do it all with krb5

git-svn-id: svn://svn.1ts.org/debian/branches/zephyr-reloaded@391 cbed1d16-5ef5-0310-b6a1-d4a37b08ba1f

diff --git a/zephyr/configure b/zephyr/configure
index 90b740e03a668b551e83730f9cce892a2d8996b6..4466d3ba86fe48a54cfef7831f6636a8c87e430a 100755 (executable)
--- a/zephyr/configure
+++ b/zephyr/configure
@@ -1476,7 +1476,6 @@ Optional Packages:
                           both]
   --with-tags[=TAGS]      include additional configurations [automatic]
   --with-x                use the X Window System
-  --with-openssl=PREFIX      Use OpenSSL crypto
   --with-krb4=PREFIX      Use Kerberos 4
   --with-krb5=PREFIX      Use Kerberos 5
   --with-hesiod=PREFIX    Use Hesiod
@@ -4142,7 +4141,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 4145 "configure"' > conftest.$ac_ext
+  echo '#line 4144 "configure"' > conftest.$ac_ext
   if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -6708,11 +6707,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:6711: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:6710: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:6715: \$? = $ac_status" >&5
+   echo "$as_me:6714: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings
@@ -6941,11 +6940,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:6944: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:6943: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:6948: \$? = $ac_status" >&5
+   echo "$as_me:6947: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings
@@ -7001,11 +7000,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7004: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7003: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:7008: \$? = $ac_status" >&5
+   echo "$as_me:7007: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -8331,7 +8330,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 8334 "configure"' > conftest.$ac_ext
+    echo '#line 8333 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9169,7 +9168,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9172 "configure"
+#line 9171 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -9267,7 +9266,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9270 "configure"
+#line 9269 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -11446,11 +11445,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11449: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11448: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:11453: \$? = $ac_status" >&5
+   echo "$as_me:11452: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings
@@ -11506,11 +11505,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11509: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11508: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:11513: \$? = $ac_status" >&5
+   echo "$as_me:11512: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -12017,7 +12016,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 12020 "configure"' > conftest.$ac_ext
+    echo '#line 12019 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -12855,7 +12854,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 12858 "configure"
+#line 12857 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12953,7 +12952,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 12956 "configure"
+#line 12955 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -13780,11 +13779,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13783: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13782: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:13787: \$? = $ac_status" >&5
+   echo "$as_me:13786: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings
@@ -13840,11 +13839,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13843: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13842: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:13847: \$? = $ac_status" >&5
+   echo "$as_me:13846: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -15150,7 +15149,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 15153 "configure"' > conftest.$ac_ext
+    echo '#line 15152 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -15894,11 +15893,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:15897: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:15896: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:15901: \$? = $ac_status" >&5
+   echo "$as_me:15900: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings
@@ -16127,11 +16126,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16130: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16129: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:16134: \$? = $ac_status" >&5
+   echo "$as_me:16133: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings
@@ -16187,11 +16186,11 @@ else
    -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16190: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16189: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:16194: \$? = $ac_status" >&5
+   echo "$as_me:16193: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -17517,7 +17516,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 17520 "configure"' > conftest.$ac_ext
+    echo '#line 17519 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -18355,7 +18354,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 18358 "configure"
+#line 18357 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -18453,7 +18452,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 18456 "configure"
+#line 18455 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -23476,90 +23475,6 @@ fi
 
 
 
