Attachment #108349 for bug #83323

Lines 651-656 Link Here

(-)screen-4.0.2/config.h.in (+6 lines)
651	*/	651	*/
652	#undef HAVE_OPENPTY	652	#undef HAVE_OPENPTY
653		653
		654	/*
		655	* define HAVE_KRB5 if your system supports MIT Kerberos 5 or
		656	* equivalent.
		657	*/
		658	#undef HAVE_KRB5
		659
654	/*	660	/*
655	* define PTYRANGE0 and or PTYRANGE1 if you want to adapt screen	661	* define PTYRANGE0 and or PTYRANGE1 if you want to adapt screen
656	* to unusual environments. E.g. For SunOs the defaults are "qpr" and	662	* to unusual environments. E.g. For SunOs the defaults are "qpr" and




AC_DEFINE_UNQUOTED(PTYRANGE1,"$p1")
fi

dnl    **** Kerberos ****
AC_ARG_WITH(krb5, [  --with-krb5[=dir]         Use Kerberos 5 (optionally installed in dir)])
if test "$with_krb5" != no -a -n "$with_krb5"; then
	if test "$with_krb5" != yes; then
		CFLAGS="$CFLAGS -I${with_krb5}/include"
		LDFLAGS="$LDFLAGS -L${with_krb5}/lib"
	fi
	LIBS="$LIBS -lkrb5"
	AC_DEFINE(HAVE_KRB5)
fi

dnl    ****  pty mode/group handling ****
dnl
dnl support provided by Luke Mewburn <lm@rmit.edu.au>, 931222




/* Copyright (c) 2005
 *      Fredrik Tolf (fredrik@dolda2000.com)
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program (see the file COPYING); if not, write to the
 * Free Software Foundation, Inc.,
 * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
 *
 ****************************************************************
 */

#include "config.h"
#ifdef HAVE_KRB5

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <krb5.h>
#include <com_err.h>

#include "screen.h"

/*
 * I do not like the coding style of screen... =(
 */

static krb5_context context;
static krb5_ccache ccache;
static int usingkrb = 0;
static struct event renewev;

#include "extern.h"

static void
krb_renew(ev, data)
struct event *ev;
char *data;
{
  int ret;
  krb5_principal myprinc;
  krb5_creds creds;
  krb5_cc_cursor cur;
  time_t now;
  int renew;
  
  SetTimeout(&renewev, 60000);
  evenq(&renewev);
  
  if((ret = krb5_cc_get_principal(context, ccache, &myprinc)) != 0)
    {
      Msg(0, "Could not get principal to renew: %s", error_message(ret));
      return;
    }

  if((ret = krb5_cc_start_seq_get(context, ccache, &cur)) != 0)
    {
      Msg(0, "Could not open current credentials cache: %s", error_message(ret));
      krb5_free_principal(context, myprinc);
      return;
    }
  time(&now);
  renew = 0;
  while(!krb5_cc_next_cred(context, ccache, &cur, &creds))
    {
      if(!strcmp(krb5_princ_component(context, creds.server, 0)->data, KRB5_TGS_NAME) &&
	 !strcmp(krb5_princ_component(context, creds.server, 1)->data, myprinc->realm.data))
	{
	  if(!creds.times.starttime)
	    creds.times.starttime = creds.times.authtime;
	  if(now > (creds.times.starttime + (((creds.times.endtime - creds.times.starttime) * 9) / 10)))
	    renew = 1;
	  break;
	}
      krb5_free_cred_contents(context, &creds);
    }
  krb5_cc_end_seq_get(context, ccache, &cur);
  if(!renew)
    {
      krb5_free_principal(context, myprinc);
      return;
    }
  
  memset(&creds, 0, sizeof(creds));
  if((ret = krb5_get_renewed_creds(context, &creds, myprinc, ccache, NULL)) != 0)
    {
      Msg(0, "Could not get renewed credentials: %s", error_message(ret));
      krb5_free_principal(context, myprinc);
      return;
    }
  if((ret = krb5_cc_initialize(context, ccache, myprinc)) != 0)
    {
      Msg(0, "Could not re-initialize credentials cache: %s", error_message(ret));
      krb5_free_principal(context, myprinc);
      krb5_free_cred_contents(context, &creds);
      return;
    }
  if((ret = krb5_cc_store_cred(context, ccache, &creds)) != 0)
    {
      Msg(0, "Could not store renewed TGT: %s", error_message(ret));
      krb5_free_principal(context, myprinc);
      krb5_free_cred_contents(context, &creds);
      return;
    }

