[5281] in Kerberos
Re: K5B5 krb524
daemon@ATHENA.MIT.EDU (Wolfgang Rupprecht)
Thu May 25 23:25:30 1995
To: kerberos@MIT.EDU
Date: 25 May 1995 19:44:17 -0700
From: wolfgang@wsrcc.com (Wolfgang Rupprecht)
u751@sas-hp.nersc.gov (Jonathan Brown) writes:
>I tried to build krb524 for Kerberos 5 beta 5. The compiler complained
>about cnv_tkt_skey.c because a number of function calls are missing the
>new context argument. Also, there is no configure script. Has anyone
>fixed this yet, or will it be done soon?
It looks like there are a bunch of "context" param botches. When the
function definitions were changed to include this new first parameter
many of the function calls were never changed. This resulted in quite
a few calls passing parameters that were shifted by one word on the
stack. I found a handful of them down in the ksu sources. Appended
are my local diffs for ksu. Perhaps someone else has gone through
other parts of the sources and found the missing contexts there?
-wolfgang
(ps. These ksu diffs also add a new flag "-s" for "sudo" or "save the
environment". I like my shell and hate being forced to use other
user's default shells when I su to them.)
#
# patch generated by wolfgang on Thu May 25 19:34:51 PDT 1995
# in directory wsrcc.com:/v/src/krb5.5/src/clients/ksu .
# Patched files are:
#
# ccache.c
# heuristic.c
# krb_auth_su.c
# ksu.h
# main.c
#
*** orig/ccache.c Fri Jan 13 14:00:42 1995
--- ccache.c Tue May 9 13:45:38 1995
***************
*** 234,244 ****
return retval;
}
if (auth_debug){
fprintf(stderr,"krb5_ccache_copy: CREDS EXPIRED:\n");
fputs(" Valid starting Expires Service principal\n",stdout);
! show_credential(&creds, cc);
fprintf(stderr,"\n");
}
}
else { /* these credentials didn't expire */
--- 234,244 ----
return retval;
}
if (auth_debug){
fprintf(stderr,"krb5_ccache_copy: CREDS EXPIRED:\n");
fputs(" Valid starting Expires Service principal\n",stdout);
! show_credential(context, &creds, cc);
fprintf(stderr,"\n");
}
}
else { /* these credentials didn't expire */
*** orig/heuristic.c Fri Jan 13 14:00:44 1995
--- heuristic.c Tue May 16 22:04:28 1995
***************
*** 415,425 ****
cc_source_name = krb5_cc_get_name(context, cc);
if ( ! stat(cc_source_name, &st_temp)){
! if (retval = find_ticket (cc, client, end_server, &temp_found)) {
return retval;
}
if (temp_found == FALSE){
--- 415,425 ----
cc_source_name = krb5_cc_get_name(context, cc);
if ( ! stat(cc_source_name, &st_temp)){
! if (retval = find_ticket (context, cc, client, end_server, &temp_found)) {
return retval;
}
if (temp_found == FALSE){
***************
*** 428,438 ****
krb5_princ_realm(context, client),
&kdc_server)){
return retval ;
}
! if(retval = find_ticket (cc,client, kdc_server, &temp_found)) {
return retval;
}
}
else {
if (auth_debug)
--- 428,438 ----
krb5_princ_realm(context, client),
&kdc_server)){
return retval ;
}
! if(retval = find_ticket (context, cc,client, kdc_server, &temp_found)) {
return retval;
}
}
else {
if (auth_debug)
***************
*** 682,699 ****
princ_trials[i].found = FALSE;
