http://www.psc.edu/networking/projects/hpn-ssh/openssh-5.2p1-hpn13v6.diff.gz committe...

[gssapi-openssh.git] / openssh / sshconnect2.c

diff --git a/openssh/sshconnect2.c b/openssh/sshconnect2.c
index a961539037e434c22cbc52a838d4b1a6287538d5..1ff0ff596c7c1473824ae8799629043cfa28ab1b 100644 (file)
--- a/openssh/sshconnect2.c
+++ b/openssh/sshconnect2.c
@@ -78,6 +78,12 @@
 extern char *client_version_string;
 extern char *server_version_string;
 extern Options options;
+extern Kex *xxx_kex;
+
+/* tty_flag is set in ssh.c. use this in ssh_userauth2 */
+/* if it is set then prevent the switch to the null cipher */
+
+extern int tty_flag;
 
 /*
  * SSH2 key exchange
@@ -407,6 +413,28 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
        pubkey_cleanup(&authctxt);
        dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
 
+       /* if the user wants to use the none cipher do it */
+       /* post authentication and only if the right conditions are met */
+       /* both of the NONE commands must be true and there must be no */
+       /* tty allocated */
+       if ((options.none_switch == 1) && (options.none_enabled == 1)) 
+       {
+               if (!tty_flag) /* no null on tty sessions */
+               {
+                       debug("Requesting none rekeying...");
+                       myproposal[PROPOSAL_ENC_ALGS_STOC] = "none";
+                       myproposal[PROPOSAL_ENC_ALGS_CTOS] = "none";
+                       kex_prop2buf(&xxx_kex->my,myproposal);
+                       packet_request_rekeying();
+                       fprintf(stderr, "WARNING: ENABLED NONE CIPHER\n");
+               }
+               else
+               {
+                       /* requested NONE cipher when in a tty */
+                       debug("Cannot switch to NONE cipher with tty allocated");
+                       fprintf(stderr, "NONE cipher switch disabled when a TTY is allocated\n");
+               }
+       }
        debug("Authentication succeeded (%s).", authctxt.method->name);
 }