  krb5_free_principal(context, myprinc);
  krb5_free_cred_contents(context, &creds);
  Msg(0, "Renewed Kerberos credentials successfully.");
}

int
krb_copycc()
{
  int ret, fd;
  krb5_ccache prevcache;
  krb5_principal myprinc;
  krb5_creds creds;
  krb5_cc_cursor cur;
  char buf[100];
  char *ccfile;

  if((ret = krb5_init_context(&context)) != 0)
    {
      Msg(0, "Could not initialize Kerberos library: %s", error_message(ret));
      return(-1);
    }
  if((ret = krb5_cc_default(context, &prevcache)) != 0)
    {
      Msg(0, "Could not get Kerberos credential cache: %s", error_message(ret));
      krb5_free_context(context);
      return(-1);
    }
  if((ret = krb5_cc_get_principal(context, prevcache, &myprinc)) != 0)
    {
      Msg(0, "Could not get principal of current ccache: %s", error_message(ret));
      krb5_cc_close(context, prevcache);
      krb5_free_context(context);
      return(-1);
    }

  sprintf(buf, "FILE:/tmp/krb5cc_scr_%i_XXXXXX", getuid());
  ccfile = buf + 5;
  if((fd = mkstemp(ccfile)) < 0)
    {
      Msg(errno, "Could not create temporary file.");
      krb5_cc_close(context, prevcache);
      krb5_free_context(context);
      return(-1);
    }
  close(fd);
  if((ret = krb5_cc_resolve(context, buf, &ccache)) != 0)
    {
      Msg(0, "Could not resolve new credential cache: %s", error_message(ret));
      krb5_cc_close(context, prevcache);
      krb5_free_context(context);
      return(-1);
    }
  if((ret = krb5_cc_initialize(context, ccache, myprinc)) != 0)
    {
      Msg(0, "Could not initialize new credential cache: %s", error_message(ret));
      krb5_cc_close(context, prevcache);
      krb5_free_context(context);
      return(-1);
    }
  
  if((ret = krb5_cc_start_seq_get(context, prevcache, &cur)) != 0)
    {
      Msg(0, "Could not get ccache cursor: %s", error_message(ret));
      krb5_cc_destroy(context, ccache);
      krb5_cc_close(context, prevcache);
      krb5_free_context(context);
      return(-1);
    }
  while(!krb5_cc_next_cred(context, prevcache, &cur, &creds))
    {
      if((ret = krb5_cc_store_cred(context, ccache, &creds)) != 0)
	{
	  Msg(0, "Could not store credential: %s", error_message(ret));
	  krb5_cc_destroy(context, ccache);
	  krb5_cc_close(context, prevcache);
	  krb5_free_context(context);
	  return(-1);
	}
    }
  krb5_cc_end_seq_get(context, prevcache, &cur);
  
  krb5_free_principal(context, myprinc);
  krb5_cc_close(context, prevcache);
  xsetenv("KRB5CCNAME", buf);
  MakeNewEnv();
  memset(&renewev, 0, sizeof(renewev));
  renewev.type = EV_TIMEOUT;
  renewev.handler = krb_renew;
  SetTimeout(&renewev, 60000);
  evenq(&renewev);
  usingkrb = 1;
  return(0);
}

void
krb_cleanup()
{
  if(!usingkrb)
    return;
  krb5_cc_destroy(context, ccache);
  krb5_free_context(context);
}

#endif




	search.c tty.c term.c window.c utmp.c loadav.c putenv.c help.c \
	termcap.c input.c attacher.c pty.c process.c display.c comm.c \
	kmapdef.c acls.c braille.c braille_tsi.c logfile.c layer.c \
	sched.c teln.c nethack.c encoding.c kerberos.c
OFILES=	screen.o ansi.o fileio.o mark.o misc.o resize.o socket.o \
	search.o tty.o term.o window.o utmp.o loadav.o putenv.o help.o \
	termcap.o input.o attacher.o pty.o process.o display.o comm.o \
	kmapdef.o acls.o braille.o braille_tsi.o logfile.o layer.o \
	sched.o teln.o nethack.o encoding.o kerberos.o

all:	screen


 comm.h layer.h term.h image.h display.h window.h extern.h
encoding.o: encoding.c config.h screen.h os.h osdef.h ansi.h acls.h \
 comm.h layer.h term.h image.h display.h window.h extern.h
kerberos.o: kerberos.c config.h screen.h osdef.h

