[openssh/f14/master] - Add the GSSAPI kuserok switch to the kuserok patch

[Jan F. Chadima]

commit 71a006277a1ca4e4fb0bdb82e6155e235c7aa361
Author: Jan F <jfch at hagar.bobr>
Date:   Wed Sep 15 20:04:07 2010 +0200

    - Add the GSSAPI kuserok switch to the kuserok patch

 openssh-5.5p1-kuserok.patch |   36 ++++++++++++++++++++++++++++++++++++
 openssh.spec                |    6 +++++-
 2 files changed, 41 insertions(+), 1 deletions(-)
---
diff --git a/openssh-5.5p1-kuserok.patch b/openssh-5.5p1-kuserok.patch
index 2390745..3fd48e5 100644
--- a/openssh-5.5p1-kuserok.patch
+++ b/openssh-5.5p1-kuserok.patch
@@ -130,3 +130,39 @@ diff -up openssh-5.5p1/sshd_config.kuserok openssh-5.5p1/sshd_config
  
  # GSSAPI options
  #GSSAPIAuthentication no
+diff -up openssh-5.6p1/gss-serv-krb5.c.kuserok openssh-5.6p1/gss-serv-krb5.c
+--- openssh-5.6p1/gss-serv-krb5.c.kuserok	2010-09-15 15:39:48.000000000 +0200
++++ openssh-5.6p1/gss-serv-krb5.c	2010-09-15 15:49:43.000000000 +0200
+@@ -97,13 +97,25 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
+ 		    krb5_get_err_text(krb_context, retval));
+ 		return 0;
+ 	}
+-	if (krb5_kuserok(krb_context, princ, name)) {
+-		retval = 1;
+-		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
+-		    name, (char *)client->displayname.value);
+-	} else
+-		retval = 0;
+-
++	if (options.use_kuserok) {
++		if (krb5_kuserok(krb_context, princ, name)) {
++			retval = 1;
++			logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
++			    name, (char *)client->displayname.value);
++		} else
++			retval = 0;
++	} else {
++		char kuser[65];
++		if (krb5_aname_to_localname(krb_context, princ, sizeof(kuser), kuser))
++			retval = 0;
++		else if (strcmp(kuser, client))
++			retval = 0;
++		else {
++			retval = 1;
++			logit("Authorized to %s, krb5 principal %s (krb5)",
++			    name, (char *)client->displayname.value);
++		}
++	}
+ 	krb5_free_principal(krb_context, princ);
+ 	return retval;
+ }
diff --git a/openssh.spec b/openssh.spec
index dcd4280..f8ee64b 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -70,7 +70,7 @@
 %endif
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%define openssh_rel 20
+%define openssh_rel 21
 %define openssh_ver 5.5p1
 %define pam_ssh_agent_rel 26
 %define pam_ssh_agent_ver 0.9.2
@@ -131,6 +131,7 @@ Patch74: openssh-5.3p1-randclean.patch
 Patch76: openssh-5.5p1-staterr.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1750
 Patch77: openssh-5.5p1-stderr.patch
+#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
 Patch78: openssh-5.5p1-kuserok.patch
 Patch79: openssh-5.5p1-x11.patch
 
@@ -588,6 +589,9 @@ fi
 %endif
 
 %changelog
+* Wed Sep 15 2010 Jan F. Chadima <jchadima at redhat.com> - 5.5p1-21 + 0.9.2-26
+- Add the GSSAPI kuserok switch to the kuserok patch
+
 * Mon Sep 13 2010 Jan F. Chadima <jchadima at redhat.com> - 5.5p1-20 + 0.9.2-26
 - Tweaking selabel patch to work properly without selinux rules loaded. (#632914)
 - enabling authorized keys command patch