxt->krb5_ticket_file) + 6;	167	len = strlen(authctxt->krb5_ticket_file) + 6;
168	authctxt->krb5_ccname = xmalloc(len);	168	authctxt->krb5_ccname = xmalloc(len);
		169	#ifdef USE_CCAPI
		170	snprintf(authctxt->krb5_ccname, len, "API:%s",
		171	authctxt->krb5_ticket_file);
		172	#else
169	snprintf(authctxt->krb5_ccname, len, "FILE:%s",	173	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
170	authctxt->krb5_ticket_file);	174	authctxt->krb5_ticket_file);
		175	#endif
171		176
172	#ifdef USE_PAM	177	#ifdef USE_PAM
173	if (options.use_pam)	178	if (options.use_pam)
Lines 219-233 Link Here
219	#ifndef HEIMDAL	224	#ifndef HEIMDAL
220	krb5_error_code	225	krb5_error_code
221	ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {	226	ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
222	int tmpfd, ret;	227	int ret;
223	char ccname[40];	228	char ccname[40];
224	mode_t old_umask;	229	mode_t old_umask;
		230	#ifdef USE_CCAPI
		231	char cctemplate[] = "API:krb5cc_%d";
		232	#else
		233	char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";
		234	int tmpfd;
		235	#endif
225		236
226	ret = snprintf(ccname, sizeof(ccname),	237	ret = snprintf(ccname, sizeof(ccname),
227	"FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());	238	cctemplate, geteuid());
228	if (ret < 0 \|\| (size_t)ret >= sizeof(ccname))	239	if (ret < 0 \|\| (size_t)ret >= sizeof(ccname))
229	return ENOMEM;	240	return ENOMEM;
230		241
		242	#ifndef USE_CCAPI
231	old_umask = umask(0177);	243	old_umask = umask(0177);
232	tmpfd = mkstemp(ccname + strlen("FILE:"));	244	tmpfd = mkstemp(ccname + strlen("FILE:"));
233	umask(old_umask);	245	umask(old_umask);
Lines 242-247 Link Here
242	return errno;	254	return errno;
243	}	255	}
244	close(tmpfd);	256	close(tmpfd);
		257	#endif
245		258
246	return (krb5_cc_resolve(ctx, ccname, ccache));	259	return (krb5_cc_resolve(ctx, ccname, ccache));
247	}	260	}




	    [Use tunnel device compatibility to OpenBSD])
	AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
	    [Prepend the address family to IP tunnel traffic])
	AC_MSG_CHECKING(if we have the Security Authorization Session API)
	AC_TRY_COMPILE([#include <Security/AuthSession.h>],
		[SessionCreate(0, 0);],
		[ac_cv_use_security_session_api="yes"
		 AC_DEFINE(USE_SECURITY_SESSION_API, 1, 
			[platform has the Security Authorization Session API])
		 LIBS="$LIBS -framework Security"
		 AC_MSG_RESULT(yes)],
		[ac_cv_use_security_session_api="no"
		 AC_MSG_RESULT(no)])
	AC_MSG_CHECKING(if we have an in-memory credentials cache)
	AC_TRY_COMPILE(
		[#include <Kerberos/Kerberos.h>],
		[cc_context_t c;
		 (void) cc_initialize (&c, 0, NULL, NULL);],
		[AC_DEFINE(USE_CCAPI, 1, 
			[platform uses an in-memory credentials cache])
		 LIBS="$LIBS -framework Security"
		 AC_MSG_RESULT(yes)
		 if test "x$ac_cv_use_security_session_api" = "xno"; then
			AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
		fi],
		[AC_MSG_RESULT(no)]
	)
  	;;
*-*-dragonfly*)
	SSHDLIBS="$SSHDLIBS -lcrypt"
	;;

Lines 168-178 Link Here

(-)gss-serv-krb5.c (-4 / +9 lines)
168	return;	168	return;
169	}	169	}
170		170
171	client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));	171	const char* new_ccname = krb5_cc_get_name(krb_context, ccache);
		172
172	client->store.envvar = "KRB5CCNAME";	173	client->store.envvar = "KRB5CCNAME";
173	len = strlen(client->store.filename) + 6;	174	#ifdef USE_CCAPI
174	client->store.envval = xmalloc(len);	175	xasprintf(&client->store.envval, "API:%s", new_ccname);
175	snprintf(client->store.envval, len, "FILE:%s", client->store.filename);	176	client->store.filename = NULL;
		177	#else
		178	xasprintf(&client->store.envval, "FILE:%s", new_ccname);
		179	client->store.filename = xstrdup(new_ccname);
		180	#endif
176		181
177	#ifdef USE_PAM	182	#ifdef USE_PAM
178	if (options.use_pam)	183	if (options.use_pam)