}
for (i= 0; i < count; i ++){
if(princ_trials[i].p){
! if (retval= find_princ_in_list(princ_trials[i].p, aplist, &found)){
return retval;
}
if ( found == TRUE){
princ_trials[i].found = TRUE;
! if (retval = find_either_ticket (cc_source, princ_trials[i].p,
end_server, &found)){
return retval;
}
if (found == TRUE){
*client = princ_trials[i].p;
--- 682,699 ----
princ_trials[i].found = FALSE;
}
for (i= 0; i < count; i ++){
if(princ_trials[i].p){
! if (retval= find_princ_in_list(context, princ_trials[i].p, aplist, &found)){
return retval;
}
if ( found == TRUE){
princ_trials[i].found = TRUE;
! if (retval = find_either_ticket (context, cc_source, princ_trials[i].p,
end_server, &found)){
return retval;
}
if (found == TRUE){
*client = princ_trials[i].p;
***************
*** 714,724 ****
if (retval = krb5_parse_name(context, aplist[i], &temp_client)){
return retval;
}
! if (retval = find_either_ticket (cc_source, temp_client,
end_server, &found)){
return retval;
}
if (found == TRUE){
if (auth_debug){
--- 714,724 ----
if (retval = krb5_parse_name(context, aplist[i], &temp_client)){
return retval;
}
! if (retval = find_either_ticket (context, cc_source, temp_client,
end_server, &found)){
return retval;
}
if (found == TRUE){
if (auth_debug){
***************
*** 760,770 ****
}
/* get the client name that is the closest
to the three princ in trials */
! if(retval=get_closest_principal(aplist, &temp_client, & found)){
return retval;
}
if (found == TRUE){
*client = temp_client;
--- 760,770 ----
}
/* get the client name that is the closest
to the three princ in trials */
! if(retval=get_closest_principal(context, aplist, &temp_client, & found)){
return retval;
}
if (found == TRUE){
*client = temp_client;
*** orig/krb_auth_su.c Thu Feb 23 05:26:23 1995
--- krb_auth_su.c Tue May 9 13:45:38 1995
***************
*** 80,90 ****
com_err(prog_name, retval,"while copying client principal");
return (FALSE) ;
}
if (auth_debug)
! { dump_principal("krb5_auth_check: Client principal name", client); }
if ( retval = krb5_sname_to_principal(context, hostname, NULL,
KRB5_NT_SRV_HST, &server)){
com_err(prog_name, retval,
"while creating server %s principal name", hostname);
--- 80,90 ----
com_err(prog_name, retval,"while copying client principal");
return (FALSE) ;
}
if (auth_debug)
! { dump_principal(context, "krb5_auth_check: Client principal name", client); }
if ( retval = krb5_sname_to_principal(context, hostname, NULL,
KRB5_NT_SRV_HST, &server)){
com_err(prog_name, retval,
"while creating server %s principal name", hostname);
***************
*** 91,101 ****
krb5_free_principal(context, client);
return (FALSE) ;
}
if (auth_debug)
! { dump_principal("krb5_auth_check: Server principal name", server); }
/* check if ticket is already in the cache, if it is
then use it.
--- 91,101 ----
krb5_free_principal(context, client);
return (FALSE) ;
}
if (auth_debug)
! { dump_principal(context, "krb5_auth_check: Server principal name", server); }
/* check if ticket is already in the cache, if it is
then use it.
