From 33a274f0258d6798f82aa16ddc2a77b718f81953 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 19 Dec 2007 07:25:58 +0000 Subject: applied gss-api enhancement form varmojfekoj --- configure.ac | 1 - gss-misc.c | 10 +-- omfwd.c | 4 +- syslogd.c | 88 ++++++++++++++++++------ syslogd.h | 1 + tcpsyslog.c | 215 +++++++++++++++++++++++++++++++++++++++++++++++------------ tcpsyslog.h | 6 ++ 7 files changed, 253 insertions(+), 72 deletions(-) diff --git a/configure.ac b/configure.ac index 50685926..7a3ce7ea 100644 --- a/configure.ac +++ b/configure.ac @@ -147,7 +147,6 @@ AC_ARG_ENABLE(gssapi_krb5, if test $want_gssapi_krb5 = yes; then AC_CHECK_LIB(gssapi_krb5, gss_acquire_cred, [ AC_CHECK_HEADER(gssapi/gssapi.h, [ - AC_MSG_ERROR(GSS-API not ready for prime time yet -- wait for next release); AC_DEFINE(USE_GSSAPI,, Define if you want to use GSSAPI) gss_libs="-lgssapi_krb5" diff --git a/gss-misc.c b/gss-misc.c index 68197f01..7a09b1b9 100644 --- a/gss-misc.c +++ b/gss-misc.c @@ -85,12 +85,12 @@ static int read_all(int fd, char *buf, unsigned int nbyte) fd_set rfds; struct timeval tv; - FD_ZERO(&rfds); - FD_SET(fd, &rfds); - tv.tv_sec = 1; - tv.tv_usec = 0; - for (ptr = buf; nbyte; ptr += ret, nbyte -= ret) { + FD_ZERO(&rfds); + FD_SET(fd, &rfds); + tv.tv_sec = 1; + tv.tv_usec = 0; + if ((ret = select(FD_SETSIZE, &rfds, NULL, NULL, &tv)) <= 0 || !FD_ISSET(fd, &rfds)) return ret; diff --git a/omfwd.c b/omfwd.c index 6491aea4..d773b23a 100644 --- a/omfwd.c +++ b/omfwd.c @@ -168,7 +168,7 @@ CODESTARTfreeInstance OM_uint32 maj_stat, min_stat; if (pData->gss_context != GSS_C_NO_CONTEXT) { - maj_stat = gss_delete_sec_context(&min_stat, pData->gss_context, GSS_C_NO_BUFFER); + maj_stat = gss_delete_sec_context(&min_stat, &pData->gss_context, GSS_C_NO_BUFFER); if (maj_stat != GSS_S_COMPLETE) display_status("deleting context", maj_stat, min_stat); } @@ -1143,7 +1143,7 @@ ENDqueryEtryPt #ifdef USE_GSSAPI -static rsRetVal setGSSMode(void *pVal, uchar *mode) +static rsRetVal setGSSMode(void __attribute__((unused)) *pVal, uchar *mode) { if (!strcmp((char *) mode, "none")) { gss_mode = GSSMODE_NONE; diff --git a/syslogd.c b/syslogd.c index 45ff32bb..a7e0003f 100644 --- a/syslogd.c +++ b/syslogd.c @@ -643,6 +643,10 @@ static struct AllowedSenders *pAllowedSenders_UDP = NULL; /* the roots of the al struct AllowedSenders *pAllowedSenders_TCP = NULL; /* lists. If NULL, all senders are ok! */ static struct AllowedSenders *pLastAllowedSenders_UDP = NULL; /* and now the pointers to the last */ static struct AllowedSenders *pLastAllowedSenders_TCP = NULL; /* element in the respective list */ +#ifdef USE_GSSAPI +struct AllowedSenders *pAllowedSenders_GSS = NULL; +static struct AllowedSenders *pLastAllowedSenders_GSS = NULL; +#endif #endif /* #ifdef SYSLOG_INET */ int option_DisallowWarning = 1; /* complain if message from disallowed sender is received */ @@ -940,12 +944,24 @@ static void PrintAllowedSenders(int iListToPrint) struct AllowedSenders *pSender; uchar szIP[64]; - assert((iListToPrint == 1) || (iListToPrint == 2)); + assert((iListToPrint == 1) || (iListToPrint == 2) +#ifdef USE_GSSAPI + || (iListToPrint == 3) +#endif + ); printf("\nAllowed %s Senders:\n", - (iListToPrint == 1) ? "UDP" : "TCP"); - pSender = (iListToPrint == 1) ? - pAllowedSenders_UDP : pAllowedSenders_TCP; + (iListToPrint == 1) ? "UDP" : +#ifdef USE_GSSAPI + (iListToPrint == 3) ? "GSS" : +#endif + "TCP"); + + pSender = (iListToPrint == 1) ? pAllowedSenders_UDP : +#ifdef USE_GSSAPI + (iListToPrint == 3) ? pAllowedSenders_GSS : +#endif + pAllowedSenders_TCP; if(pSender == NULL) { printf("\tNo restrictions set.