Skip to content

Commit 3575542

Browse files
stnoonanstnoonan
authored
Merge pull request #139 from oxpa/master
Three minor fixes
2 parents bd4e8c3 + d902d29 commit 3575542

File tree

1 file changed

+59
-29
lines changed

1 file changed

+59
-29
lines changed

‎ngx_http_auth_spnego_module.c‎

Lines changed: 59 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ typedef struct {
130130
ngx_str_t keytab;
131131
ngx_str_t service_ccache;
132132
ngx_str_t srvcname;
133+
ngx_str_t shm_zone_name;
133134
ngx_flag_t fqun;
134135
ngx_flag_t force_realm;
135136
ngx_flag_t allow_basic;
@@ -152,6 +153,10 @@ static ngx_command_t ngx_http_auth_spnego_commands[] = {
152153
NGX_HTTP_LOC_CONF_OFFSET,
153154
offsetof(ngx_http_auth_spnego_loc_conf_t, protect), NULL},
154155

156+
{ngx_string("auth_gss_zone_name"), NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
157+
ngx_conf_set_str_slot, NGX_HTTP_LOC_CONF_OFFSET,
158+
offsetof(ngx_http_auth_spnego_loc_conf_t, shm_zone_name), NULL},
159+
155160
{ngx_string("auth_gss_realm"), SPNEGO_NGX_CONF_FLAGS, ngx_conf_set_str_slot,
156161
NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_auth_spnego_loc_conf_t, realm),
157162
NULL},
@@ -308,13 +313,48 @@ static void *ngx_http_auth_spnego_create_loc_conf(ngx_conf_t *cf) {
308313
return conf;
309314
}
310315

316+
static ngx_int_t ngx_http_auth_spnego_init_shm_zone(ngx_shm_zone_t *shm_zone,
317+
void *data) {
318+
if (data) {
319+
shm_zone->data = data;
320+
return NGX_OK;
321+
}
322+
323+
shm_zone->data = shm_zone->shm.addr;
324+
return NGX_OK;
325+
}
326+
327+
static ngx_int_t ngx_http_auth_spnego_create_shm_zone(ngx_conf_t *cf,
328+
ngx_str_t *name) {
329+
if (shm_zone != NULL) return NGX_OK;
330+
331+
shm_zone =
332+
ngx_shared_memory_add(cf, name, 65536, &ngx_http_auth_spnego_module);
333+
if (shm_zone == NULL) {
334+
return NGX_ERROR;
335+
}
336+
337+
shm_zone->init = ngx_http_auth_spnego_init_shm_zone;
338+
339+
return NGX_OK;
340+
}
341+
311342
static char *ngx_http_auth_spnego_merge_loc_conf(ngx_conf_t *cf, void *parent,
312343
void *child) {
313344
ngx_http_auth_spnego_loc_conf_t *prev = parent;
314345
ngx_http_auth_spnego_loc_conf_t *conf = child;
315346

316347
/* "off" by default */
317348
ngx_conf_merge_off_value(conf->protect, prev->protect, 0);
349+
ngx_conf_merge_str_value(conf->shm_zone_name, prev->shm_zone_name, SHM_ZONE_NAME);
350+
351+
if (conf->protect != 0) {
352+
if (ngx_http_auth_spnego_create_shm_zone(cf, &conf->shm_zone_name) != NGX_OK) {
353+
ngx_conf_log_error(NGX_LOG_INFO, cf, 0,
354+
"auth_spnego: failed to create shared memory zone");
355+
return NGX_CONF_ERROR;
356+
}
357+
}
318358

319359
ngx_conf_merge_str_value(conf->realm, prev->realm, "");
320360
ngx_conf_merge_str_value(conf->keytab, prev->keytab, "/etc/krb5.keytab");
@@ -440,30 +480,6 @@ static ngx_int_t ngx_http_auth_spnego_add_variable(ngx_conf_t *cf,
440480
return NGX_OK;
441481
}
442482

443-
static ngx_int_t ngx_http_auth_spnego_init_shm_zone(ngx_shm_zone_t *shm_zone,
444-
void *data) {
445-
if (data) {
446-
shm_zone->data = data;
447-
return NGX_OK;
448-
}
449-
450-
shm_zone->data = shm_zone->shm.addr;
451-
return NGX_OK;
452-
}
453-
454-
static ngx_int_t ngx_http_auth_spnego_create_shm_zone(ngx_conf_t *cf) {
455-
ngx_str_t name = ngx_string(SHM_ZONE_NAME);
456-
457-
shm_zone =
458-
ngx_shared_memory_add(cf, &name, 65536, &ngx_http_auth_spnego_module);
459-
if (shm_zone == NULL) {
460-
return NGX_ERROR;
461-
}
462-
463-
shm_zone->init = ngx_http_auth_spnego_init_shm_zone;
464-
465-
return NGX_OK;
466-
}
467483