-# Check whether --with-openssl was given.
-if test "${with_openssl+set}" = set; then
-  withval=$with_openssl; openssl="$withval"
-else
-  openssl=no
-fi
-
-if test "$openssl" != no; then
-   { echo "$as_me:$LINENO: checking for DES_ecb_encrypt in -lcrypto" >&5
-echo $ECHO_N "checking for DES_ecb_encrypt in -lcrypto... $ECHO_C" >&6; }
-if test "${ac_cv_lib_crypto_DES_ecb_encrypt+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lcrypto  $LIBS"
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char DES_ecb_encrypt ();
-int
-main ()
-{
-return DES_ecb_encrypt ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (ac_try="$ac_link"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_link") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-        test -z "$ac_c_werror_flag" ||
-        test ! -s conftest.err
-       } && test -s conftest$ac_exeext &&
-       $as_test_x conftest$ac_exeext; then
-  ac_cv_lib_crypto_DES_ecb_encrypt=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-       ac_cv_lib_crypto_DES_ecb_encrypt=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
-      conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ echo "$as_me:$LINENO: result: $ac_cv_lib_crypto_DES_ecb_encrypt" >&5
-echo "${ECHO_T}$ac_cv_lib_crypto_DES_ecb_encrypt" >&6; }
-if test $ac_cv_lib_crypto_DES_ecb_encrypt = yes; then
-  OPENSSL_LIBS=-lcrypto
-               cat >>confdefs.h <<\_ACEOF
-#define HAVE_OPENSSL 1
-_ACEOF
-
-else
-  { { echo "$as_me:$LINENO: error: Openssl requested but not found" >&5
-echo "$as_me: error: Openssl requested but not found" >&2;}
-   { (exit 1); exit 1; }; }
-fi
-
-fi
-
-
 # Check whether --with-krb4 was given.
 if test "${with_krb4+set}" = set; then
   withval=$with_krb4; krb4="$withval"
@@ -25409,7 +25324,7 @@ else
 echo "$as_me: error: This package requires ss." >&2;}
    { (exit 1); exit 1; }; }
 fi
-LIBS="$OPENSSL_LIBS $KRB5_LIBS $KRB4_LIBS $HESIOD_LIBS $LIBS"
+LIBS="$KRB5_LIBS $KRB4_LIBS $HESIOD_LIBS $LIBS"
 
 if test $ac_cv_c_compiler_gnu = yes; then
     { echo "$as_me:$LINENO: checking whether $CC needs -traditional" >&5

diff --git a/zephyr/configure.in b/zephyr/configure.in
index d24a891395c9794bd09834d8718b60cee0423c83..57b97df9b28728e35102a138df0cdbdefa9d88ec 100644 (file)
--- a/zephyr/configure.in
+++ b/zephyr/configure.in
@@ -84,15 +84,6 @@ AC_SUBST(TLIB)
 AC_SUBST(RLIB)
 AC_SUBST(SLIB)
 
-AC_ARG_WITH(openssl,
-       [  --with-openssl=PREFIX      Use OpenSSL crypto],
-       [openssl="$withval"], [openssl=no])
-if test "$openssl" != no; then
-   AC_CHECK_LIB(crypto, DES_ecb_encrypt, [OPENSSL_LIBS=-lcrypto
-               AC_DEFINE(HAVE_OPENSSL)],
-               [AC_MSG_ERROR(Openssl requested but not found)])
-fi
-
 ATHENA_KRB4
 ATHENA_KRB5
 ATHENA_HESIOD
@@ -100,7 +91,7 @@ ATHENA_REGEXP
 ATHENA_ARES
 ATHENA_UTIL_COM_ERR
 ATHENA_UTIL_SS
-LIBS="$OPENSSL_LIBS $KRB5_LIBS $KRB4_LIBS $HESIOD_LIBS $LIBS"
+LIBS="$KRB5_LIBS $KRB4_LIBS $HESIOD_LIBS $LIBS"
 
 dnl Checks for library functions.
 AC_PROG_GCC_TRADITIONAL

diff --git a/zephyr/h/config.h.in b/zephyr/h/config.h.in
index 688870f1387242cfeb023afa22da810f04026da0..40c0a3e4ebd8c05a70c118bb2ea1b7d149f3438f 100644 (file)
--- a/zephyr/h/config.h.in
+++ b/zephyr/h/config.h.in
@@ -273,6 +273,3 @@
 
 /* Define to `int' if <sys/types.h> doesn't define. */
 #undef uid_t
-
-/* Wether we have the openssl library about */
-#undef HAVE_OPENSSL

diff --git a/zephyr/server/bdump.c b/zephyr/server/bdump.c
index 39b4cd8ec27a20475a407a338197fea19a5c80f9..50bfaeaf0e8b5f33e7fc7ba19ed9212ca7ba533c 100644 (file)
--- a/zephyr/server/bdump.c
+++ b/zephyr/server/bdump.c
@@ -102,6 +102,9 @@ static int setup_file_pointers(void);
 static void shutdown_file_pointers(void);
 static void cleanup(Server *server);
 