\n"); } else { @@ -1068,7 +1084,6 @@ int isAllowedSender(struct AllowedSenders *pAllowRoot, struct sockaddr *pFrom, c if (MaskCmp (&(pAllow->allowedSender), pAllow->SignificantBits, pFrom, pszFromHost)) return 1; } - dbgprintf("%s is not an allowed sender\n", pszFromHost); return 0; } #endif /* #ifdef SYSLOG_INET */ @@ -1629,7 +1644,7 @@ void getCurrTime(struct syslogTime *t) static int usage(void) { fprintf(stderr, "usage: rsyslogd [-46AdhqQvw] [-l hostlist] [-m markinterval] [-n] [-p path]\n" \ - " [-s domainlist] [-r[port]] [-tport[,max-sessions]] [-f conffile] [-i pidfile] [-x]\n"); + " [-s domainlist] [-r[port]] [-tport[,max-sessions]] [-gport[,max-sessions]] [-f conffile] [-i pidfile] [-x]\n"); exit(1); /* "good" exit - done to terminate usage() */ } @@ -3624,6 +3639,10 @@ static void die(int sig) if(sockTCPLstn != NULL && *sockTCPLstn) { deinit_tcp_listener(); } +#ifdef USE_GSSAPI + if(bEnableTCP & ALLOWEDMETHOD_GSS) + TCPSessGSSDeinit(); +#endif #endif /* Clean-up files. */ @@ -3714,6 +3733,11 @@ static rsRetVal addAllowedSenderLine(char* pName, uchar** ppRestOfConfLine) } else if(!strcasecmp(pName, "tcp")) { ppRoot = &pAllowedSenders_TCP; ppLast = &pLastAllowedSenders_TCP; +#ifdef USE_GSSAPI + } else if(!strcasecmp(pName, "gss")) { + ppRoot = &pAllowedSenders_GSS; + ppLast = &pLastAllowedSenders_GSS; +#endif } else { logerrorSz("Invalid protocol '%s' in allowed sender " "list, line ignored", pName); @@ -4217,6 +4241,9 @@ static void dbgPrintInitInfo(void) /* now the allowedSender lists: */ PrintAllowedSenders(1); /* UDP */ PrintAllowedSenders(2); /* TCP */ +#ifdef USE_GSSAPI + PrintAllowedSenders(3); /* GSS */ +#endif printf("\n"); #endif /* #ifdef SYSLOG_INET */ @@ -4370,9 +4397,19 @@ static void init(void) clearAllowedSenders (pAllowedSenders_TCP); pAllowedSenders_TCP = NULL; } +#ifdef USE_GSSAPI + if (pAllowedSenders_GSS != NULL) { + clearAllowedSenders (pAllowedSenders_GSS); + pAllowedSenders_GSS = NULL; + } +#endif } - assert(pAllowedSenders_UDP == NULL && pAllowedSenders_TCP == NULL); + assert(pAllowedSenders_UDP == NULL && pAllowedSenders_TCP == NULL +#ifdef USE_GSSAPI + && pAllowedSenders_GSS == NULL +#endif + ); #endif /* I was told by an IPv6 expert that calling getservbyname() seems to be * still valid, at least for the use case we have. So I re-enabled that @@ -4509,16 +4546,17 @@ static void init(void) * user-selectable option. rgerhards, 2007-06-21 */ # ifdef USE_GSSAPI - if(bEnableTCP == 2) { + if(bEnableTCP & ALLOWEDMETHOD_GSS) { if(TCPSessGSSInit()) { logerror("GSS-API initialization failed\n"); - bEnableTCP = -1; + bEnableTCP &= ~(ALLOWEDMETHOD_GSS); } } + if(bEnableTCP) # endif - if((sockTCPLstn = create_tcp_socket()) != NULL) { - dbgprintf("Opened %d syslog TCP port(s).\n", *sockTCPLstn); - } + if((sockTCPLstn = create_tcp_socket()) != NULL) { + dbgprintf("Opened %d syslog TCP port(s).