improve support for GSS_S_CONTINUE_NEEDED (still not fully working); syslog more...

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/raeburn-gssapi-cfx@15902 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/gssftp/ftpd/ftpd.c b/src/appl/gssftp/ftpd/ftpd.c
index 2a09bf3d08031f2c8c167070186787886d79cee2..73b36673e74d6bdde8de1a5a833e01c1efff0b2d 100644 (file)
--- a/src/appl/gssftp/ftpd/ftpd.c
+++ b/src/appl/gssftp/ftpd/ftpd.c
@@ -154,6 +154,8 @@ krb5_ccache ccache;
 static void ftpd_gss_convert_creds(char *name, gss_cred_id_t);
 static int ftpd_gss_userok(gss_buffer_t, char *name);
 
+static void log_gss_error(int, OM_uint32, OM_uint32, const char *);
+
 #endif /* GSSAPI */
 
 char *auth_type;       /* Authentication succeeded?  If so, what type? */
@@ -2502,18 +2504,18 @@ char *adata;
                                                                &deleg_creds);
                                return(0);
                        }
-                       if (stat_maj == GSS_S_COMPLETE) {
+                       if (accept_maj == GSS_S_COMPLETE) {
                                reply(235, "ADAT=%s", gbuf);
-                               replied = 1;
                        } else {
                                /* If the server accepts the security data, and
                                   requires additional data, it should respond
                                   with reply code 335. */
                                reply(335, "ADAT=%s", gbuf);
                        }
+                       replied = 1;
                        (void) gss_release_buffer(&stat_min, &out_tok);
                }
-               if (stat_maj == GSS_S_COMPLETE) {
+               if (accept_maj == GSS_S_COMPLETE) {
                        /* GSSAPI authentication succeeded */
                        stat_maj = gss_display_name(&stat_min, client,
                                                    &client_name, &mechid);
@@ -2523,7 +2525,8 @@ char *adata;
                                   respond with reply code 535." */
                                reply_gss_error(535, stat_maj, stat_min,
                                                "extracting GSSAPI identity name");
-                               syslog(LOG_ERR, "gssapi error extracting identity");
+                               log_gss_error(LOG_ERR, stat_maj, stat_min,
+                                             "gssapi error extracting identity");
                                (void) gss_release_cred(&stat_min, &server_creds);
                                if (ret_flags & GSS_C_DELEG_FLAG)
                                        (void) gss_release_cred(&stat_min,
@@ -2554,11 +2557,12 @@ char *adata;
                          }
                                
                        return(1);
-               } else if (stat_maj == GSS_S_CONTINUE_NEEDED) {
+               } else if (accept_maj == GSS_S_CONTINUE_NEEDED) {
                        /* If the server accepts the security data, and
                           requires additional data, it should respond with
                           reply code 335. */
-                       reply(335, "more data needed");
+                       if (!replied)
+                           reply(335, "more data needed");
                        (void) gss_release_cred(&stat_min, &server_creds);
                        if (ret_flags & GSS_C_DELEG_FLAG)
                          (void) gss_release_cred(&stat_min, &deleg_creds);
@@ -2806,11 +2810,44 @@ char *buf;
 #endif /* SETPROCTITLE */
 
 #ifdef GSSAPI
+/* A more general callback would probably use a void*, but currently I
+   only need an int in both cases.  */
+static void with_gss_error_text(void (*cb)(const char *, int, int),
+                               OM_uint32 maj_stat, OM_uint32 min_stat,
+                               int misc);
+
+static void
+log_gss_error_1(const char *msg, int severity, int is_major)
+{
+    syslog(severity, "... GSSAPI error %s: %s",
+          is_major ? "major" : "minor", msg);
+}
+
+static void
+log_gss_error(int severity, OM_uint32 maj_stat, OM_uint32 min_stat,
+             const char *s)
+{
+    syslog(severity, s);
+    with_gss_error_text(log_gss_error_1, maj_stat, min_stat, severity);
+}
+
+static void
+reply_gss_error_1(const char *msg, int code, int is_major)
+{
+    lreply(code, "GSSAPI error %s: %s",
+          is_major ? "major" : "minor", msg);
+}
+
 void
-reply_gss_error(code, maj_stat, min_stat, s)
-int code;
-OM_uint32 maj_stat, min_stat;
-char *s;
+reply_gss_error(int code, OM_uint32 maj_stat, OM_uint32 min_stat, char *s)
+{
+    with_gss_error_text(reply_gss_error_1, maj_stat, min_stat, code);
+    reply(code, "GSSAPI error: %s", s);
+}
+
+static void with_gss_error_text(void (*cb)(const char *, int, int),
+                               OM_uint32 maj_stat, OM_uint32 min_stat,
+                               int misc)
 {
        /* a lot of work just to report the error */
        OM_uint32 gmaj_stat, gmin_stat;
@@ -2824,8 +2861,7 @@ char *s;
                                               &msg_ctx, &msg);
                if ((gmaj_stat == GSS_S_COMPLETE)||
                    (gmaj_stat == GSS_S_CONTINUE_NEEDED)) {
-                       lreply(code, "GSSAPI error major: %s", 
-                              (char*)msg.value);
+                       (*cb)((char*)msg.value, misc, 1);
                        (void) gss_release_buffer(&gmin_stat, &msg);
                }
                if (gmaj_stat != GSS_S_CONTINUE_NEEDED)
@@ -2839,14 +2875,12 @@ char *s;
                                               &msg_ctx, &msg);
                if ((gmaj_stat == GSS_S_COMPLETE)||
                    (gmaj_stat == GSS_S_CONTINUE_NEEDED)) {
-                       lreply(code, "GSSAPI error minor: %s",
-                              (char*)msg.value);
+                       (*cb)((char*)msg.value, misc, 0);
                        (void) gss_release_buffer(&gmin_stat, &msg);
                }
                if (gmaj_stat != GSS_S_CONTINUE_NEEDED)
                        break;
        }
-       reply(code, "GSSAPI error: %s", s);
 }
 
 void