+#if defined(HAVE_KRB4) || defined(HAVE_KRB5)
+static int des_service_decrypt(char *in, char *out);
+#endif
 #ifdef HAVE_KRB5
 static long ticket5_time;
 #define TKT5LIFETIME 8*60*60
@@ -116,10 +119,13 @@ static long ticket_time;
 
 #endif /* HAVE_KRB4 */
 
-#if defined(HAVE_KRB4) || defined(HAVE_OPENSSL)
+#if defined(HAVE_KRB4)
 extern C_Block serv_key;
 extern Sched   serv_ksched;
 #endif
+#if defined(HAVE_KRB5) && !defined(HAVE_KRB4)
+krb5_keyblock  *server_key;
+#endif
 
 static Timer *bdump_timer;
 static int live_socket = -1;
@@ -1081,7 +1087,7 @@ get_tgt(void)
                                             0,
                                             NULL,
                                             &opt);
-#if defined(HAVE_OPENSSL) && !defined(HAVE_KRB4)
+#ifndef HAVE_KRB4
        if (retval) {
            krb5_free_principal(Z_krb5_ctx, principal);
            krb5_kt_close(Z_krb5_ctx, kt);
@@ -1095,21 +1101,19 @@ get_tgt(void)
                break;
        }
        if (!retval) {
-           retval = krb5_copy_keyblock(Z_krb5_ctx, &kt_ent.key, &serv_key);
+           retval = krb5_copy_keyblock(Z_krb5_ctx, &kt_ent.key, &server_key);
            if (retval) {
                krb5_free_principal(Z_krb5_ctx, principal);
                krb5_kt_close(Z_krb5_ctx, kt);
                return(1);
            }
        
-           des_key_sched(serv_key, serv_ksched.s);
-
            got_des = 1;
        }
 #endif
        krb5_free_principal(Z_krb5_ctx, principal);
        krb5_kt_close(Z_krb5_ctx, kt);
-#if defined(HAVE_OPENSSL) && !defined(HAVE_KRB4)
+#ifndef HAVE_KRB4
        if (retval) return(1);
 #endif
 
@@ -1168,7 +1172,11 @@ bdump_recv_loop(Server *server)
 #endif
 #if defined(HAVE_KRB4) || defined(HAVE_KRB5)    
     char *cp;
+#ifndef HAVE_KRB4
+    unsigned char cblock[8];
+#else
     C_Block cblock;
+#endif
 #endif
     ZRealm *realm = NULL;
  
