* gssapiP_krb5.h: Add rcache member to the creds

	structure. [krb5-libs/370]

	* accept_sec_context.c (krb5_gss_accept_sec_context): Actually set
	an rcache in auth context from the one saved in the creds
	structure. [krb5-libs/370]

	* acquire_cred.c (acquire_accept_cred): Set up an rcache for use
	later. [krb5-libs/370]

	* delete_sec_context.c (krb5_gss_delete_sec_context): Don't delete
	the rcache when freeing the auth_context. [krb5-libs/370]

	* rel_cred.c (krb5_gss_release_cred): Properly close the
	rcache. [krb5-libs/370]

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@10371 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/gssapi/krb5/ChangeLog b/src/lib/gssapi/krb5/ChangeLog
index ff41d8df720f134ef5a325eb507c675cda785453..5602578dafe400cdcfb6d2d163cb061312e81d8c 100644 (file)
--- a/src/lib/gssapi/krb5/ChangeLog
+++ b/src/lib/gssapi/krb5/ChangeLog
@@ -1,3 +1,21 @@
+Wed Jan 21 19:14:09 1998  Tom Yu  <tlyu@mit.edu>
+
+       * gssapiP_krb5.h: Add rcache member to the creds
+       structure. [krb5-libs/370]
+
+       * accept_sec_context.c (krb5_gss_accept_sec_context): Actually set
+       an rcache in auth context from the one saved in the creds
+       structure. [krb5-libs/370]
+
+       * acquire_cred.c (acquire_accept_cred): Set up an rcache for use
+       later. [krb5-libs/370]
+
+       * delete_sec_context.c (krb5_gss_delete_sec_context): Don't delete
+       the rcache when freeing the auth_context. [krb5-libs/370]
+
+       * rel_cred.c (krb5_gss_release_cred): Properly close the
+       rcache. [krb5-libs/370]
+
 Mon Dec 29 10:30:43 1997  Ezra Peisach  <epeisach@kangaroo.mit.edu>
 
        * Makefile.in (OBJS): Changed val_cred.$(OBJECT) to

diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index bf984d87a5eae1ef720fb36bc5e33c04143a9c91..e3cf97257102cd2876f51d8767b4d65e78da90ee 100644 (file)
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -291,6 +291,14 @@ krb5_gss_accept_sec_context(minor_status, context_handle,
 
    /* decode the message */
 
+   if ((code = krb5_auth_con_init(context, &auth_context))) {
+       *minor_status = code;
+       return(GSS_S_FAILURE);
+   }
+   if ((code = krb5_auth_con_setrcache(context, auth_context, cred->rcache))) {
+       *minor_status = code;
+       return(GSS_S_FAILURE);
+   }
    if ((code = krb5_rd_req(context, &auth_context, &ap_req, cred->princ,
                          cred->keytab, NULL, &ticket)))
           goto fail;

diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c
index 402ac3ab2d655d5586d2b73546ba1d2110b0e195..272ea426dc881812cc9336725227c756d5caa6b2 100644 (file)
--- a/src/lib/gssapi/krb5/acquire_cred.c
+++ b/src/lib/gssapi/krb5/acquire_cred.c
@@ -89,6 +89,15 @@ acquire_accept_cred(context, minor_status, desired_name, output_princ, cred)
    /* hooray.  we made it */
 
    cred->keytab = kt;
+
+   /* Open the replay cache for this principal. */
+   if ((code = krb5_get_server_rcache(context,
+                                     krb5_princ_component(context, princ, 0),
+                                     &cred->rcache))) {
+       *minor_status = code;
+       return(GSS_S_FAILURE);
+   }
+
    return(GSS_S_COMPLETE);
 }
 

diff --git a/src/lib/gssapi/krb5/delete_sec_context.c b/src/lib/gssapi/krb5/delete_sec_context.c
index 9a9e07ce57e5c9e658bf0888793f6177c70623f4..16964995a7ce55abb232d7d72d7bbadbc5490b19 100644 (file)
--- a/src/lib/gssapi/krb5/delete_sec_context.c
+++ b/src/lib/gssapi/krb5/delete_sec_context.c
@@ -97,8 +97,10 @@ krb5_gss_delete_sec_context(minor_status, context_handle, output_token)
    if (ctx->subkey)
       krb5_free_keyblock(context, ctx->subkey);
 
-   if (ctx->auth_context)
+   if (ctx->auth_context) {
+       (void)krb5_auth_con_setrcache(context, ctx->auth_context, NULL);
        krb5_auth_con_free(context, ctx->auth_context);
+   }
 
    if (ctx->mech_used)
        gss_release_oid(minor_status, &ctx->mech_used);

diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
index 69b0031181df0631107e1acc1556650abe9b3663..9f3c7571120a7e352ecf49efd3f95e04a48aa32e 100644 (file)
--- a/src/lib/gssapi/krb5/gssapiP_krb5.h
+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
@@ -88,6 +88,7 @@ typedef struct _krb5_gss_cred_id_rec {
    /* ccache (init) data */
    krb5_ccache ccache;
    krb5_timestamp tgt_expire;
+   krb5_rcache rcache;
 } krb5_gss_cred_id_rec, *krb5_gss_cred_id_t; 
 
 typedef struct _krb5_gss_enc_desc {

diff --git a/src/lib/gssapi/krb5/rel_cred.c b/src/lib/gssapi/krb5/rel_cred.c
index df301987b75059250b5bf1f9304a4141735612ea..0d81399af254ad4ecccc6e8098e986f1cf5ba514 100644 (file)
--- a/src/lib/gssapi/krb5/rel_cred.c
+++ b/src/lib/gssapi/krb5/rel_cred.c
@@ -29,7 +29,7 @@ krb5_gss_release_cred(minor_status, cred_handle)
 {
    krb5_context context;
    krb5_gss_cred_id_t cred;
-   krb5_error_code code1, code2;
+   krb5_error_code code1, code2, code3;
 
    if (GSS_ERROR(kg_get_context(minor_status, &context)))
       return(GSS_S_FAILURE);
@@ -54,6 +54,10 @@ krb5_gss_release_cred(minor_status, cred_handle)
    else
       code2 = 0;
 
+   if (cred->rcache)
+      code3 = krb5_rc_close(context, cred->rcache);
+   else
+      code3 = 0;
    if (cred->princ)
       krb5_free_principal(context, cred->princ);
    xfree(cred);
@@ -65,6 +69,8 @@ krb5_gss_release_cred(minor_status, cred_handle)
       *minor_status = code1;
    if (code2)
       *minor_status = code2;
+   if (code3)
+      *minor_status = code3;
 
    return(*minor_status?GSS_S_FAILURE:GSS_S_COMPLETE);
 }