- markus@cvs.openbsd.org 2003/08/22 10:56:09

     [auth2.c auth2-gss.c auth.h compat.c compat.h gss-genr.c gss-serv-krb5.c
     gss-serv.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h readconf.c
     readconf.h servconf.c servconf.h session.c session.h ssh-gss.h
     ssh_config.5 sshconnect2.c sshd_config sshd_config.5]
     support GSS API user authentication; patches from Simon Wilkinson,
     stripped down and tested by Jakob and myself.

1 files changed, 29 insertions, 2 deletions

diff --git a/session.c b/session.c
index 20c4b8a97..3593a3ff5 100644
--- a/session.c
+++ b/session.c
@@ -33,7 +33,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.160 2003/08/13 08:33:02 markus Exp $");
+RCSID("$OpenBSD: session.c,v 1.161 2003/08/22 10:56:09 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -58,6 +58,10 @@ RCSID("$OpenBSD: session.c,v 1.160 2003/08/13 08:33:02 markus Exp $");
 #include "session.h"
 #include "monitor_wrap.h"
 
+#ifdef GSSAPI
+#include "ssh-gss.h"
+#endif
+
 /* func */
 
 Session *session_new(void);
@@ -424,6 +428,12 @@ do_exec_no_pty(Session *s, const char *command)
         }
 #endif /* USE_PAM */
 
+#ifdef GSSAPI
+        temporarily_use_uid(s->pw);
+        ssh_gssapi_storecreds();
+        restore_uid();
+#endif
+
         /* Fork the child. */
         if ((pid = fork()) == 0) {
                 fatal_remove_all_cleanups();
@@ -550,6 +560,12 @@ do_exec_pty(Session *s, const char *command)
         }
 #endif
 
+#ifdef GSSAPI
+        temporarily_use_uid(s->pw);
+        ssh_gssapi_storecreds();
+        restore_uid();
+#endif
+
         /* Fork the child. */
         if ((pid = fork()) == 0) {
                 fatal_remove_all_cleanups();
@@ -807,7 +823,7 @@ check_quietlogin(Session *s, const char *command)
  * Sets the value of the given variable in the environment.  If the variable
  * already exists, its value is overriden.
  */
-static void
+void
 child_set_env(char ***envp, u_int *envsizep, const char *name,
         const char *value)
 {
@@ -934,6 +950,13 @@ do_setup_env(Session *s, const char *shell)
         copy_environment(environ, &env, &envsize);
 #endif
 
+#ifdef GSSAPI
+        /* Allow any GSSAPI methods that we've used to alter 
+         * the childs environment as they see fit
+         */
+        ssh_gssapi_do_child(&env, &envsize);
+#endif
+
         if (!options.use_login) {
                 /* Set basic environment. */
                 child_set_env(&env, &envsize, "USER", pw->pw_name);
@@ -2088,4 +2111,8 @@ static void
 do_authenticated2(Authctxt *authctxt)
 {
         server_loop2(authctxt);
+#if defined(GSSAPI)
+        if (options.gss_cleanup_creds)
+                ssh_gssapi_cleanup_creds(NULL);
+#endif
 }