fail gss userauth if we received a limited globus proxy

[gssapi-openssh.git] / openssh / monitor_wrap.c

diff --git a/openssh/monitor_wrap.c b/openssh/monitor_wrap.c
index 3137b4840c9704580b1c251846a7f4143937a97a..396ec3266d11ffab8607b496ee875471f9d3c5e4 100644 (file)
--- a/openssh/monitor_wrap.c
+++ b/openssh/monitor_wrap.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor_wrap.c,v 1.31 2003/08/28 12:54:34 markus Exp $");
+RCSID("$OpenBSD: monitor_wrap.c,v 1.35 2003/11/17 11:06:07 markus Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/dh.h>
@@ -40,7 +40,13 @@ RCSID("$OpenBSD: monitor_wrap.c,v 1.31 2003/08/28 12:54:34 markus Exp $");
 #include "packet.h"
 #include "mac.h"
 #include "log.h"
+#ifdef TARGET_OS_MAC    /* XXX Broken krb5 headers on Mac */
+#undef TARGET_OS_MAC
 #include "zlib.h"
+#define TARGET_OS_MAC 1
+#else
+#include "zlib.h"
+#endif
 #include "monitor.h"
 #include "monitor_wrap.h"
 #include "xmalloc.h"
@@ -66,6 +72,16 @@ extern struct monitor *pmonitor;
 extern Buffer input, output;
 extern ServerOptions options;
 
+int
+mm_is_monitor(void)
+{
+       /*
+        * m_pid is only set in the privileged part, and
+        * points to the unprivileged child.
+        */
+       return (pmonitor && pmonitor->m_pid > 0);
+}
+
 void
 mm_request_send(int socket, enum monitor_reqtype type, Buffer *m)
 {
@@ -94,7 +110,7 @@ mm_request_receive(int socket, Buffer *m)
        res = atomicio(read, socket, buf, sizeof(buf));
        if (res != sizeof(buf)) {
                if (res == 0)
-                       fatal_cleanup();
+                       cleanup_exit(255);
                fatal("%s: read: %ld", __func__, (long)res);
        }
        msg_len = GET_32BIT(buf);
@@ -214,7 +230,8 @@ mm_getpwnamallow(const char *login)
        return (pw);
 }
 
-char *mm_auth2_read_banner(void)
+char *
+mm_auth2_read_banner(void)
 {
        Buffer m;
        char *banner;
@@ -225,10 +242,16 @@ char *mm_auth2_read_banner(void)
        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, &m);
        buffer_clear(&m);
 
-       mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTH2_READ_BANNER, &m);
+       mm_request_receive_expect(pmonitor->m_recvfd,
+           MONITOR_ANS_AUTH2_READ_BANNER, &m);
        banner = buffer_get_string(&m, NULL);
        buffer_free(&m);
 
+       /* treat empty banner as missing banner */
+       if (strlen(banner) == 0) {
+               xfree(banner);
+               banner = NULL;
+       }
        return (banner);
 }
 
@@ -648,9 +671,8 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
 }
 
 void
-mm_session_pty_cleanup2(void *session)
+mm_session_pty_cleanup2(Session *s)
 {
-       Session *s = session;
        Buffer m;
 
        if (s->ttyfd == -1)
@@ -670,7 +692,7 @@ mm_session_pty_cleanup2(void *session)
 
 #ifdef USE_PAM
 void
-mm_start_pam(char *user)
+mm_start_pam(Authctxt *authctxt)
 {
        Buffer m;
 
@@ -679,8 +701,6 @@ mm_start_pam(char *user)
                fatal("UsePAM=no, but ended up in %s anyway", __func__);
 
        buffer_init(&m);
-       buffer_put_cstring(&m, user);
-
        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, &m);
 
        buffer_free(&m);
@@ -699,12 +719,12 @@ mm_do_pam_account(void)
        buffer_init(&m);
        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_ACCOUNT, &m);
 
-       mm_request_receive_expect(pmonitor->m_recvfd, 
+       mm_request_receive_expect(pmonitor->m_recvfd,
            MONITOR_ANS_PAM_ACCOUNT, &m);
        ret = buffer_get_int(&m);
 
        buffer_free(&m);
-       
+
        debug3("%s returning %d", __func__, ret);
 
        return (ret);
@@ -1118,6 +1138,25 @@ mm_ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *in,
        return (major);
 }
 
+OM_uint32
+mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+{
+       Buffer m;
+       OM_uint32 major;
+
+       buffer_init(&m);
+       buffer_put_string(&m, gssbuf->value, gssbuf->length);
+       buffer_put_string(&m, gssmic->value, gssmic->length);
+
+       mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSCHECKMIC, &m);
+       mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSCHECKMIC,
+           &m);
+
+       major = buffer_get_int(&m);
+       buffer_free(&m);
+       return(major);
+}
+
 int
 mm_ssh_gssapi_userok(char *user)
 {
@@ -1141,6 +1180,7 @@ OM_uint32
 mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash) {
         Buffer m;
         OM_uint32 major;
+       u_int len;
 
         buffer_init(&m);
         buffer_put_string(&m, data->value, data->length);
@@ -1149,7 +1189,8 @@ mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash) {
         mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);
 
         major=buffer_get_int(&m);
-        hash->value = buffer_get_string(&m, &hash->length);
+        hash->value = buffer_get_string(&m, &len);
+       hash->length = len;
 
        buffer_free(&m);