Lines 1320-1325 Link Here

(-)screen-4.0.2/screen.c (+7 lines)
1320	#endif	1320	#endif
1321	FinishRc(RcFileName);	1321	FinishRc(RcFileName);
1322		1322
		1323	#ifdef HAVE_KRB5
		1324	krb_copycc();
		1325	#endif
		1326
1323	debug2("UID %d EUID %d\n", (int)getuid(), (int)geteuid());	1327	debug2("UID %d EUID %d\n", (int)getuid(), (int)geteuid());
1324	if (windows == NULL)	1328	if (windows == NULL)
1325	{	1329	{
Lines 1643-1648 Link Here
1643	xsetegid(eff_gid);	1647	xsetegid(eff_gid);
1644	#endif	1648	#endif
1645	}	1649	}
		1650	#ifdef HAVE_KRB5
		1651	krb_cleanup();
		1652	#endif
1646	for (display = displays; display; display = display->d_next)	1653	for (display = displays; display; display = display->d_next)
1647	{	1654	{
1648	if (D_status)	1655	if (D_status)

Return to bug 83323

Lines 719-724 Link Here

(-)screen-4.0.2/configure.in (+11 lines)
719	AC_DEFINE_UNQUOTED(PTYRANGE1,"$p1")	719	AC_DEFINE_UNQUOTED(PTYRANGE1,"$p1")
720	fi	720	fi
721		721
		722	dnl ** Kerberos **
		723	AC_ARG_WITH(krb5, [ --with-krb5[=dir] Use Kerberos 5 (optionally installed in dir)])
		724	if test "$with_krb5" != no -a -n "$with_krb5"; then
		725	if test "$with_krb5" != yes; then
		726	CFLAGS="$CFLAGS -I${with_krb5}/include"
		727	LDFLAGS="$LDFLAGS -L${with_krb5}/lib"
		728	fi
		729	LIBS="$LIBS -lkrb5"
		730	AC_DEFINE(HAVE_KRB5)
		731	fi
		732
722	dnl ** pty mode/group handling **	733	dnl ** pty mode/group handling **
723	dnl	734	dnl
724	dnl support provided by Luke Mewburn <lm@rmit.edu.au>, 931222	735	dnl support provided by Luke Mewburn <lm@rmit.edu.au>, 931222

