* Makefile.in: Change LOCALINCLUDE and the link line to allow for

	krb4 compatibility.

	* ftpd.c: Change KERBEROS to KRB5_KRB4_COMPAT where appropriate.
	(reply): Fix up braces around the check for auth_type ==
	"KERBEROS_V4" so that the nesting of if statements is correct.
	Various and sundry fixes from danw@mit.edu to make it work.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@10234 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/gssftp/ftpd/ChangeLog b/src/appl/gssftp/ftpd/ChangeLog
index d43bbdbaf5cf2ace6019945062fc6bee7a0c8b3d..4deb143e06534248d0619eff81bd96d8b9ffa3c1 100644 (file)
--- a/src/appl/gssftp/ftpd/ChangeLog
+++ b/src/appl/gssftp/ftpd/ChangeLog
@@ -1,3 +1,13 @@
+Thu Oct 16 01:23:41 1997  Tom Yu  <tlyu@mit.edu>
+
+       * Makefile.in: Change LOCALINCLUDE and the link line to allow for
+       krb4 compatibility.
+
+       * ftpd.c: Change KERBEROS to KRB5_KRB4_COMPAT where appropriate.
+       (reply): Fix up braces around the check for auth_type ==
+       "KERBEROS_V4" so that the nesting of if statements is correct.
+       Various and sundry fixes from danw@mit.edu to make it work.
+
 Thu Aug 28 23:48:27 1997  Sam Hartman  <hartmans@luminous.mesas.com>
 
        * ftpd.c (send_file_list): Flush the data before closing it.

diff --git a/src/appl/gssftp/ftpd/Makefile.in b/src/appl/gssftp/ftpd/Makefile.in
index b08d68d92666107f852a2bdebb8ba200f6f2cffe..303ae80ed7abc019ac24a6bc3e7b16c67f95b6aa 100644 (file)
--- a/src/appl/gssftp/ftpd/Makefile.in
+++ b/src/appl/gssftp/ftpd/Makefile.in
@@ -20,13 +20,13 @@ SRCS        = $(srcdir)/ftpd.c ftpcmd.c $(srcdir)/logwtmp.c $(srcdir)/popen.c \
 OBJS   = ftpd.o ftpcmd.o glob.o popen.o logwtmp.o vers.o radix.o \
          secure.o $(LIBOBJS) $(SETENVOBJ)
 
-LOCALINCLUDE = -I$(srcdir)/..
+LOCALINCLUDE = -I$(srcdir)/.. -I$(srcdir) @KRB4_INCLUDES@
 DEFINES = -DGSSAPI -DNOCONFIDENTIAL
 
 all::  ftpd
 
 ftpd:  $(OBJS) $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-       $(CC_LINK) -o $@ $(OBJS) $(GSS_LIBS) $(KRB5_BASE_LIBS)
+       $(CC_LINK) -o $@ $(OBJS) $(GSS_LIBS) $(KRB4COMPAT_LIBS)
 
 clean::
        $(RM) ftpd ftpcmd.c

diff --git a/src/appl/gssftp/ftpd/ftpd.c b/src/appl/gssftp/ftpd/ftpd.c
index aedacdf4e00ed58e0ea0c7ee99f90129c6030e4b..8eed259bbc8328d582917c23f732d78b7b63fa5a 100644 (file)
--- a/src/appl/gssftp/ftpd/ftpd.c
+++ b/src/appl/gssftp/ftpd/ftpd.c
@@ -113,7 +113,7 @@ extern reply(int, char *, ...);
 extern lreply(int, char *, ...);
 #endif
 
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
 #include <krb.h>
 
 AUTH_DAT kdata;
@@ -121,8 +121,8 @@ KTEXT_ST ticket;
 MSG_DAT msg_data;
 Key_schedule schedule;
 int kerb_ok;   /* Kerberos authentication and authorization succeeded */
-char *keyfile = KEYFILE;
-#endif /* KERBEROS */
+char *keyfile;
+#endif /* KRB5_KRB4_COMPAT */
 
 #ifdef GSSAPI
 #include <gssapi/gssapi.h>
@@ -226,6 +226,9 @@ main(argc, argv, envp)
        int addrlen, on = 1, tos, port = -1;
        char *cp;
 
