[gentoo-commits] gentoo-x86 commit in net-misc/openssh/files: openssh-5.9_p1-sshd-gssapi-multihomed.patch sshd.rc6.3

[Mike Frysinger (vapier)]

vapier      11/09/07 01:38:46

  Added:                openssh-5.9_p1-sshd-gssapi-multihomed.patch
                        sshd.rc6.3
  Log:
  Version bump.  Drop --oknodo in init.d #377771 by Michael Mair-Keimberger.  Add GSSAPI/Kerberos fix #378361 by Kevan Carstensen.
  
  (Portage version: 2.2.0_alpha51/cvs/Linux x86_64)

Revision  Changes    Path
1.1                  net-misc/openssh/files/openssh-5.9_p1-sshd-gssapi-multihomed.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-misc/openssh/files/openssh-5.9_p1-sshd-gssapi-multihomed.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-misc/openssh/files/openssh-5.9_p1-sshd-gssapi-multihomed.patch?rev=1.1&content-type=text/plain

Index: openssh-5.9_p1-sshd-gssapi-multihomed.patch
===================================================================
Index: gss-serv.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/gss-serv.c,v
retrieving revision 1.22
diff -u -p -r1.22 gss-serv.c
--- gss-serv.c	8 May 2008 12:02:23 -0000	1.22
+++ gss-serv.c	11 Jan 2010 05:38:29 -0000
@@ -41,9 +41,12 @@
 #include "channels.h"
 #include "session.h"
 #include "misc.h"
+#include "servconf.h"
 
 #include "ssh-gss.h"
 
+extern ServerOptions options;
+
 static ssh_gssapi_client gssapi_client =
     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
     GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL}};
@@ -77,25 +80,32 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx)
 	char lname[MAXHOSTNAMELEN];
 	gss_OID_set oidset;
 
-	gss_create_empty_oid_set(&status, &oidset);
-	gss_add_oid_set_member(&status, ctx->oid, &oidset);
-
-	if (gethostname(lname, MAXHOSTNAMELEN)) {
-		gss_release_oid_set(&status, &oidset);
-		return (-1);
-	}
+	if (options.gss_strict_acceptor) {
+		gss_create_empty_oid_set(&status, &oidset);
+		gss_add_oid_set_member(&status, ctx->oid, &oidset);
+
+		if (gethostname(lname, MAXHOSTNAMELEN)) {
+			gss_release_oid_set(&status, &oidset);
+			return (-1);
+		}
+
+		if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
+			gss_release_oid_set(&status, &oidset);
+			return (ctx->major);
+		}
+
+		if ((ctx->major = gss_acquire_cred(&ctx->minor,
+		    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds,
+		    NULL, NULL)))
+			ssh_gssapi_error(ctx);
 
-	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
 		gss_release_oid_set(&status, &oidset);
 		return (ctx->major);
+	} else {
+		ctx->name = GSS_C_NO_NAME;
+		ctx->creds = GSS_C_NO_CREDENTIAL;
 	}
-
-	if ((ctx->major = gss_acquire_cred(&ctx->minor,
-	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
-		ssh_gssapi_error(ctx);
-
-	gss_release_oid_set(&status, &oidset);
-	return (ctx->major);
+	return GSS_S_COMPLETE;
 }
 
 /* Privileged */
Index: servconf.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/servconf.c,v
retrieving revision 1.201
diff -u -p -r1.201 servconf.c
--- servconf.c	10 Jan 2010 03:51:17 -0000	1.201
+++ servconf.c	11 Jan 2010 05:34:56 -0000
@@ -86,6 +86,7 @@ initialize_server_options(ServerOptions 
 	options->kerberos_get_afs_token = -1;
 	options->gss_authentication=-1;
 	options->gss_cleanup_creds = -1;
+	options->gss_strict_acceptor = -1;
 	options->password_authentication = -1;
 	options->kbd_interactive_authentication = -1;
 	options->challenge_response_authentication = -1;
@@ -200,6 +201,8 @@ fill_default_server_options(ServerOption
 		options->gss_authentication = 0;
 	if (options->gss_cleanup_creds == -1)
 		options->gss_cleanup_creds = 1;
+	if (options->gss_strict_acceptor == -1)
+		options->gss_strict_acceptor = 0;
 	if (options->password_authentication == -1)
 		options->password_authentication = 1;
 	if (options->kbd_interactive_authentication == -1)
@@ -277,7 +280,8 @@ typedef enum {
 	sBanner, sUseDNS, sHostbasedAuthentication,
 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
 	sClientAliveCountMax, sAuthorizedKeysFile,
-	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
+	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
+	sAcceptEnv, sPermitTunnel,
 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
 	sUsePrivilegeSeparation, sAllowAgentForwarding,
 	sZeroKnowledgePasswordAuthentication, sHostCertificate,
@@ -327,9 +331,11 @@ static struct {
 #ifdef GSSAPI
 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
 	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
+	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 #else
 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
+	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 #endif
 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
@@ -850,6 +856,10 @@ process_server_config_line(ServerOptions
 
 	case sGssCleanupCreds:
 		intptr = &options->gss_cleanup_creds;
+		goto parse_flag;
+
+	case sGssStrictAcceptor:
+		intptr = &options->gss_strict_acceptor;
 		goto parse_flag;
 