Line 0 Link Here

(-)screen-4.0.2/kerberos.c (+218 lines)
		1	/* Copyright (c) 2005
		2	* Fredrik Tolf (fredrik@dolda2000.com)
		3	*
		4	* This program is free software; you can redistribute it and/or modify
		5	* it under the terms of the GNU General Public License as published by
		6	* the Free Software Foundation; either version 2, or (at your option)
		7	* any later version.
		8	*
		9	* This program is distributed in the hope that it will be useful,
		10	* but WITHOUT ANY WARRANTY; without even the implied warranty of
		11	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		12	* GNU General Public License for more details.
		13	*
		14	* You should have received a copy of the GNU General Public License
		15	* along with this program (see the file COPYING); if not, write to the
		16	* Free Software Foundation, Inc.,
		17	* 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
		18	*
		19	****************************************************************
		20	*/
		21
		22	#include "config.h"
		23	#ifdef HAVE_KRB5
		24
		25	#include <stdlib.h>
		26	#include <stdio.h>
		27	#include <unistd.h>
		28	#include <krb5.h>
		29	#include <com_err.h>
		30
		31	#include "screen.h"
		32
		33	/*
		34	* I do not like the coding style of screen... =(
		35	*/
		36
		37	static krb5_context context;
		38	static krb5_ccache ccache;
		39	static int usingkrb = 0;
		40	static struct event renewev;
		41
		42	#include "extern.h"
		43
		44	static void
		45	krb_renew(ev, data)
		46	struct event *ev;
		47	char *data;
		48	{
		49	int ret;
		50	krb5_principal myprinc;
		51	krb5_creds creds;
		52	krb5_cc_cursor cur;
		53	time_t now;
		54	int renew;
		55
		56	SetTimeout(&renewev, 60000);
		57	evenq(&renewev);
		58
		59	if((ret = krb5_cc_get_principal(context, ccache, &myprinc)) != 0)
		60	{
		61	Msg(0, "Could not get principal to renew: %s", error_message(ret));
		62	return;
		63	}
		64
65	if((ret = krb5_cc_start_seq_get(context, ccache, &cur)) != 0)
66	{
67	Msg(0, "Could not open current credentials cache: %s", error_message(ret));
68	krb5_free_principal(context, myprinc);
69	return;
70	}
71	time(&now);
72	renew = 0;
73	while(!krb5_cc_next_cred(context, ccache, &cur, &creds))
74	{
75	if(!strcmp(krb5_princ_component(context, creds.server, 0)->data, KRB5_TGS_NAME) &&
76	!strcmp(krb5_princ_component(context, creds.server, 1)->data, myprinc->realm.data))
77	{
78	if(!creds.times.starttime)
79	creds.times.starttime = creds.times.authtime;
80	if(now > (creds.times.starttime + (((creds.times.endtime - creds.times.starttime) * 9) / 10)))
81	renew = 1;
82	break;
83	}
84	krb5_free_cred_contents(context, &creds);
85	}
86	krb5_cc_end_seq_get(context, ccache, &cur);
87	if(!renew)
88	{
89	krb5_free_principal(context, myprinc);
90	return;
91	}
92
93	memset(&creds, 0, sizeof(creds));
94	if((ret = krb5_get_renewed_creds(context, &creds, myprinc, ccache, NULL)) != 0)
95	{
96	Msg(0, "Could not get renewed credentials: %s", error_message(ret));
97	krb5_free_principal(context, myprinc);
98	return;
99	}
100	if((ret = krb5_cc_initialize(context, ccache, myprinc)) != 0)
101	{
102	Msg(0, "Could not re-initialize credentials cache: %s", error_message(ret));
103	krb5_free_principal(context, myprinc);
104	krb5_free_cred_contents(context, &creds);
105	return;
106	}
107	if((ret = krb5_cc_store_cred(context, ccache, &creds)) != 0)
108	{
109	Msg(0, "Could not store renewed TGT: %s", error_message(ret));
110	krb5_free_principal(context, myprinc);
111	krb5_free_cred_contents(context, &creds);
112	return;
113	}
114
115	krb5_free_principal(context, myprinc);
116	krb5_free_cred_contents(context, &creds);
117	Msg(0, "Renewed Kerberos credentials successfully.");
118	}
119
120	int
121	krb_copycc()
122	{
123	int ret, fd;
124	krb5_ccache prevcache;
125	krb5_principal myprinc;
126	krb5_creds creds;
127	krb5_cc_cursor cur;
128	char buf[100];
129	char *ccfile;
130
131	if((ret = krb5_init_context(&context)) != 0)
132	{
133	Msg(0, "Could not initialize Kerberos library: %s", error_message(ret));
134	return(-1);
135	}
136	if((ret = krb5_cc_default(context, &prevcache)) != 0)
137	{
138	Msg(0, "Could not get Kerberos credential cache: %s", error_message(ret));
139	krb5_free_context(context);
140	return(-1);
141	}
142	if((ret = krb5_cc_get_principal(context, prevcache, &myprinc)) != 0)
143	{
144	Msg(0, "Could not get principal of current ccache: %s", error_message(ret));
145	krb5_cc_close(context, prevcache);
146	krb5_free_context(context);
147	return(-1);
148	}
149
150	sprintf(buf, "FILE:/tmp/krb5cc_scr_%i_XXXXXX", getuid());
151	ccfile = buf + 5;
152	if((fd = mkstemp(ccfile)) < 0)
153	{
154	Msg(errno, "Could not create temporary file.");
155	krb5_cc_close(context, prevcache);
156	krb5_free_context(context);
157	return(-1);
158	}
159	close(fd);
160	if((ret = krb5_cc_resolve(context, buf, &ccache)) != 0)
161	{
162	Msg(0, "Could not resolve new credential cache: %s", error_message(ret));
163	krb5_cc_close(context, prevcache);
164	krb5_free_context(context);
165	return(-1);
166	}
167	if((ret = krb5_cc_initialize(context, ccache, myprinc)) != 0)
168	{
169	Msg(0, "Could not initialize new credential cache: %s", error_message(ret));
170	krb5_cc_close(context, prevcache);
171	krb5_free_context(context);
172	return(-1);
173	}
174
175	if((ret = krb5_cc_start_seq_get(context, prevcache, &cur)) != 0)
176	{
177	Msg(0, "Could not get ccache cursor: %s", error_message(ret));
178	krb5_cc_destroy(context, ccache);
179	krb5_cc_close(context, prevcache);
180	krb5_free_context(context);
181	return(-1);
182	}
183	while(!krb5_cc_next_cred(context, prevcache, &cur, &creds))
184	{
185	if((ret = krb5_cc_store_cred(context, ccache, &creds)) != 0)
186	{
187	Msg(0, "Could not store credential: %s", error_message(ret));
188	krb5_cc_destroy(context, ccache);
189	krb5_cc_close(context, prevcache);
190	krb5_free_context(context);
191	return(-1);
192	}
193	}
194	krb5_cc_end_seq_get(context, prevcache, &cur);
195
196	krb5_free_principal(context, myprinc);
197	krb5_cc_close(context, prevcache);
198	xsetenv("KRB5CCNAME", buf);
199	MakeNewEnv();
200	memset(&renewev, 0, sizeof(renewev));
201	renewev.type = EV_TIMEOUT;
202	renewev.handler = krb_renew;
203	SetTimeout(&renewev, 60000);
204	evenq(&renewev);
205	usingkrb = 1;
206	return(0);
207	}
208
209	void
210	krb_cleanup()
211	{
212	if(!usingkrb)
213	return;
214	krb5_cc_destroy(context, ccache);
215	krb5_free_context(context);
216	}
217
218	#endif