+#ifdef KRB5_KRB4_COMPAT
+       keyfile = KEYFILE;
+#endif /* KRB5_KRB4_COMPAT */
        debug = 0;
 #ifdef SETPROCTITLE
        /*
@@ -279,7 +282,7 @@ main(argc, argv, envp)
                                fprintf(stderr, "ftpd: -r expects argument\n");
                        goto nextopt;
 
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
                case 's':
                        if (*++cp != '\0')
                                keyfile = cp;
@@ -291,7 +294,7 @@ main(argc, argv, envp)
                                fprintf(stderr, "ftpd: -s expects argument\n");
                        goto nextopt;
 
-#endif /* KERBEROS */
+#endif /* KRB5_KRB4_COMPAT */
                case 't':
                        timeout = atoi(++cp);
                        if (maxtimeout < timeout)
@@ -593,28 +596,6 @@ user(name)
                        return;
                }
        }
-#ifdef KERBEROS
-       if (auth_type && strcmp(auth_type, "KERBEROS_V4") == 0) {
-               char buf[FTP_BUFSIZ];
-               kerb_ok = kuserok(&kdata,name) == 0;
-               if (! kerb_ok && authenticate) {
-                       reply(530, "User %s access denied.", name);
-                       if (logging)
-                               syslog(LOG_NOTICE,
-                                      "FTP KERBEROS LOGIN REFUSED FROM %s, %s",
-                                      remotehost, name);
-                       pw = (struct passwd *) NULL;
-                       return;
-               }
-               sprintf(buf, "Kerberos user %s%s%s@%s is%s authorized as %s%s",
-                       kdata.pname, *kdata.pinst ? "." : "",
-                       kdata.pinst, kdata.prealm,
-                       kerb_ok ? "" : " not",
-                       name, kerb_ok ? "" : "; Password required.");
-               reply(kerb_ok ? 232 : 331, "%s", buf);
-               syslog(kerb_ok ? LOG_INFO : LOG_ERR, "%s", buf);
-       } else
-#endif /* KERBEROS */
 #ifdef GSSAPI
        if (auth_type && strcmp(auth_type, "GSSAPI") == 0) {
                char buf[FTP_BUFSIZ];
@@ -637,6 +618,28 @@ user(name)
                syslog(gss_ok ? LOG_INFO : LOG_ERR, "%s", buf);
        } else
 #endif /* GSSAPI */
+#ifdef KRB5_KRB4_COMPAT
+       if (auth_type && strcmp(auth_type, "KERBEROS_V4") == 0) {
+               char buf[FTP_BUFSIZ];
+               kerb_ok = kuserok(&kdata,name) == 0;
+               if (! kerb_ok && authenticate) {
+                       reply(530, "User %s access denied.", name);
+                       if (logging)
+                               syslog(LOG_NOTICE,
+                                      "FTP KERBEROS LOGIN REFUSED FROM %s, %s",
+                                      remotehost, name);
+                       pw = (struct passwd *) NULL;
+                       return;
+               }
+               sprintf(buf, "Kerberos user %s%s%s@%s is%s authorized as %s%s",
+                       kdata.pname, *kdata.pinst ? "." : "",
+                       kdata.pinst, kdata.prealm,
+                       kerb_ok ? "" : " not",
+                       name, kerb_ok ? "" : "; Password required.");
+               reply(kerb_ok ? 232 : 331, "%s", buf);
+               syslog(kerb_ok ? LOG_INFO : LOG_ERR, "%s", buf);
+       } else
+#endif /* KRB5_KRB4_COMPAT */
        /* Other auth types go here ... */
        if (authenticate) {
                reply(530, "User %s access denied: authentication required.",
@@ -697,7 +700,7 @@ end_login()
        guest = 0;
 }
 
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
 static char *services[] = { "ftp", "rcmd", NULL };
 
 kpass(name, passwd)
@@ -747,7 +750,7 @@ char *name, *passwd;
        dest_tkt();
        return(1);
 }
-#endif /* KERBEROS */
+#endif /* KRB5_KRB4_COMPAT */
 
