From d85ece0977e043154b7d8f5aef5f4cd972771e8e Mon Sep 17 00:00:00 2001
From: Michael Meffie <mmeffie@sinenomine.net>
Date: Tue, 28 Feb 2012 09:19:11 -0500
Subject: [PATCH] auth: remove static local realms

Remove the static list of local realms and use the auth
interface to perform the local realm match check.

Change-Id: I0f56e7974e59035eb9bf9fb343b550ab6b7ef314
Reviewed-on: http://gerrit.openafs.org/6876
Reviewed-by: Derrick Brashear <shadow@dementix.org>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
---
 src/auth/userok.c | 53 ++++++-----------------------------------------------
 1 file changed, 6 insertions(+), 47 deletions(-)

diff --git a/src/auth/userok.c b/src/auth/userok.c
index 1e6f856..29178c3 100644
--- a/src/auth/userok.c
+++ b/src/auth/userok.c
@@ -591,10 +591,8 @@ kerberosSuperUser(struct afsconf_dir *adir, char *tname, char *tinst,
 {
     char tcell_l[MAXKTCREALMLEN] = "";
     char *tmp;
-    static char lcell[MAXCELLCHARS] = "";
-    static char lrealms[AFS_NUM_LREALMS][AFS_REALM_SZ];
-    static int  num_lrealms = -1;
-    int lrealm_match = 0, i;
+    int code;
+    afs_int32 islocal;
     int flag;
 
     /* generate lowercased version of cell name */
@@ -607,48 +605,9 @@ kerberosSuperUser(struct afsconf_dir *adir, char *tname, char *tinst,
 	}
     }
 
-    /* determine local cell name. It's static, so will only get
-     * calculated the first time through */
-    if (!lcell[0])
-	afsconf_GetLocalCell(adir, lcell, sizeof(lcell));
-
-    /* if running a krb environment, also get the local realm */
-    /* note - this assumes AFS_REALM_SZ <= MAXCELLCHARS */
-    /* just set it to lcell if it fails */
-    if (num_lrealms == -1) {
-	for (i=0; i<AFS_NUM_LREALMS; i++) {
-	    if (afs_krb_get_lrealm(lrealms[i], i) != 0 /*KSUCCESS*/)
-		break;
-	}
-
-	if (i == 0) {
-	    strncpy(lrealms[0], lcell, AFS_REALM_SZ);
-	    num_lrealms = 1;
-	} else {
-	    num_lrealms = i;
-	}
-    }
-
-    /* See if the ticket cell matches one of the local realms */
-    lrealm_match = 0;
-    for ( i=0;i<num_lrealms;i++ ) {
-	if (!strcasecmp(lrealms[i], tcell)) {
-	    lrealm_match = 1;
-	    break;
-	}
-    }
-
-    /* If yes, then make sure that the name is not present in
-     * an exclusion list */
-    if (lrealm_match) {
-	char uname[MAXKTCNAMELEN + MAXKTCNAMELEN + MAXKTCREALMLEN + 3];
-	if (tinst && tinst[0])
-	    snprintf(uname,sizeof(uname),"%s.%s@%s",tname,tinst,tcell);
-	else
-	    snprintf(uname,sizeof(uname),"%s@%s",tname,tcell);
-
-	if (afs_krb_exclusion(uname))
-	    lrealm_match = 0;
+    code = afsconf_IsLocalRealmMatch(adir, &islocal, tname, tinst, tcell);
+    if (code) {
+	return 0;
     }
 
     /* start with no authorization */
@@ -664,7 +623,7 @@ kerberosSuperUser(struct afsconf_dir *adir, char *tname, char *tinst,
 	flag = 1;
 
 	/* cell of connection matches local cell or one of the realms */
-    } else if (!strcasecmp(tcell, lcell) || lrealm_match) {
+    } else if (islocal) {
 	if (CompFindUser(adir, tname, ".", tinst, NULL, identity)) {
 	    flag = 1;
 	}
-- 
1.9.4