\n", *sockTCPLstn); + } } } #endif @@ -5728,6 +5766,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se (struct sockaddr *)&frominet, (char*)fromHostFQDN)) { printchopped((char*)fromHost, line, l, finet[i+1], 1); } else { + dbgprintf("%s is not an allowed sender\n", (char*)fromHostFQDN); if(option_DisallowWarning) { logerrorSz("UDP message from disallowed sender %s discarded", (char*)fromHost); @@ -5752,7 +5791,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se if (FD_ISSET(sockTCPLstn[i+1], pReadfds)) { dbgprintf("New connect on TCP inetd socket: #%d\n", sockTCPLstn[i+1]); # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(bEnableTCP & ALLOWEDMETHOD_GSS) TCPSessGSSAccept(sockTCPLstn[i+1]); else # endif @@ -5773,14 +5812,15 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se /* Receive message */ # ifdef USE_GSSAPI - if(bEnableTCP == 2) + int allowedMethods = pTCPSessions[iTCPSess].allowedMethods; + if(allowedMethods & ALLOWEDMETHOD_GSS) state = TCPSessGSSRecv(iTCPSess, buf, sizeof(buf)); else # endif state = recv(fdSess, buf, sizeof(buf), 0); if(state == 0) { # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(allowedMethods & ALLOWEDMETHOD_GSS) TCPSessGSSClose(iTCPSess); else { # endif @@ -5795,7 +5835,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se logerrorInt("TCP session %d will be closed, error ignored\n", fdSess); # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(allowedMethods & ALLOWEDMETHOD_GSS) TCPSessGSSClose(iTCPSess); else # endif @@ -5810,7 +5850,7 @@ static rsRetVal processSelectAfter(int maxfds, int nfds, fd_set *pReadfds, fd_se "previous messages for reason(s)\n", iTCPSess); # ifdef USE_GSSAPI - if(bEnableTCP == 2) + if(allowedMethods & ALLOWEDMETHOD_GSS) TCPSessGSSClose(iTCPSess); else # endif @@ -6136,6 +6176,11 @@ static void printVersion(void) #else printf("\tSYSLOG_INET (Internet/remote support):\tNo\n"); #endif +#if defined(SYSLOG_INET) && defined(USE_GSSAPI) + printf("\tFEATURE_GSSAPI (GSSAPI Kerberos 5 support):\tYes\n"); +#else + printf("\tFEATURE_GSSAPI (GSSAPI Kerberos 5 support):\tNo\n"); +#endif #ifndef NDEBUG printf("\tFEATURE_DEBUG (debug build, slow code):\tYes\n"); #else @@ -6282,8 +6327,9 @@ int main(int argc, char **argv) break; case 'g': /* enable tcp gssapi logging */ #if defined(SYSLOG_INET) && defined(USE_GSSAPI) - configureTCPListen(optarg); - bEnableTCP = 2; + if (!bEnableTCP) + configureTCPListen(optarg); + bEnableTCP |= ALLOWEDMETHOD_GSS; #else fprintf(stderr, "rsyslogd: -g not valid - not compiled with gssapi support"); #endif @@ -6341,7 +6387,9 @@ int main(int argc, char **argv) break; case 't': /* enable tcp logging */ #ifdef SYSLOG_INET - configureTCPListen(optarg); + if (!bEnableTCP) + configureTCPListen(optarg); + bEnableTCP |= ALLOWEDMETHOD_TCP; #else fprintf(stderr, "rsyslogd: -t not valid - not compiled with network support"); #endif diff --git a/syslogd.h b/syslogd.h index 43d4f0ea..aefe13b0 100644 --- a/syslogd.h +++ b/syslogd.h @@ -79,6 +79,7 @@ extern char **StripDomains; extern char *LocalDomain; extern int bDropMalPTRMsgs; extern struct AllowedSenders *pAllowedSenders_TCP; +extern struct AllowedSenders *pAllowedSenders_GSS; extern char ctty[]; #endif /* #ifndef SYSLOGD_H_INCLUDED */ diff --git a/tcpsyslog.c b/tcpsyslog.c index c2591663..1891505c 100644 --- a/tcpsyslog.c +++ b/tcpsyslog.c @@ -77,7 +77,7 @@ int *sockTCPLstn = NULL; /* read-only after startup, modified by restart */ struct TCPSession *pTCPSessions; /* The thread-safeness of the sesion table is doubtful */ #ifdef USE_GSSAPI -static gss_cred_id_t gss_server_creds; +static gss_cred_id_t gss_server_creds = GSS_C_NO_CREDENTIAL; char *gss_listen_service_name = NULL; #endif @@ -99,7 +99,6 @@ void configureTCPListen(char *cOptarg) register char *pArg = cOptarg; assert(cOptarg != NULL); - bEnableTCP = -1; /* enable TCP listening */ /* extract port */ i = 0; @@ -166,6 +165,7 @@ static int TCPSessInit(void) #ifdef USE_GSSAPI pTCPSessions[i].gss_flags = 0; pTCPSessions[i].gss_context = GSS_C_NO_CONTEXT; + pTCPSessions[i].allowedMethods = 0; #endif } return(0); @@ -229,7 +229,7 @@ void deinit_tcp_listener(void) close(fd); free(pTCPSessions[iTCPSess].fromHost); #ifdef USE_GSSAPI - if(bEnableTCP == 2) { + if(bEnableTCP & ALLOWEDMETHOD_GSS) { OM_uint32 maj_stat, min_stat; maj_stat = gss_delete_sec_context(&min_stat, &pTCPSessions[iTCPSess].gss_context, GSS_C_NO_BUFFER); if (maj_stat != GSS_S_COMPLETE) @@ -420,6 +420,7 @@ int TCPSessAccept(int fd) uchar fromHost[NI_MAXHOST]; uchar fromHostFQDN[NI_MAXHOST]; char *pBuf; + char allowedMethods = 0; newConn = accept(fd, (struct sockaddr*) &addr, &addrlen); if (newConn < 0) { @@ -453,7 +454,21 @@ int TCPSessAccept(int fd) * configured to do this). * rgerhards, 2005-09-26 */ - if(!isAllowedSender(pAllowedSenders_TCP, (struct sockaddr *)&addr, (char*)fromHostFQDN)) { +#ifdef USE_GSSAPI + if((bEnableTCP & ALLOWEDMETHOD_TCP) && + isAllowedSender(pAllowedSenders_TCP, (struct sockaddr *)&addr, (char*)fromHostFQDN)) + allowedMethods |= ALLOWEDMETHOD_TCP; + if((bEnableTCP & ALLOWEDMETHOD_GSS) && + isAllowedSender(pAllowedSenders_GSS, (struct sockaddr *)&addr, (char*)fromHostFQDN)) + allowedMethods |= ALLOWEDMETHOD_GSS; + if(allowedMethods) + pTCPSessions[iSess].allowedMethods = allowedMethods; + else +#else + if(!isAllowedSender(pAllowedSenders_TCP, (struct sockaddr *)&addr, (char*)fromHostFQDN)) +#endif + { + dbgprintf("%s is not an allowed sender\n", (char *) fromHostFQDN); if(option_DisallowWarning) { errno = 0; logerrorSz("TCP message from disallowed sender %s discarded", @@ -706,7 +721,10 @@ int TCPSessGSSInit(void) gss_buffer_desc name_buf; gss_name_t server_name; OM_uint32 maj_stat, min_stat; - + + if (gss_server_creds != GSS_C_NO_CREDENTIAL) + return 0; + name_buf.value = (gss_listen_service_name == NULL) ? "host" : gss_listen_service_name; name_buf.length = strlen(name_buf.value) + 1; maj_stat = gss_import_name(&min_stat, &name_buf, GSS_C_NT_HOSTBASED_SERVICE, &server_name); @@ -733,60 +751,159 @@ int TCPSessGSSAccept(int fd) { gss_buffer_desc send_tok, recv_tok; gss_name_t client; - gss_OID doid; OM_uint32 maj_stat, min_stat, acc_sec_min_stat; int iSess; gss_ctx_id_t *context; OM_uint32 *sess_flags; int fdSess; + char allowedMethods; if ((iSess = TCPSessAccept(fd)) == -1) return -1; - context = &pTCPSessions[iSess].gss_context; - *context = GSS_C_NO_CONTEXT; - sess_flags = &pTCPSessions[iSess].gss_flags; - fdSess = pTCPSessions[iSess].sock; - - do { - if (recv_token(fdSess, &recv_tok) <= 0) - return -1; - - maj_stat = gss_accept_sec_context(&acc_sec_min_stat, context, gss_server_creds, - &recv_tok, GSS_C_NO_CHANNEL_BINDINGS, &client, - NULL, &send_tok, sess_flags, NULL, NULL); - if (recv_tok.value) { - free(recv_tok.value); - recv_tok.value = NULL; - } - if (send_tok.length != 0) { - if (send_token(fdSess, &send_tok) < 0) { + allowedMethods = pTCPSessions[iSess].allowedMethods; + if (allowedMethods & ALLOWEDMETHOD_GSS) { + /* Buffer to store raw message in case that + * gss authentication fails halfway through. + */ + char buf[MAXLINE]; + int ret = 0; + + dbgprintf("GSS-API Trying to accept TCP session %d\n", iSess); + + fdSess = pTCPSessions[iSess].sock; + if (allowedMethods & ALLOWEDMETHOD_TCP) { + int len; + fd_set fds; + struct timeval tv; + + do { + FD_ZERO(&fds); + FD_SET(fdSess, &fds); + tv.tv_sec = 1; + tv.tv_usec = 0; + ret = select(fdSess + 1, &fds, NULL, NULL, &tv); + } while (ret < 0 && errno == EINTR); + if (ret < 0) { + logerrorInt("TCP session %d will be closed, error ignored\n", iSess); + TCPSessClose(iSess); return -1; + } else if (ret == 0) { + dbgprintf("GSS-API Reverting to plain TCP\n"); + pTCPSessions[iSess].allowedMethods = ALLOWEDMETHOD_TCP; + return 0; } - gss_release_buffer(&min_stat, &send_tok); - } - if (maj_stat != GSS_S_COMPLETE - && maj_stat != GSS_S_CONTINUE_NEEDED) { - display_status("accepting context", maj_stat, - acc_sec_min_stat); - if (*context != GSS_C_NO_CONTEXT) - gss_delete_sec_context(&min_stat, context, - GSS_C_NO_BUFFER); - return -1; - } - } while (maj_stat == GSS_S_CONTINUE_NEEDED); + do { + ret = recv(fdSess, buf, sizeof (buf), MSG_PEEK); + } while (ret < 0 && errno == EINTR); + if (ret <= 0) { + if (ret == 0) + dbgprintf("GSS-API Connection closed by peer\n"); + else + logerrorInt("TCP session %d will be closed, error ignored\n", iSess); + TCPSessClose(iSess); + return -1; + } - maj_stat = gss_display_name(&min_stat, client, &recv_tok, NULL); - if (maj_stat != GSS_S_COMPLETE) - display_status("displaying name", maj_stat, min_stat); - gss_release_name(&min_stat, &client); + if (ret < 4) { + dbgprintf("GSS-API Reverting to plain TCP\n"); + pTCPSessions[iSess].allowedMethods = ALLOWEDMETHOD_TCP; + return 0; + } else if (ret == 4) { + /* The client might has been interupted after sending + * the data length (4B), give him another chance. + */ + sleep(1); + do { + ret = recv(fdSess, buf, sizeof (buf), MSG_PEEK); + } while (ret < 0 && errno == EINTR); + if (ret <= 0) { + if (ret == 0) + dbgprintf("GSS-API Connection closed by peer\n"); + else + logerrorInt("TCP session %d will be closed, error ignored\n", iSess); + TCPSessClose(iSess); + return -1; + } + } - dbgprintf("GSS-API Accepted connection from: %s\n", recv_tok.value); - gss_release_buffer(&min_stat, &recv_tok); + len = ntohl((buf[0] << 24) + | (buf[1] << 16) + | (buf[2] << 8) + | buf[3]); + if ((ret - 4) < len || len == 0) { + dbgprintf("GSS-API Reverting to plain TCP\n"); + pTCPSessions[iSess].allowedMethods = ALLOWEDMETHOD_TCP; + return 0; + } + } - dbgprintf("GSS-API Provided context flags:\n"); - display_ctx_flags(*sess_flags); + context = &pTCPSessions[iSess].gss_context; + *context = GSS_C_NO_CONTEXT; + sess_flags = &pTCPSessions[iSess].gss_flags; + do { + if (recv_token(fdSess, &recv_tok) <= 0) { + logerrorInt("TCP session %d will be closed, error ignored\n", iSess); + TCPSessClose(iSess); + return -1; + } + maj_stat = gss_accept_sec_context(&acc_sec_min_stat, context, gss_server_creds, + &recv_tok, GSS_C_NO_CHANNEL_BINDINGS, &client, + NULL, &send_tok, sess_flags, NULL, NULL); + if (recv_tok.value) { + free(recv_tok.value); + recv_tok.value = NULL; + } + if (maj_stat != GSS_S_COMPLETE + && maj_stat != GSS_S_CONTINUE_NEEDED) { + gss_release_buffer(&min_stat, &send_tok); + if (*context != GSS_C_NO_CONTEXT) + gss_delete_sec_context(&min_stat, context, GSS_C_NO_BUFFER); + if ((allowedMethods & ALLOWEDMETHOD_TCP) && + (GSS_ROUTINE_ERROR(maj_stat) == GSS_S_DEFECTIVE_TOKEN)) { + dbgprintf("GSS-API Reverting to plain TCP\n"); + dbgprintf("tcp session socket with new data: #%d\n", fdSess); + if(TCPSessDataRcvd(iSess, buf, ret) == 0) { + logerrorInt("Tearing down TCP Session %d - see " + "previous messages for reason(s)\n", + iSess); + TCPSessClose(iSess); + return -1; + } + pTCPSessions[iSess].allowedMethods = ALLOWEDMETHOD_TCP; + return 0; + } + display_status("accepting context", maj_stat, + acc_sec_min_stat); + TCPSessClose(iSess); + return -1; + } + if (send_tok.length != 0) { + if (send_token(fdSess, &send_tok) < 0) { + gss_release_buffer(&min_stat, &send_tok); + logerrorInt("TCP session %d will be closed, error ignored\n", iSess); + if (*context != GSS_C_NO_CONTEXT) + gss_delete_sec_context(&min_stat, context, GSS_C_NO_BUFFER); + TCPSessClose(iSess); + return -1; + } + gss_release_buffer(&min_stat, &send_tok); + } + } while (maj_stat == GSS_S_CONTINUE_NEEDED); + + maj_stat = gss_display_name(&min_stat, client, &recv_tok, NULL); + if (maj_stat != GSS_S_COMPLETE) + display_status("displaying name", maj_stat, min_stat); + else + dbgprintf("GSS-API Accepted connection from: %s\n", recv_tok.value); + gss_release_name(&min_stat, &client); + gss_release_buffer(&min_stat, &recv_tok); + + dbgprintf("GSS-API Provided context flags:\n"); + display_ctx_flags(*sess_flags); + pTCPSessions[iSess].allowedMethods = ALLOWEDMETHOD_GSS; + } return 0; } @@ -845,9 +962,19 @@ void TCPSessGSSClose(int iSess) { display_status("deleting context", maj_stat, min_stat); *context = GSS_C_NO_CONTEXT; pTCPSessions[iSess].gss_flags = 0; + pTCPSessions[iSess].allowedMethods = 0; TCPSessClose(iSess); } + + +void TCPSessGSSDeinit(void) { + OM_uint32 maj_stat, min_stat; + + maj_stat = gss_release_cred(&min_stat, &gss_server_creds); + if (maj_stat != GSS_S_COMPLETE) + display_status("releasing credentials", maj_stat, min_stat); +} #endif /* #ifdef USE_GSSAPI */ diff --git a/tcpsyslog.h b/tcpsyslog.h index f8e2fa94..a68e8934 100644 --- a/tcpsyslog.h +++ b/tcpsyslog.h @@ -39,6 +39,7 @@ struct TCPSession { #if defined(SYSLOG_INET) && defined(USE_GSSAPI) OM_uint32 gss_flags; gss_ctx_id_t gss_context; + char allowedMethods; #endif }; @@ -49,8 +50,12 @@ extern int bEnableTCP; extern struct TCPSession *pTCPSessions; #if defined(SYSLOG_INET) && defined(USE_GSSAPI) extern char *gss_listen_service_name; + +#define ALLOWEDMETHOD_GSS 2 #endif +#define ALLOWEDMETHOD_TCP 1 + /* prototypes */ void deinit_tcp_listener(void); int *create_tcp_socket(void); @@ -65,6 +70,7 @@ int TCPSessGSSInit(void); int TCPSessGSSAccept(int fd); int TCPSessGSSRecv(int fd, void *buf, size_t buf_len); void TCPSessGSSClose(int sess); +void TCPSessGSSDeinit(void); #endif #endif /* #ifndef TCPSYSLOG_H_INCLUDED */ -- cgit