components/network/hpn-ssh/patches/0006-GSS-store-creds-for-Solaris.patch

   1 --- hpn-ssh-hpn-18.4.2/configure.ac.orig
   2 +++ hpn-ssh-hpn-18.4.2/configure.ac
   3 @@ -1169,6 +1169,9 @@
   4                 ],
   5         )
   6         TEST_SHELL=$SHELL       # let configure find us a capable shell
   7 +       AC_DEFINE([USE_GSS_STORE_CRED], [1], [Use the Solaris-style GSS cred store])
   8 +       AC_DEFINE([GSSAPI_STORECREDS_NEEDS_RUID], [1], [GSSAPI storecreds needs ruid])
   9 +       AC_DEFINE([HAVE_PAM_AUSER], [1], [pam_auser])
  10         ;;
  11  *-*-sunos4*)
  12         CPPFLAGS="$CPPFLAGS -DSUNOS4"
  13 --- hpn-ssh-hpn-18.4.2/gss-serv-krb5.c.orig
  14 +++ hpn-ssh-hpn-18.4.2/gss-serv-krb5.c
  15 @@ -109,7 +109,7 @@
  16         return retval;
  17  }
  18
  19 -
  20 +#ifndef USE_GSS_STORE_CRED
  21  /* This writes out any forwarded credentials from the structure populated
  22   * during userauth. Called after we have setuid to the user */
  23
  24 @@ -195,6 +195,7 @@
  25
  26         return;
  27  }
  28 +#endif /* #ifndef USE_GSS_STORE_CRED */
  29
  30  ssh_gssapi_mech gssapi_kerberos_mech = {
  31         "toWM5Slw5Ew8Mqkay+al2g==",
  32 @@ -203,7 +204,11 @@
  33         NULL,
  34         &ssh_gssapi_krb5_userok,
  35         NULL,
  36 +#ifdef USE_GSS_STORE_CRED
  37 +       NULL
  38 +#else
  39         &ssh_gssapi_krb5_storecreds
  40 +#endif
  41  };
  42
  43  #endif /* KRB5 */
  44 --- hpn-ssh-hpn-18.4.2/gss-serv.c.orig
  45 +++ hpn-ssh-hpn-18.4.2/gss-serv.c
  46 @@ -44,6 +44,7 @@
  47  #include "session.h"
  48  #include "misc.h"
  49  #include "servconf.h"
  50 +#include "sshbuf.h"
  51
  52  #include "ssh-gss.h"
  53
  54 @@ -319,22 +320,66 @@
  55  void
  56  ssh_gssapi_cleanup_creds(void)
  57  {
  58 +#ifdef USE_GSS_STORE_CRED
  59 +       debug("removing gssapi cred file not implemented");
  60 +#else
  61         if (gssapi_client.store.filename != NULL) {
  62                 /* Unlink probably isn't sufficient */
  63                 debug("removing gssapi cred file\"%s\"",
  64                     gssapi_client.store.filename);
  65                 unlink(gssapi_client.store.filename);
  66         }
  67 +#endif /* USE_GSS_STORE_CRED */
  68  }
  69
  70  /* As user */
  71  void
  72  ssh_gssapi_storecreds(void)
  73  {
  74 +#ifdef USE_GSS_STORE_CRED
  75 +       OM_uint32 maj_status, min_status;
  76 +
  77 +       if (gssapi_client.creds == NULL) {
  78 +               debug("No credentials stored");
  79 +               return;
  80 +       }
  81 +
  82 +       maj_status = gss_store_cred(&min_status, gssapi_client.creds,
  83 +           GSS_C_INITIATE, &gssapi_client.mech->oid, 1, 1, NULL, NULL);
  84 +
  85 +       if (GSS_ERROR(maj_status)) {
  86 +               struct sshbuf *b;
  87 +               gss_buffer_desc msg;
  88 +               OM_uint32 lmin;
  89 +               OM_uint32 more = 0;
  90 +               if ((b = sshbuf_new()) == NULL) fatal("malloc");
  91 +               /* GSS-API error */
  92 +               do {
  93 +                       gss_display_status(&lmin, maj_status, GSS_C_GSS_CODE,
  94 +                           GSS_C_NULL_OID, &more, &msg);
  95 +                       sshbuf_put(b, msg.value, msg.length);
  96 +                       sshbuf_put(b, "\n", 1);
  97 +                       gss_release_buffer(&lmin, &msg);
  98 +               } while (more != 0);
  99 +               /* Mechanism specific error */
 100 +               do {
 101 +                       gss_display_status(&lmin, min_status, GSS_C_MECH_CODE,
 102 +                           &gssapi_client.mech->oid, &more, &msg);
 103 +                       sshbuf_put(b, msg.value, msg.length);
 104 +                       sshbuf_put(b, "\n", 1);
 105 +                       gss_release_buffer(&lmin, &msg);
 106 +               } while (more != 0);
 107 +               sshbuf_put(b, "\0", 1);
 108 +               error("GSS-API error while storing delegated credentials: %s",
 109 +                   sshbuf_ptr(b));
 110 +               sshbuf_free(b);
 111 +       }
 112 +#else  /* #ifdef USE_GSS_STORE_CRED */
 113         if (gssapi_client.mech && gssapi_client.mech->storecreds) {
 114                 (*gssapi_client.mech->storecreds)(&gssapi_client);
 115         } else
 116                 debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
 117 +#endif /* #ifdef USE_GSS_STORE_CRED */
 118  }
 119
 120  /* This allows GSSAPI methods to do things to the child's environment based
 121 --- hpn-ssh-hpn-18.4.2/servconf.c.orig
 122 +++ hpn-ssh-hpn-18.4.2/servconf.c
 123 @@ -620,7 +620,11 @@
 124         { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
 125  #ifdef GSSAPI
 126         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
 127 +#ifdef USE_GSS_STORE_CRED
 128 +       { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 129 +#else /* USE_GSS_STORE_CRED */
 130         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
 131 +#endif /* USE_GSS_STORE_CRED */
 132         { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 133  #else
 134         { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 135 --- hpn-ssh-hpn-18.4.2/sshd.c.orig
 136 +++ hpn-ssh-hpn-18.4.2/sshd.c
 137 @@ -2313,9 +2313,23 @@
 138
 139  #ifdef GSSAPI
 140         if (options.gss_authentication) {
 141 +#ifdef GSSAPI_STORECREDS_NEEDS_RUID
 142 +               if (setreuid(authctxt->pw->pw_uid, -1) != 0) {
 143 +                       debug("setreuid %u: %.100s",
 144 +                           (u_int) authctxt->pw->pw_uid, strerror(errno));
 145 +                       goto bail_storecred;
 146 +               }
 147 +#endif
 148                 temporarily_use_uid(authctxt->pw);
 149                 ssh_gssapi_storecreds();
 150                 restore_uid();
 151 +#ifdef GSSAPI_STORECREDS_NEEDS_RUID
 152 +               if (setuid(geteuid()) != 0) {
 153 +                       fatal("setuid %u: %.100s", (u_int) geteuid(),
 154 +                           strerror(errno));
 155 +               }
 156 + bail_storecred: ;
 157 +#endif
 158         }
 159  #endif
 160  #ifdef USE_PAM