Lines 55-66 Link Here

(-)screen-4.0.2/Makefile.in (-2 / +3 lines)
55	search.c tty.c term.c window.c utmp.c loadav.c putenv.c help.c \	55	search.c tty.c term.c window.c utmp.c loadav.c putenv.c help.c \
56	termcap.c input.c attacher.c pty.c process.c display.c comm.c \	56	termcap.c input.c attacher.c pty.c process.c display.c comm.c \
57	kmapdef.c acls.c braille.c braille_tsi.c logfile.c layer.c \	57	kmapdef.c acls.c braille.c braille_tsi.c logfile.c layer.c \
58	sched.c teln.c nethack.c encoding.c	58	sched.c teln.c nethack.c encoding.c kerberos.c
59	OFILES= screen.o ansi.o fileio.o mark.o misc.o resize.o socket.o \	59	OFILES= screen.o ansi.o fileio.o mark.o misc.o resize.o socket.o \
60	search.o tty.o term.o window.o utmp.o loadav.o putenv.o help.o \	60	search.o tty.o term.o window.o utmp.o loadav.o putenv.o help.o \
61	termcap.o input.o attacher.o pty.o process.o display.o comm.o \	61	termcap.o input.o attacher.o pty.o process.o display.o comm.o \
62	kmapdef.o acls.o braille.o braille_tsi.o logfile.o layer.o \	62	kmapdef.o acls.o braille.o braille_tsi.o logfile.o layer.o \
63	sched.o teln.o nethack.o encoding.o	63	sched.o teln.o nethack.o encoding.o kerberos.o
64		64
65	all: screen	65	all: screen
66		66
Lines 329-331 Link Here
329	comm.h layer.h term.h image.h display.h window.h extern.h	329	comm.h layer.h term.h image.h display.h window.h extern.h
330	encoding.o: encoding.c config.h screen.h os.h osdef.h ansi.h acls.h \	330	encoding.o: encoding.c config.h screen.h os.h osdef.h ansi.h acls.h \
331	comm.h layer.h term.h image.h display.h window.h extern.h	331	comm.h layer.h term.h image.h display.h window.h extern.h
		332	kerberos.o: kerberos.c config.h screen.h osdef.h