Re: Detect when KRB5CCNAME changes for certain server scenarios

[Michael B Allen <mba2000@ioplex.com>]

On Fri, 9 Feb 2007 17:52:58 -0500
Michael B Allen <mba2000@ioplex.com> wrote:

>   2) Because of 1, no mutex is necessary becasue the above function is
>   already protected by the GSSAPI mutex provided that the context is
>   in fact the static gssapi_krb5_context.

Actually it appears I'm wrong about this. It's not protected by the
GSSAPI mutex. Also it occurs to me that someone might want to call the
krb5_cc_* function directly even if they're using GSSAPI (I do). Therefore
I like your current patch.

However, there is one problem with the code:

+    if (s && s != cc_env) {
+	update = 1;
+	goto out;
+    }
+    if (cc_uid != (unsigned)getuid()) {
+	update = 1;
+	goto out;
+    }
+out:
+    if (update) {
+	cc_env = s;

Even if s == cc_env, that does not ensure that the string it points to
has not changed.

Meaning, it is possible that getenv could return the same address with
different content (I have actually managed to produce this error in my
test environment).

You must compare the current name and getenv directly like:

  if (context->default_cc_name == NULL ||
              s != cc_env ||
              (s && strcmp(context->default_cc_name, s) != 0) {
      update = 1;
      ...

Mike

-- 
Michael B Allen
PHP Active Directory SSO
http://www.ioplex.com/