468484
static ngx_int_t ngx_http_auth_spnego_init(ngx_conf_t *cf) {
469485
ngx_http_handler_pt *h;
@@ -478,10 +494,6 @@ static ngx_int_t ngx_http_auth_spnego_init(ngx_conf_t *cf) {
478494

479495
*h = ngx_http_auth_spnego_handler;
480496

481-
if (ngx_http_auth_spnego_create_shm_zone(cf) != NGX_OK) {
482-
return NGX_ERROR;
483-
}
484-
485497
ngx_str_t var_name = ngx_string(CCACHE_VARIABLE_NAME);
486498
if (ngx_http_auth_spnego_add_variable(cf, &var_name) != NGX_OK) {
487499
return NGX_ERROR;
@@ -507,6 +519,9 @@ ngx_http_auth_spnego_headers_basic_only(ngx_http_request_t *r,
507519
}
508520

509521
r->headers_out.www_authenticate->hash = 1;
522+
#if defined(nginx_version) && nginx_version >= 1023000
523+
r->headers_out.www_authenticate->next = NULL;
524+
#endif
510525
r->headers_out.www_authenticate->key.len = sizeof("WWW-Authenticate") - 1;
511526
r->headers_out.www_authenticate->key.data = (u_char *)"WWW-Authenticate";
512527
r->headers_out.www_authenticate->value.len = value.len;
@@ -543,6 +558,9 @@ ngx_http_auth_spnego_headers(ngx_http_request_t *r,
543558
}
544559

545560
r->headers_out.www_authenticate->hash = 1;
561+
#if defined(nginx_version) && nginx_version >= 1023000
562+
r->headers_out.www_authenticate->next = NULL;
563+
#endif
546564
r->headers_out.www_authenticate->key.len = sizeof("WWW-Authenticate") - 1;
547565
r->headers_out.www_authenticate->key.data = (u_char *)"WWW-Authenticate";
548566
r->headers_out.www_authenticate->value.len = value.len;
@@ -564,6 +582,9 @@ ngx_http_auth_spnego_headers(ngx_http_request_t *r,
564582
}
565583

566584
r->headers_out.www_authenticate->hash = 2;
585+
#if defined(nginx_version) && nginx_version >= 1023000
586+
r->headers_out.www_authenticate->next = NULL;
587+
#endif
567588
r->headers_out.www_authenticate->key.len =
568589
sizeof("WWW-Authenticate") - 1;
569590
r->headers_out.www_authenticate->key.data =
@@ -756,7 +777,7 @@ static ngx_int_t
756777
ngx_http_auth_spnego_store_delegated_creds(ngx_http_request_t *r,
757778
ngx_str_t *principal_name,
758779
creds_info delegated_creds) {
759-
krb5_context kcontext;
780+
krb5_context kcontext = NULL;
760781
krb5_principal principal = NULL;
761782
krb5_ccache ccache = NULL;
762783
krb5_error_code kerr = 0;
@@ -1260,6 +1281,10 @@ static ngx_int_t ngx_http_auth_spnego_obtain_server_credentials(
12601281
krb5_principal principal = NULL;
12611282
krb5_get_init_creds_opt gicopts;
12621283
krb5_creds creds;
1284+
#ifdef HEIMDAL_DEPRECATED
1285+
// only used to call krb5_get_init_creds_opt_alloc() in newer heimdal
1286+
krb5_get_init_creds_opt *gicopts_l;
1287+
#endif
12631288

12641289
char *principal_name = NULL;
12651290
char *tgs_principal_name = NULL;
@@ -1342,7 +1367,12 @@ static ngx_int_t ngx_http_auth_spnego_obtain_server_credentials(
13421367

13431368
spnego_debug1("Obtaining new credentials for %s", principal_name);
13441369

1370+
#ifndef HEIMDAL_DEPRECATED
13451371
krb5_get_init_creds_opt_init(&gicopts);
1372+
#else
1373+
gicopts_l = &gicopts;
1374+
krb5_get_init_creds_opt_alloc(kcontext, &gicopts_l);
1375+
#endif
13461376
krb5_get_init_creds_opt_set_forwardable(&gicopts, 1);
13471377

13481378
size_t tgs_principal_name_size =

0 commit comments

Comments
 (0)