From: Dan Winship <danw@mit.edu>
Date: Fri, 30 Jan 1998 01:24:59 +0000 (+0000)
Subject:         * ftpd.c (auth_data): Accept forwarded credentials and dispose of
X-Git-Tag: krb5-1.1-beta1~868
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=05262eccf16fda8713d474ca1790309018b6ba28;p=krb5.git

    * ftpd.c (auth_data): Accept forwarded credentials and dispose of
        them properly. (And fix some indentation bugs.)

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@10390 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/appl/gssftp/ftpd/ChangeLog b/src/appl/gssftp/ftpd/ChangeLog
index 2ea1c752a..50256487f 100644
--- a/src/appl/gssftp/ftpd/ChangeLog
+++ b/src/appl/gssftp/ftpd/ChangeLog
@@ -1,3 +1,8 @@
+Thu Jan 29 19:51:02 1998  Dan Winship  <danw@mit.edu>
+
+	* ftpd.c (auth_data): Accept forwarded credentials and dispose of
+	them properly. (And fix some indentation bugs.)
+
 Sun Dec 21 18:17:53 1997  Tom Yu  <tlyu@mit.edu>
 
 	* logwtmp.c (ftp_logwtmp): Rename logwtmp to ftp_logwtmp to avoid
diff --git a/src/appl/gssftp/ftpd/ftpd.c b/src/appl/gssftp/ftpd/ftpd.c
index b0d1933ed..d3d785522 100644
--- a/src/appl/gssftp/ftpd/ftpd.c
+++ b/src/appl/gssftp/ftpd/ftpd.c
@@ -1907,7 +1907,7 @@ char *data;
 	if (strcmp(temp_auth_type, "GSSAPI") == 0) {
 		int replied = 0;
 		int found = 0;
-		gss_cred_id_t server_creds;     
+		gss_cred_id_t server_creds, deleg_creds;
 		gss_name_t client;
 		int ret_flags;
 		struct gss_channel_bindings_struct chan;
@@ -1994,7 +1994,7 @@ char *data;
 							    &out_tok, /* output_token */
 							    &ret_flags,
 							    NULL, 	/* ignore time_rec */
-							    NULL   /* ignore del_cred_handle */
+							    &deleg_creds  /* forwarded credentials */
 							    );
 			if (accept_maj==GSS_S_COMPLETE||accept_maj==GSS_S_CONTINUE_NEEDED)
 				break;
@@ -2006,6 +2006,9 @@ char *data;
 						"accepting context");
 				syslog(LOG_ERR, "failed accepting context");
 				(void) gss_release_cred(&stat_min, &server_creds);
+				if (ret_flags & GSS_C_DELEG_FLAG)
+					(void) gss_release_cred(&stat_min,
+								&deleg_creds);
 				return 0;
 			}
 		} else {
@@ -2020,6 +2023,10 @@ char *data;
 				secure_error("Couldn't encode ADAT reply (%s)",
 					     radix_error(kerror));
 				syslog(LOG_ERR, "couldn't encode ADAT reply");
+				(void) gss_release_cred(&stat_min, &server_creds);
+				if (ret_flags & GSS_C_DELEG_FLAG)
+					(void) gss_release_cred(&stat_min,
+								&deleg_creds);
 				return(0);
 			}
 			if (stat_maj == GSS_S_COMPLETE) {
@@ -2027,52 +2034,65 @@ char *data;
 				replied = 1;
 			} else {
 				/* If the server accepts the security data, and
-				   requires additional data, it should respond with
-				   reply code 335. */
+				   requires additional data, it should respond
+				   with reply code 335. */
 				reply(335, "ADAT=%s", gbuf);
 			}
 			(void) gss_release_buffer(&stat_min, &out_tok);
 		}
 		if (stat_maj == GSS_S_COMPLETE) {
 			/* GSSAPI authentication succeeded */
-			stat_maj = gss_display_name(&stat_min, client, &client_name, 
-						    &mechid);
+			stat_maj = gss_display_name(&stat_min, client,
+						    &client_name, &mechid);
 			if (stat_maj != GSS_S_COMPLETE) {
-				/* "If the server rejects the security data (if 
+				/* "If the server rejects the security data (if
 				   a checksum fails, for instance), it should 
 				   respond with reply code 535." */
 				reply_gss_error(535, stat_maj, stat_min,
 						"extracting GSSAPI identity name");
 				syslog(LOG_ERR, "gssapi error extracting identity");
 				(void) gss_release_cred(&stat_min, &server_creds);
+				if (ret_flags & GSS_C_DELEG_FLAG)
+					(void) gss_release_cred(&stat_min,
+								&deleg_creds);
 				return 0;
 			}
 			/* If the server accepts the security data, but does
-				   not require any additional data (i.e., the security
-				   data exchange has completed successfully), it must
-				   respond with reply code 235. */
-			if (!replied) reply(235, "GSSAPI Authentication succeeded");
+			   not require any additional data (i.e., the security
+			   data exchange has completed successfully), it must
+			   respond with reply code 235. */
+			if (!replied)
+			  reply(235, "GSSAPI Authentication succeeded");
 				
 			auth_type = temp_auth_type;
 			temp_auth_type = NULL;
-				
+
 			(void) gss_release_cred(&stat_min, &server_creds);
+			if (ret_flags & GSS_C_DELEG_FLAG) {
+			  /* This would be a good place to do something
+			     useful with the forwarded credentials... */
+			  (void) gss_release_cred(&stat_min, &deleg_creds);
+			}
 			return(1);
 		} else if (stat_maj == GSS_S_CONTINUE_NEEDED) {
 			/* If the server accepts the security data, and
-				   requires additional data, it should respond with
-				   reply code 335. */
+			   requires additional data, it should respond with
+			   reply code 335. */
 			reply(335, "more data needed");
 			(void) gss_release_cred(&stat_min, &server_creds);
+			if (ret_flags & GSS_C_DELEG_FLAG)
+			  (void) gss_release_cred(&stat_min, &deleg_creds);
 			return(0);
 		} else {
 			/* "If the server rejects the security data (if 
-				   a checksum fails, for instance), it should 
-				   respond with reply code 535." */
+			   a checksum fails, for instance), it should 
+			   respond with reply code 535." */
 			reply_gss_error(535, stat_maj, stat_min, 
 					"GSSAPI failed processing ADAT");
 			syslog(LOG_ERR, "GSSAPI failed processing ADAT");
 			(void) gss_release_cred(&stat_min, &server_creds);
+			if (ret_flags & GSS_C_DELEG_FLAG)
+			  (void) gss_release_cred(&stat_min, &deleg_creds);
 			return(0);
 		}
 	}