@@ -1268,32 +1276,31 @@ bdump_recv_loop(Server *server)
            if (*notice.z_class_inst) {
                /* check out this session key I found */
                cp = notice.z_message + strlen(notice.z_message) + 1;
-               switch (*cp) {
-#if defined(HAVE_KRB4) || defined(HAVE_OPENSSL)
-                   if (got_des) {
-                       /* ****ing netascii; this is an encrypted DES keyblock
-                          XXX this code should be conditionalized for server
-                          transitions   */
-                       retval = Z_krb5_init_keyblock(Z_krb5_ctx, ENCTYPE_DES_CBC_CRC,
-                                                     sizeof(C_Block),
-                                                     &client->session_keyblock);
+               if (*cp == '0' && got_des) {
+                   /* ****ing netascii; this is an encrypted DES keyblock
+                      XXX this code should be conditionalized for server
+                      transitions   */
+                   retval = Z_krb5_init_keyblock(Z_krb5_ctx, ENCTYPE_DES_CBC_CRC,
+                                                 sizeof(cblock),
+                                                 &client->session_keyblock);
+                   if (retval) {
+                       syslog(LOG_ERR, "brl failed to allocate DES keyblock: %s",
+                              error_message(retval));
+                       return retval;
+                   }
+                   retval = ZReadAscii(cp, strlen(cp), cblock, sizeof(cblock));
+                   if (retval != ZERR_NONE) {
+                       syslog(LOG_ERR,"brl bad cblk read: %s (%s)",
+                              error_message(retval), cp);
+                   } else {
+                       retval = des_service_decrypt(cblock, Z_keydata(client->session_keyblock));
                        if (retval) {
-                           syslog(LOG_ERR, "brl failed to allocate DES keyblock: %s",
+                           syslog(LOG_ERR, "brl failed to decyrpt DES session key: %s",
                                   error_message(retval));
                            return retval;
                        }
-                       retval = ZReadAscii(cp, strlen(cp), cblock, sizeof(C_Block));
-                       if (retval != ZERR_NONE) {
-                           syslog(LOG_ERR,"brl bad cblk read: %s (%s)",
-                              error_message(retval), cp);
-                       } else {
-                           des_ecb_encrypt((C_Block *)cblock, (C_Block *)Z_keydata(client->session_keyblock),
-                                           serv_ksched.s, DES_DECRYPT);
-                       }
                    }
-                   break;
-#endif
-               case 'Z':
+               } else if (*cp == 'Z') {
                    /* Zcode! Long live the new flesh! */
                    retval = ZReadZcode((unsigned char *)cp, buf, sizeof(buf), &blen);
                    if (retval != ZERR_NONE) {
@@ -1312,7 +1319,6 @@ bdump_recv_loop(Server *server)
                        memcpy(Z_keydata(client->session_keyblock), &buf[8],
                               Z_keylen(client->session_keyblock));
                    }
-                   break;
                }
            }
 #else
@@ -1659,3 +1665,24 @@ setup_file_pointers (void)
 
     return 0;
 }
+
+#ifdef HAVE_KRB5
+static int des_service_decrypt(char *in, char *out) {
+#ifndef HAVE_KRB4
+    krb5_data dout;
+    krb5_enc_data din;
+
+    dout.length = 8;
+    dout.data = out;
+
+    din.ciphertext.length = 8;
+    din.ciphertext.data = in;
+    din.enctype = Z_enctype(server_key);
+
+    return krb5_c_decrypt(Z_krb5_ctx, server_key, 0, 0, &din, &dout);
+#else
+    des_ecb_encrypt((C_Block *)in, (C_Block *)out, serv_ksched.s, DES_DECRYPT);
+    return 0; /* sigh */
+#endif
+}
+#endif

diff --git a/zephyr/server/subscr.c b/zephyr/server/subscr.c
index 8515644a4f9b08cb1bea3618dc9f628df17d0e8e..63b71095b1cf92a1ae760791246ebfd1fb084d67 100644 (file)
--- a/zephyr/server/subscr.c
+++ b/zephyr/server/subscr.c
@@ -61,7 +61,7 @@ static const char rcsid_subscr_c[] = "$Id$";
  *
  */
 
-#if defined(HAVE_KRB4) || defined(HAVE_OPENSSL)
+#if defined(HAVE_KRB4)
 C_Block        serv_key;
 Sched  serv_ksched;
 #endif

diff --git a/zephyr/server/zserver.h b/zephyr/server/zserver.h
index 54a56e66b2b9e7fc51e7f7b9f1d80165bd420b36..078a8a7df30c56f1c8a6e2072f12e081f19ab2b5 100644 (file)
--- a/zephyr/server/zserver.h
+++ b/zephyr/server/zserver.h
@@ -61,12 +61,7 @@ extern C_Block __Zephyr_session;
 /* Current time as cached by main(); use instead of time(). */
 #define NOW t_local.tv_sec
 
-#if defined(HAVE_OPENSSL) & !defined(HAVE_KRB4)
-#define OPENSSL_DES_LIBDES_COMPATIBILITY
-#include <openssl/des.h>
-#endif
-
-#if defined(HAVE_KRB4) || defined(HAVE_OPENSSL)
+#ifdef HAVE_KRB4
 /* Kerberos shouldn't stick us with array types... */
 typedef struct {
     des_key_schedule s;