merging OPENSSH_5_2P1_SIMON_20090726_HPN13V6 to trunk:

[gssapi-openssh.git] / openssh / sshconnect2.c

diff --git a/openssh/sshconnect2.c b/openssh/sshconnect2.c
index 1ff0ff596c7c1473824ae8799629043cfa28ab1b..c7aadb4a9526c5433d685ee0b1c9c07d0e720c06 100644 (file)
--- a/openssh/sshconnect2.c
+++ b/openssh/sshconnect2.c
@@ -85,6 +85,16 @@ extern Kex *xxx_kex;
 
 extern int tty_flag;
 
+/* tty_flag is set in ssh.c. use this in ssh_userauth2 */
+/* if it is set then prevent the switch to the null cipher */
+
+extern int tty_flag;
+
+/* tty_flag is set in ssh.c. use this in ssh_userauth2 */
+/* if it is set then prevent the switch to the null cipher */
+
+extern int tty_flag;
+
 /*
  * SSH2 key exchange
  */
@@ -287,7 +297,10 @@ int        userauth_jpake(Authctxt *);
 void   userauth_jpake_cleanup(Authctxt *);
 
 #ifdef GSSAPI
+int    userauth_external(Authctxt *authctxt);
 int    userauth_gssapi(Authctxt *authctxt);
+int    userauth_gssapi_with_mic(Authctxt *authctxt);
+int    userauth_gssapi_without_mic(Authctxt *authctxt);
 void   input_gssapi_response(int type, u_int32_t, void *);
 void   input_gssapi_token(int type, u_int32_t, void *);
 void   input_gssapi_hash(int type, u_int32_t, void *);
@@ -311,6 +324,12 @@ Authmethod authmethods[] = {
 #ifdef GSSAPI
        {"gssapi-keyex",
                userauth_gsskeyex,
+               NULL,
+               &options.gss_authentication,
+               NULL},
+       {"external-keyx",
+               userauth_external,
+               NULL,
                &options.gss_authentication,
                NULL},
        {"gssapi-with-mic",
@@ -318,6 +337,11 @@ Authmethod authmethods[] = {
                NULL,
                &options.gss_authentication,
                NULL},
+       {"gssapi",
+               userauth_gssapi,
+               NULL,
+               &options.gss_authentication,
+               NULL},
 #endif
        {"hostbased",
                userauth_hostbased,
@@ -626,12 +650,17 @@ userauth_gssapi(Authctxt *authctxt)
        static u_int mech = 0;
        OM_uint32 min;
        int ok = 0;
-       const char *gss_host;
+       char *gss_host = NULL;
+
+       if (!options.gss_authentication) {
+               verbose("GSSAPI authentication disabled.");
+               return 0;
+       }
 
        if (options.gss_trust_dns)
-               gss_host = get_canonical_hostname(1);
+               gss_host = (char *)get_canonical_hostname(1);
        else
-               gss_host = authctxt->host;
+               gss_host = (char *)authctxt->host;
 
        /* Try one GSSAPI method at a time, rather than sending them all at
         * once. */
@@ -712,7 +741,8 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
 
        if (status == GSS_S_COMPLETE) {
                /* send either complete or MIC, depending on mechanism */
-               if (!(flags & GSS_C_INTEG_FLAG)) {
+               if (strcmp(authctxt->method->name,"gssapi")==0 ||
+                   (!(flags & GSS_C_INTEG_FLAG))) {
                        packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
                        packet_send();
                } else {
@@ -857,6 +887,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
        xfree(lang);
 }
 
+#ifdef GSI
+extern
+const gss_OID_desc * const              gss_mech_globus_gssapi_openssl;
+#define is_gsi_oid(oid) \
+  (oid->length == gss_mech_globus_gssapi_openssl->length && \
+   (memcmp(oid->elements, gss_mech_globus_gssapi_openssl->elements, \
+          oid->length) == 0))
+#endif
+
+int
+userauth_external(Authctxt *authctxt)
+{
+    static int attempt = 0;
+        
+    if (attempt++ >= 1)
+        return 0;
+                                
+       /* The client MUST NOT try this method if initial key exchange
+          was not performed using a GSSAPI-based key exchange
+          method. */
+       if (gss_kex_context == NULL) {
+               debug2("gsskex not performed, skipping external-keyx");
+               return 0;
+       }
+
+    debug2("userauth_external");
+    packet_start(SSH2_MSG_USERAUTH_REQUEST);
+#ifdef GSI
+    if (options.implicit && is_gsi_oid(gss_kex_context->oid)) {
+        packet_put_cstring("");
+       } else {
+#endif
+    packet_put_cstring(authctxt->server_user);
+#ifdef GSI
+       }
+#endif
+    packet_put_cstring(authctxt->service);
+    packet_put_cstring(authctxt->method->name);
+    packet_send();
+    packet_write_wait();
+    return 1;
+}                                                                                                
 int
 userauth_gsskeyex(Authctxt *authctxt)
 {
@@ -874,8 +946,16 @@ userauth_gsskeyex(Authctxt *authctxt)
                return (0);
        }
 
-       ssh_gssapi_buildmic(&b, authctxt->server_user, authctxt->service,
-           "gssapi-keyex");
+#ifdef GSI
+    if (options.implicit && is_gsi_oid(gss_kex_context->oid)) {
+        ssh_gssapi_buildmic(&b, "", authctxt->service, "gssapi-keyex");
+       } else {
+#endif
+        ssh_gssapi_buildmic(&b, authctxt->server_user, authctxt->service,
+                            "gssapi-keyex");
+#ifdef GSI
+       }
+#endif
 
        gssbuf.value = buffer_ptr(&b);
        gssbuf.length = buffer_len(&b);
@@ -886,7 +966,15 @@ userauth_gsskeyex(Authctxt *authctxt)
        }
 
        packet_start(SSH2_MSG_USERAUTH_REQUEST);
+#ifdef GSI
+    if (options.implicit && is_gsi_oid(gss_kex_context->oid)) {
+        packet_put_cstring("");
+       } else {
+#endif
        packet_put_cstring(authctxt->server_user);
+#ifdef GSI
+       }
+#endif
        packet_put_cstring(authctxt->service);
        packet_put_cstring(authctxt->method->name);
        packet_put_string(mic.value, mic.length);