Apply patch from Ian.Baker@cern.ch:

Optional GSS-API Functionality.

This patch implements mutual authentication, out of sequence and
replay detection using the GSS-API.  The changes implemented are
optional and are turned off by default.

This option is specified to the client through an environment variable
as is the name of the server principal to authenticate.  Currently
the server principal can be left unspecified and a default based on
the host keytab will be used.

This option is specified to the daemon through a command line option,
with the name of the principal whose credentials the daemon should
use specified as an environment variable.  A simple handshake is
exchanged between the client and server in order to prevent
unecessary delays and protocol derailments when mixing authenticating
and non-authenticating clients and servers.

Revised based on review comments.
GSS-API authentication is now implemented as a per host option.

Revised further by me (Fergus Henderson) to fix a spelling error
and to rename the per host option from ",gssapi" to ",auth".

1 files changed, 9 insertions, 0 deletions

diff --git a/src/hosts.c b/src/hosts.c
index 71bce88..2ca00d0 100644
--- a/src/hosts.c
+++ b/src/hosts.c
@@ -241,6 +241,9 @@ static int dcc_parse_options(const char **psrc,
 
     host->compr = DCC_COMPRESS_NONE;
     host->cpp_where = DCC_CPP_ON_CLIENT;
+#ifdef HAVE_GSSAPI
+    host->authenticate = 0;
+#endif
 
     while (p[0] == ',') {
         p++;
@@ -256,6 +259,12 @@ static int dcc_parse_options(const char **psrc,
             rs_trace("got CPP option");
             host->cpp_where = DCC_CPP_ON_SERVER;
             p += 3;
+#ifdef HAVE_GSSAPI
+        } else if (str_startswith("auth", p)) {
+            rs_trace("got GSSAPI option");
+            host->authenticate = 1;
+            p += 4;
+#endif
         } else {
             rs_log_error("unrecognized option in host specification: %s",
                          started);