***************
*** 121,131 ****
krb5_free_principal(context, client);
krb5_free_principal(context, server);
return (FALSE) ;
}
! if (auth_debug){ dump_principal("local tgt principal name", tgtq.server ); }
retval = krb5_cc_retrieve_cred(context, cc, KRB5_TC_MATCH_SRV_NAMEONLY,
&tgtq, &tgt);
if (! retval) retval = krb5_check_exp(context, tgt.times);
--- 121,131 ----
krb5_free_principal(context, client);
krb5_free_principal(context, server);
return (FALSE) ;
}
! if (auth_debug){ dump_principal(context, "local tgt principal name", tgtq.server ); }
retval = krb5_cc_retrieve_cred(context, cc, KRB5_TC_MATCH_SRV_NAMEONLY,
&tgtq, &tgt);
if (! retval) retval = krb5_check_exp(context, tgt.times);
***************
*** 179,189 ****
}
if (auth_debug){
fprintf(stderr,"krb5_auth_check: got ticket for end server \n");
! dump_principal("out_creds->server", out_creds->server );
}
if (tgts){
register int i =0;
--- 179,189 ----
}
if (auth_debug){
fprintf(stderr,"krb5_auth_check: got ticket for end server \n");
! dump_principal(context, "out_creds->server", out_creds->server );
}
if (tgts){
register int i =0;
***************
*** 291,302 ****
return KRB5KRB_AP_WRONG_PRINC;
}
if (auth_debug){
fprintf(stderr,"krb5_verify_tkt_def: verified target server\n");
! dump_principal("server", server);
! dump_principal("tkt->server", tkt->server);
}
/* get the default keytab */
if( retval = krb5_kt_default(context, &keytabid)){
krb5_free_ticket(context, tkt);
--- 291,302 ----
return KRB5KRB_AP_WRONG_PRINC;
}
if (auth_debug){
fprintf(stderr,"krb5_verify_tkt_def: verified target server\n");
! dump_principal(context, "server", server);
! dump_principal(context, "tkt->server", tkt->server);
}
/* get the default keytab */
if( retval = krb5_kt_default(context, &keytabid)){
krb5_free_ticket(context, tkt);
***************
*** 338,349 ****
}
if (auth_debug){
fprintf(stderr,
"krb5_verify_tkt_def: verified client's identity\n");
! dump_principal("client", client);
! dump_principal("tkt->enc_part2->client",tkt->enc_part2->client);
}
tkt_ses_key = tkt->enc_part2->session;
if (cred_ses_key->keytype != tkt_ses_key->keytype ||
--- 338,349 ----
}
if (auth_debug){
fprintf(stderr,
"krb5_verify_tkt_def: verified client's identity\n");
! dump_principal(context, "client", client);
! dump_principal(context, "tkt->enc_part2->client",tkt->enc_part2->client);
}
tkt_ses_key = tkt->enc_part2->session;
if (cred_ses_key->keytype != tkt_ses_key->keytype ||
No differences encountered
*** orig/main.c Thu Mar 16 20:53:15 1995
--- main.c Mon May 15 11:20:34 1995
***************
*** 74,83 ****
--- 74,84 ----
char localhostname [MAXHOSTNAMELEN];
opt_info options;
int option=0;
int statusp=0;
int use_source_cache = 0;
+ int ksudo = 0;
krb5_error_code retval = 0;
krb5_principal client = NULL;
krb5_ccache cc_target = NULL;
krb5_context ksu_context;
char * cc_target_tag = NULL;
***************
*** 166,176 ****
pargv[i] = argv[i + 1];
}
}
! while(!done && ((option = getopt(pargc, pargv,"n:c:C:r:a:zZDfpkql:e:")) != EOF)){
switch (option) {
case 'r':
options.opt |= KDC_OPT_RENEWABLE;
retval = krb5_parse_lifetime(ksu_context, optarg, &options.rlife);
if (retval != 0 || options.rlife == 0) {
--- 167,177 ----
pargv[i] = argv[i + 1];
}
}
! while(!done && ((option = getopt(pargc, pargv,"n:c:C:r:a:zZDfpkqsl:e:")) != EOF)){
switch (option) {
case 'r':
options.opt |= KDC_OPT_RENEWABLE;
retval = krb5_parse_lifetime(ksu_context, optarg, &options.rlife);
if (retval != 0 || options.rlife == 0) {
