STABLE14-pts-encrypt-option-20090512

LICENSE IPL10
FIXES 124681

add -encrypt flag to pts generic options, allowing the wire to be
encrypted if desired and the user's authenticated. document same.

(cherry picked from commit 6ba44802ea6cf722c22a4784cbbad70ed6f5d60a)

diff --git a/doc/man-pages/pod1/pts.pod b/doc/man-pages/pod1/pts.pod
index 913a9ff18f9131aec907fbfcd11f199100467a9d..a3da5727031deea073eadad1af39e063467fb935 100644 (file)
--- a/doc/man-pages/pod1/pts.pod
+++ b/doc/man-pages/pod1/pts.pod
@@ -129,6 +129,12 @@ privileged users to issue commands that change the Protection Database,
 and refuses to perform such an action even if the B<-noauth> flag is
 provided.
 
+=item B<-encrypt>
+
+Establishes an authenticated, encrypted connection to the Protection Server.
+It is useful when it is desired to obscure network traffic related to the
+transactions being done.
+
 =item B<-localauth>
 
 Constructs a server ticket using the server encryption key with the

diff --git a/src/ptserver/pts.c b/src/ptserver/pts.c
index 7b90a926521832712726c2734ca7c2653bf23c1a..1a329c18c741104e725e225c1922622add5b2fdc 100644 (file)
--- a/src/ptserver/pts.c
+++ b/src/ptserver/pts.c
@@ -176,6 +176,10 @@ GetGlobals(struct cmd_syndesc *as, void *arock)
        changed = 1;
        sec = 1;
     }
+    if (as->parms[22].items) { /* -encrypt */
+       changed = 1;
+       sec = 3;
+    }
     if (as->parms[18].items || as->parms[20].items) {  /* -test, -localauth */
        changed = 1;
        confdir = AFSDIR_SERVER_ETC_DIRPATH;
@@ -1022,6 +1026,8 @@ add_std_args(register struct cmd_syndesc *ts)
                "use local authentication");
     cmd_AddParm(ts, "-auth", CMD_FLAG, CMD_OPTIONAL,
                "use user's authentication (default)");
+    cmd_AddParm(ts, "-encrypt", CMD_FLAG, CMD_OPTIONAL,
+               "encrypt commands");
 }
 
 /*

diff --git a/src/ptserver/ptuser.c b/src/ptserver/ptuser.c
index fcd9d695ffe363a7debdc55d741137c6aa27406c..a5f7d16b0de005eabe792ac013aade52950bc5e5 100644 (file)
--- a/src/ptserver/ptuser.c
+++ b/src/ptserver/ptuser.c
@@ -203,6 +203,8 @@ pr_Initialize(IN afs_int32 secLevel, IN char *confDir, IN char *cell)
        code = ktc_GetToken(&sname, &ttoken, sizeof(ttoken), NULL);
        if (code) {
            afs_com_err(whoami, code, "(getting token)");
+           if (secLevel > 1)
+               return code;
            scIndex = 0;
        } else {
            if (ttoken.kvno >= 0 && ttoken.kvno <= 256)
@@ -215,7 +217,8 @@ pr_Initialize(IN afs_int32 secLevel, IN char *confDir, IN char *cell)
                scIndex = 2;
            }
            sc[2] =
-               rxkad_NewClientSecurityObject(rxkad_clear, &ttoken.sessionKey,
+               rxkad_NewClientSecurityObject((secLevel > 1) ? rxkad_crypt :
+                                             rxkad_clear, &ttoken.sessionKey,
                                              ttoken.kvno, ttoken.ticketLen,
                                              ttoken.ticket);
        }