 	case sPasswordAuthentication:
Index: servconf.h
===================================================================
RCS file: /cvs/src/usr.bin/ssh/servconf.h,v
retrieving revision 1.89
diff -u -p -r1.89 servconf.h
--- servconf.h	9 Jan 2010 23:04:13 -0000	1.89
+++ servconf.h	11 Jan 2010 05:32:28 -0000
@@ -92,6 +92,7 @@ typedef struct {
 						 * authenticated with Kerberos. */
 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
+	int 	gss_strict_acceptor;	/* If true, restrict the GSSAPI acceptor name */
 	int     password_authentication;	/* If true, permit password
 						 * authentication. */
 	int     kbd_interactive_authentication;	/* If true, permit */
Index: sshd_config
===================================================================
RCS file: /cvs/src/usr.bin/ssh/sshd_config,v
retrieving revision 1.81
diff -u -p -r1.81 sshd_config
--- sshd_config	8 Oct 2009 14:03:41 -0000	1.81
+++ sshd_config	11 Jan 2010 05:32:28 -0000
@@ -69,6 +69,7 @@
 # GSSAPI options
 #GSSAPIAuthentication no
 #GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
 
 # Set this to 'yes' to enable PAM authentication, account processing, 
 # and session processing. If this is enabled, PAM authentication will 
Index: sshd_config.5
===================================================================
RCS file: /cvs/src/usr.bin/ssh/sshd_config.5,v
retrieving revision 1.116
diff -u -p -r1.116 sshd_config.5
--- sshd_config.5	9 Jan 2010 23:04:13 -0000	1.116
+++ sshd_config.5	11 Jan 2010 05:37:20 -0000
@@ -386,6 +386,21 @@ on logout.
 The default is
 .Dq yes .
 Note that this option applies to protocol version 2 only.
+.It Cm GSSAPIStrictAcceptorCheck
+Determines whether to be strict about the identity of the GSSAPI acceptor
+a client authenticates against.
+If set to
+.Dq yes
+then the client must authenticate against the
+.Pa host
+service on the current hostname.
+If set to
+.Dq no
+then the client may authenticate against any service key stored in the
+machine's default store.
+This facility is provided to assist with operation on multi homed machines.
+The default is
+.Dq yes .
 .It Cm HostbasedAuthentication
 Specifies whether rhosts or /etc/hosts.equiv authentication together
 with successful public key client host authentication is allowed



1.1                  net-misc/openssh/files/sshd.rc6.3

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-misc/openssh/files/sshd.rc6.3?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-misc/openssh/files/sshd.rc6.3?rev=1.1&content-type=text/plain

Index: sshd.rc6.3
===================================================================
#!/sbin/runscript
# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/files/sshd.rc6.3,v 1.1 2011/09/07 01:38:46 vapier Exp $

opts="${opts} reload checkconfig gen_keys"

depend() {
	use logger dns
	need net
}

SSHD_CONFDIR=${SSHD_CONFDIR:-/etc/ssh}
SSHD_PIDFILE=${SSHD_PIDFILE:-/var/run/${SVCNAME}.pid}
SSHD_BINARY=${SSHD_BINARY:-/usr/sbin/sshd}

checkconfig() {
	if [ ! -d /var/empty ] ; then
		mkdir -p /var/empty || return 1
	fi

	if [ ! -e "${SSHD_CONFDIR}"/sshd_config ] ; then
		eerror "You need an ${SSHD_CONFDIR}/sshd_config file to run sshd"
		eerror "There is a sample file in /usr/share/doc/openssh"
		return 1
	fi

	gen_keys || return 1

	[ "${SSHD_PIDFILE}" != "/var/run/sshd.pid" ] \
		&& SSHD_OPTS="${SSHD_OPTS} -o PidFile=${SSHD_PIDFILE}"
	[ "${SSHD_CONFDIR}" != "/etc/ssh" ] \
		&& SSHD_OPTS="${SSHD_OPTS} -f ${SSHD_CONFDIR}/sshd_config"

	"${SSHD_BINARY}" -t ${SSHD_OPTS} || return 1
}

gen_key() {
	local type=$1 key ks
	[ $# -eq 1 ] && ks="${type}_"
	key="${SSHD_CONFDIR}/ssh_host_${ks}key"
	if [ ! -e "${key}" ] ; then
		ebegin "Generating ${type} host key"
		ssh-keygen -t ${type} -f "${key}" -N ''
		eend $? || return $?
	fi
}

gen_keys() {
	if egrep -q '^[[:space:]]*Protocol[[:space:]]+.*1' "${SSHD_CONFDIR}"/sshd_config ; then
		gen_key rsa1 "" || return 1
	fi
	gen_key dsa && gen_key rsa && gen_key ecdsa
	return $?
}

start() {
	checkconfig || return 1

	ebegin "Starting ${SVCNAME}"
	start-stop-daemon --start --exec "${SSHD_BINARY}" \
	    --pidfile "${SSHD_PIDFILE}" \
	    -- ${SSHD_OPTS}
	eend $?
}

stop() {
	if [ "${RC_CMD}" = "restart" ] ; then
		checkconfig || return 1
	fi

	ebegin "Stopping ${SVCNAME}"
	start-stop-daemon --stop --exec "${SSHD_BINARY}" \
	    --pidfile "${SSHD_PIDFILE}" --quiet
	eend $?
}

reload() {
	checkconfig || return 1
	ebegin "Reloading ${SVCNAME}"
	start-stop-daemon --stop --signal HUP \
	    --exec "${SSHD_BINARY}" --pidfile "${SSHD_PIDFILE}"
	eend $?
}