Lines 117-122 Link Here

(-)sshd.c (+58 lines)
117	#include "monitor_fdpass.h"	117	#include "monitor_fdpass.h"
118	#include "version.h"	118	#include "version.h"
119		119
		120	#ifdef USE_SECURITY_SESSION_API
		121	#include <Security/AuthSession.h>
		122	#endif
		123
120	#ifdef LIBWRAP	124	#ifdef LIBWRAP
121	#include <tcpd.h>	125	#include <tcpd.h>
122	#include <syslog.h>	126	#include <syslog.h>
Lines 1749-1754 Link Here
1749		1753
1750	/* Log the connection. */	1754	/* Log the connection. */
1751	verbose("Connection from %.500s port %d", remote_ip, remote_port);	1755	verbose("Connection from %.500s port %d", remote_ip, remote_port);
		1756
		1757	#ifdef USE_SECURITY_SESSION_API
		1758	/*
		1759	* Create a new security session for use by the new user login if
		1760	* the current session is the root session or we are not launched
		1761	* by inetd (eg: debugging mode or server mode). We do not
		1762	* necessarily need to create a session if we are launched from
		1763	* inetd because Panther xinetd will create a session for us.
		1764	*
		1765	* The only case where this logic will fail is if there is an
		1766	* inetd running in a non-root session which is not creating
		1767	* new sessions for us. Then all the users will end up in the
		1768	* same session (bad).
		1769	*
		1770	* When the client exits, the session will be destroyed for us
		1771	* automatically.
		1772	*
		1773	* We must create the session before any credentials are stored
		1774	* (including AFS pags, which happens a few lines below).
		1775	*/
		1776	{
		1777	OSStatus err = 0;
		1778	SecuritySessionId sid = 0;
		1779	SessionAttributeBits sattrs = 0;
		1780
		1781	err = SessionGetInfo(callerSecuritySession, &sid, &sattrs);
		1782	if (err)
		1783	error("SessionGetInfo() failed with error %.8X",
		1784	(unsigned) err);
		1785	else
		1786	debug("Current Session ID is %.8X / Session Attributes are %.8X",
		1787	(unsigned) sid, (unsigned) sattrs);
		1788
		1789	if (inetd_flag && !(sattrs & sessionIsRoot))
		1790	debug("Running in inetd mode in a non-root session... "
		1791	"assuming inetd created the session for us.");
		1792	else {
		1793	debug("Creating new security session...");
		1794	err = SessionCreate(0, sessionHasTTY \| sessionIsRemote);
		1795	if (err)
		1796	error("SessionCreate() failed with error %.8X",
		1797	(unsigned) err);
		1798
		1799	err = SessionGetInfo(callerSecuritySession, &sid,
		1800	&sattrs);
		1801	if (err)
		1802	error("SessionGetInfo() failed with error %.8X",
		1803	(unsigned) err);
		1804	else
		1805	debug("New Session ID is %.8X / Session Attributes are %.8X",
		1806	(unsigned) sid, (unsigned) sattrs);
		1807	}
		1808	}
		1809	#endif
1752		1810
1753	/*	1811	/*
1754	* We don't want to listen forever unless the other side	1812	* We don't want to listen forever unless the other side

Return to bug 1245

Lines 273-279 Link Here

(-)configure.ac (-1 / +25 lines)
273	[Use tunnel device compatibility to OpenBSD])	273	[Use tunnel device compatibility to OpenBSD])
274	AC_DEFINE(SSH_TUN_PREPEND_AF, 1,	274	AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
275	[Prepend the address family to IP tunnel traffic])	275	[Prepend the address family to IP tunnel traffic])
276	;;	276	AC_MSG_CHECKING(if we have the Security Authorization Session API)
		277	AC_TRY_COMPILE([#include <Security/AuthSession.h>],
		278	[SessionCreate(0, 0);],
		279	[ac_cv_use_security_session_api="yes"
		280	AC_DEFINE(USE_SECURITY_SESSION_API, 1,
		281	[platform has the Security Authorization Session API])
		282	LIBS="$LIBS -framework Security"
		283	AC_MSG_RESULT(yes)],
		284	[ac_cv_use_security_session_api="no"
		285	AC_MSG_RESULT(no)])
		286	AC_MSG_CHECKING(if we have an in-memory credentials cache)
		287	AC_TRY_COMPILE(
		288	[#include <Kerberos/Kerberos.h>],
		289	[cc_context_t c;
		290	(void) cc_initialize (&c, 0, NULL, NULL);],
		291	[AC_DEFINE(USE_CCAPI, 1,
		292	[platform uses an in-memory credentials cache])
		293	LIBS="$LIBS -framework Security"
		294	AC_MSG_RESULT(yes)
		295	if test "x$ac_cv_use_security_session_api" = "xno"; then
		296	AC_MSG_ERROR(* Need a security framework to use the credentials cache API *)
		297	fi],
		298	[AC_MSG_RESULT(no)]
		299	)
		300	;;
277	--dragonfly*)	301	--dragonfly*)
278	SSHDLIBS="$SSHDLIBS -lcrypt"	302	SSHDLIBS="$SSHDLIBS -lcrypt"
279	;;	303	;;