More compiler quietening.

[exim.git] / src / src / auths / heimdal_gssapi.c

diff --git a/src/src/auths/heimdal_gssapi.c b/src/src/auths/heimdal_gssapi.c
index 29d148b125d02d7a313f1803dfb00c018da811d0..21ed75bf4813e4f9ce5ec75884ad71ca01f92ea1 100644 (file)
--- a/src/src/auths/heimdal_gssapi.c
+++ b/src/src/auths/heimdal_gssapi.c
@@ -9,7 +9,7 @@
    Author: Phil Pennock <pdp@exim.org> */
 /* Copyright (c) Phil Pennock 2012 */
 
-/* Interface to Heimdal SASL library for GSSAPI authentication. */
+/* Interface to Heimdal library for GSSAPI authentication. */
 
 /* Naming and rationale
 
@@ -34,15 +34,18 @@ Without rename, we could add an option for GS2 support in the future.
 * heimdal sources and man-pages, plus http://www.h5l.org/manual/
 * FreeBSD man-pages (very informative!)
 * http://www.ggf.org/documents/GFD.24.pdf confirming GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
-  semantics, that found by browsing Heimdal source to find how to set the keytab
-
+  semantics, that found by browsing Heimdal source to find how to set the keytab; however,
+  after multiple attempts I failed to get that to work and instead switched to
+  gsskrb5_register_acceptor_identity().
 */
 
 #include "../exim.h"
 
 #ifndef AUTH_HEIMDAL_GSSAPI
 /* dummy function to satisfy compilers when we link in an "empty" file. */
-static void dummy(int x) { dummy(x-1); }
+static void dummy(int x);
+static void dummy2(int x) { dummy(x-1); }
+static void dummy(int x) { dummy2(x-1); }
 #else
 
 #include <gssapi/gssapi.h>
@@ -51,9 +54,6 @@ static void dummy(int x) { dummy(x-1); }
 /* for the _init debugging */
 #include <krb5.h>
 
-/* Because __gss_krb5_register_acceptor_identity_x_oid_desc is internal */
-#include <roken.h>
-
 #include "heimdal_gssapi.h"
 
 /* Authenticator-specific options. */
@@ -62,8 +62,6 @@ optionlist auth_heimdal_gssapi_options[] = {
       (void *)(offsetof(auth_heimdal_gssapi_options_block, server_hostname)) },
   { "server_keytab",        opt_stringptr,
       (void *)(offsetof(auth_heimdal_gssapi_options_block, server_keytab)) },
-  { "server_realm",         opt_stringptr,
-      (void *)(offsetof(auth_heimdal_gssapi_options_block, server_realm)) },
   { "server_service",       opt_stringptr,
       (void *)(offsetof(auth_heimdal_gssapi_options_block, server_service)) }
 };
@@ -75,7 +73,6 @@ int auth_heimdal_gssapi_options_count =
 auth_heimdal_gssapi_options_block auth_heimdal_gssapi_option_defaults = {
   US"$primary_hostname",    /* server_hostname */
   NULL,                     /* server_keytab */
-  NULL,                     /* server_realm */
   US"smtp",                 /* server_service */
 };
 
@@ -99,8 +96,8 @@ static int
 enable consistency checks to be done, or anything else that needs
 to be set up. */
 
-/* Heimdal provides a GSSAPI extension method (via an OID) for setting the
-keytab; in the init, we mostly just use raw krb5 methods so that we can report
+/* Heimdal provides a GSSAPI extension method for setting the keytab;
+in the init, we mostly just use raw krb5 methods so that we can report
 the keytab contents, for -D+auth debugging. */
 
 void
@@ -313,6 +310,7 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data)
             error_out = auth_get_data(&from_client, US"", 0);
             if (error_out != OK)
               goto ERROR_OUT;
+            handled_empty_ir = TRUE;
             continue;
           }
         }
@@ -369,7 +367,7 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data)
         0x02 Integrity protection
         0x04 Confidentiality protection
 
-        The remaining three octets are the maximum buffer size for wrappe
+        The remaining three octets are the maximum buffer size for wrapped
         content. */
         sasl_config[0] = 0x01;  /* Exim does not wrap/unwrap SASL layers after auth */
         gbufdesc.value = (void *) sasl_config;
@@ -416,10 +414,10 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data)
           error_out = FAIL;
           goto ERROR_OUT;
         }
-        if (gbufdesc_out.length < 5) {
+        if (gbufdesc_out.length < 4) {
           HDEBUG(D_auth)
             debug_printf("gssapi: final message too short; "
-                "need flags, buf sizes and authzid\n");
+                "need flags, buf sizes and optional authzid\n");
           error_out = FAIL;
           goto ERROR_OUT;
         }
@@ -438,14 +436,17 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data)
 
         /* Identifiers:
         The SASL provided identifier is an unverified authzid.
-        GSSAPI provides us with a verified identifier.
+        GSSAPI provides us with a verified identifier, but it might be empty
+        for some clients.
         */
 
         /* $auth2 is authzid requested at SASL layer */
-        expand_nlength[2] = gbufdesc_out.length - 4;
-        auth_vars[1] = expand_nstring[2] =
-          string_copyn((US gbufdesc_out.value) + 4, expand_nlength[2]);
-        expand_nmax = 2;
+        if (gbufdesc_out.length > 4) {
+          expand_nlength[2] = gbufdesc_out.length - 4;
+          auth_vars[1] = expand_nstring[2] =
+            string_copyn((US gbufdesc_out.value) + 4, expand_nlength[2]);
+          expand_nmax = 2;
+        }
 
         gss_release_buffer(&min_stat, &gbufdesc_out);
         EmptyBuf(gbufdesc_out);
@@ -468,6 +469,14 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data)
         auth_vars[0] = expand_nstring[1] =
           string_copyn(gbufdesc_out.value, gbufdesc_out.length);
 
+        if (expand_nmax == 0) { /* should be: authzid was empty */
+          expand_nmax = 2;
+          expand_nlength[2] = expand_nlength[1];
+          auth_vars[1] = expand_nstring[2] = string_copyn(expand_nstring[1], expand_nlength[1]);
+          HDEBUG(D_auth)
+            debug_printf("heimdal SASL: empty authzid, set to dup of GSSAPI display name\n");
+        }
+
         HDEBUG(D_auth)
           debug_printf("heimdal SASL: happy with client request\n"
              "  auth1 (verified GSSAPI display-name): \"%s\"\n"
@@ -519,7 +528,7 @@ exim_gssapi_error_defer(uschar *store_reset_point,
   va_start(ap, format);
   if (!string_vformat(buffer, sizeof(buffer), format, ap))
     log_write(0, LOG_MAIN|LOG_PANIC_DIE,
-        "exim_gssapi_error_defer expansion larger than %d",
+        "exim_gssapi_error_defer expansion larger than %lu",
         sizeof(buffer));
   va_end(ap);