diff options
| author | Damien Miller <djm@mindrot.org> | 2014-02-27 00:17:49 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2014-02-27 00:17:49 +0100 |
| commit | e6a74aeeacd01d885262ff8e50eb28faee8c8039 (patch) | |
| tree | 5e3bb4872b341d7364268634c7cfeb64658cb50e /gss-serv.c | |
| parent | - djm@cvs.openbsd.org 2014/02/26 20:18:37 (diff) | |
| download | openssh-e6a74aeeacd01d885262ff8e50eb28faee8c8039.tar.xz openssh-e6a74aeeacd01d885262ff8e50eb28faee8c8039.zip | |
- djm@cvs.openbsd.org 2014/02/26 20:28:44
[auth2-gss.c gss-serv.c ssh-gss.h sshd.c]
bz#2107 - cache OIDs of supported GSSAPI mechanisms before privsep
sandboxing, as running this code in the sandbox can cause violations;
ok markus@
Diffstat (limited to 'gss-serv.c')
| -rw-r--r-- | gss-serv.c | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/gss-serv.c b/gss-serv.c index b61e6e140..e61b37bec 100644 --- a/gss-serv.c +++ b/gss-serv.c @@ -1,4 +1,4 @@ -/* $OpenBSD: gss-serv.c,v 1.25 2014/02/02 03:44:31 djm Exp $ */ +/* $OpenBSD: gss-serv.c,v 1.26 2014/02/26 20:28:44 djm Exp $ */ /* * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. @@ -66,6 +66,25 @@ ssh_gssapi_mech* supported_mechs[]= { &gssapi_null_mech, }; +/* + * ssh_gssapi_supported_oids() can cause sandbox violations, so prepare the + * list of supported mechanisms before privsep is set up. + */ +static gss_OID_set supported_oids; + +void +ssh_gssapi_prepare_supported_oids(void) +{ + ssh_gssapi_supported_oids(&supported_oids); +} + +OM_uint32 +ssh_gssapi_test_oid_supported(OM_uint32 *ms, gss_OID member, int *present) +{ + if (supported_oids == NULL) + ssh_gssapi_prepare_supported_oids(); + return gss_test_oid_set_member(ms, member, supported_oids, present); +} /* * Acquire credentials for a server running on the current host. |