 pass(passwd)
        char *passwd;
@@ -760,9 +763,9 @@ pass(passwd)
        }
        askpasswd = 0;
        if (
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
            !kerb_ok &&
-#endif /* KERBEROS */
+#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
            !gss_ok &&
 #endif /* GSSAPI */
@@ -777,7 +780,7 @@ pass(passwd)
 #else
                xpasswd = crypt(passwd, salt);
 #endif
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
                /* null pw_passwd ok if Kerberos password ok */
                if (pw == NULL ||
                    (*pw->pw_passwd && strcmp(xpasswd, pw->pw_passwd) &&
@@ -787,7 +790,7 @@ pass(passwd)
                /* The strcmp does not catch null passwords! */
                if (pw == NULL || *pw->pw_passwd == '\0' ||
                    strcmp(xpasswd, pw->pw_passwd)) {
-#endif /* KERBEROS */
+#endif /* KRB5_KRB4_COMPAT */
                        reply(530, "Login incorrect.");
                        pw = NULL;
                        if (login_attempts++ >= 5) {
@@ -1439,20 +1442,24 @@ reply(n, fmt, p0, p1, p2, p3, p4, p5)
                if (n) sprintf(in, "%d%c", n, cont_char);
                else in[0] = '\0';
                strcat(in, buf);
-#ifdef KERBEROS
-               if (strcmp(auth_type, "KERBEROS_V4") == 0)
-                 if ((length = level == PROT_P ?
-                   krb_mk_priv((unsigned char *)in, (unsigned char *)out,
-                               strlen(in), schedule, &kdata.session,
-                               &ctrl_addr, &his_addr)
-                 : krb_mk_safe((unsigned char *)in, (unsigned char *)out,
-                               strlen(in), &kdata.session,
-                               &ctrl_addr, &his_addr)) == -1) {
-                       syslog(LOG_ERR, "krb_mk_%s failed for KERBEROS_V4",
-                                       level == PROT_P ? "priv" : "safe");
-                       fputs(in,stdout);
-                 } else
-#endif /* KERBEROS */
+#ifdef KRB5_KRB4_COMPAT
+               if (strcmp(auth_type, "KERBEROS_V4") == 0) {
+                       if ((length = level == PROT_P ?
+                            krb_mk_priv((unsigned char *)in,
+                                        (unsigned char *)out,
+                                        strlen(in), schedule, &kdata.session,
+                                        &ctrl_addr, &his_addr)
+                            : krb_mk_safe((unsigned char *)in,
+                                          (unsigned char *)out,
+                                          strlen(in), &kdata.session,
+                                          &ctrl_addr, &his_addr)) == -1) {
+                               syslog(LOG_ERR,
+                                      "krb_mk_%s failed for KERBEROS_V4",
+                                      level == PROT_P ? "priv" : "safe");
+                               fputs(in,stdout);
+                       }
+               } else
+#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
                /* reply (based on level) */
                if (strcmp(auth_type, "GSSAPI") == 0) {
@@ -1804,18 +1811,18 @@ char *type;
        if (auth_type)
                reply(534, "Authentication type already set to %s", auth_type);
        else
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
        if (strcmp(type, "KERBEROS_V4") == 0)
                reply(334, "Using authentication type %s; ADAT must follow",
                                temp_auth_type = type);
        else
-#endif /* KERBEROS */
+#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
        if (strcmp(type, "GSSAPI") == 0)
                reply(334, "Using authentication type %s; ADAT must follow",
                                temp_auth_type = type);
        else
-#endif /* KERBEROS */
+#endif /* GSSAPI */
        /* Other auth types go here ... */
                reply(504, "Unknown authentication type: %s", type);
 }
@@ -1824,14 +1831,14 @@ auth_data(data)
 char *data;
 {
        int kerror, length;
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
        int i;
        static char *service;
        char instance[INST_SZ];
        u_long cksum;
        char buf[FTP_BUFSIZ];
        u_char out_buf[sizeof(buf)];
-#endif /* KERBEROS */
+#endif /* KRB5_KRB4_COMPAT */
 
        if (auth_type) {
                reply(503, "Authentication already established");
@@ -1841,7 +1848,7 @@ char *data;
                reply(503, "Must identify AUTH type before ADAT");
                return(0);
        }
-#ifdef KERBEROS
+#ifdef KRB5_KRB4_COMPAT
        if (strcmp(temp_auth_type, "KERBEROS_V4") == 0) {
                if (kerror = radix_encode(data, out_buf, &length, 1)) {
                        reply(501, "Couldn't decode ADAT (%s)",
@@ -1889,7 +1896,7 @@ char *data;
                temp_auth_type = NULL;
                return(1);
        }
-#endif /* KERBEROS */
+#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
        if (strcmp(temp_auth_type, "GSSAPI") == 0) {
                int replied = 0;