***************
*** 308,317 ****
--- 309,321 ----
if (auth_debug){
fprintf(stderr,"Command to be executed: %s\n", cmd);
}
break;
+ case 's':
+ ksudo++;
+ break;
case '?':
default:
errflg++;
break;
}
***************
*** 419,429 ****
fprintf(stderr,
"GET_best_princ_for_target result: NOT AUTHORIZED\n");
}else{
fprintf(stderr,
"GET_best_princ_for_target result-best principal ");
! plain_dump_principal (client);
fprintf(stderr,"\n");
}
}
if (hp){
--- 423,433 ----
fprintf(stderr,
"GET_best_princ_for_target result: NOT AUTHORIZED\n");
}else{
fprintf(stderr,
"GET_best_princ_for_target result-best principal ");
! plain_dump_principal (ksu_context, client);
fprintf(stderr,"\n");
}
}
if (hp){
***************
*** 694,740 ****
}
/* get the shell of the user, this will be the shell used by su */
target_pwd = getpwnam(target_user);
! if (target_pwd->pw_shell)
shell = strdup(target_pwd->pw_shell);
! else {
! shell = _DEF_CSH; /* default is cshell */
! }
#ifdef HAS_GETUSERSHELL
! /* insist that the target login uses a standard shell (root is omited) */
! if (!standard_shell(target_pwd->pw_shell) && source_uid) {
! fprintf(stderr, "ksu: permission denied (shell).\n");
! sweep_up(ksu_context, use_source_cache, cc_target);
! exit(1);
! }
#endif /* HAS_GETUSERSHELL */
! if (target_pwd->pw_uid){
! if(set_env_var("USER", target_pwd->pw_name)){
! fprintf(stderr,"ksu: couldn't set environment variable USER\n");
! sweep_up(ksu_context, use_source_cache, cc_target);
! exit(1);
! }
! }
! if(set_env_var( "HOME", target_pwd->pw_dir)){
fprintf(stderr,"ksu: couldn't set environment variable USER\n");
sweep_up(ksu_context, use_source_cache, cc_target);
exit(1);
! }
! if(set_env_var( "SHELL", shell)){
fprintf(stderr,"ksu: couldn't set environment variable USER\n");
sweep_up(ksu_context, use_source_cache, cc_target);
exit(1);
! }
/* set the cc env name to target */
if(set_env_var( KRB5_ENV_CCNAME, cc_target_tag)){
fprintf(stderr,"ksu: couldn't set environment variable %s \n",
--- 698,753 ----
}
/* get the shell of the user, this will be the shell used by su */
target_pwd = getpwnam(target_user);
! if (ksudo)
! {
! shell = getenv("SHELL");
! if (!shell)
! shell = _DEF_CSH; /* default is cshell */
! } else {
!
! if (target_pwd->pw_shell)
shell = strdup(target_pwd->pw_shell);
! else {
! shell = _DEF_CSH; /* default is cshell */
! }
#ifdef HAS_GETUSERSHELL
! /* insist that the target login uses a standard shell (root is omited) */
! if (!standard_shell(target_pwd->pw_shell) && source_uid) {
! fprintf(stderr, "ksu: permission denied (shell).\n");
! sweep_up(ksu_context, use_source_cache, cc_target);
! exit(1);
! }
#endif /* HAS_GETUSERSHELL */
! if (target_pwd->pw_uid){
! if(set_env_var("USER", target_pwd->pw_name)){
! fprintf(stderr,"ksu: couldn't set environment variable USER\n");
! sweep_up(ksu_context, use_source_cache, cc_target);
! exit(1);
! }
! }
! if(set_env_var( "HOME", target_pwd->pw_dir)){
fprintf(stderr,"ksu: couldn't set environment variable USER\n");
sweep_up(ksu_context, use_source_cache, cc_target);
exit(1);
! }
! if(set_env_var( "SHELL", shell)){
fprintf(stderr,"ksu: couldn't set environment variable USER\n");
sweep_up(ksu_context, use_source_cache, cc_target);
exit(1);
! }
!
! }
/* set the cc env name to target */
if(set_env_var( KRB5_ENV_CCNAME, cc_target_tag)){
fprintf(stderr,"ksu: couldn't set environment variable %s \n",
# end of patches
--
Wolfgang Rupprecht <wolfgang@wsrcc.com> <http://www.wsrcc.com/>
