- dtucker@cvs.openbsd.org 2004/02/27 22:44:56

[openssh.git] / sshconnect2.c

diff --git a/sshconnect2.c b/sshconnect2.c
index 388a25741d7b976c44270ea80888bf3fe9e969f0..3a218113cfb2917e4f2d8cf5c7eb058f232ee8f1 100644 (file)
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.131 2003/11/17 09:45:39 djm Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.134 2004/01/19 21:25:15 markus Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -222,7 +222,7 @@ static char *authmethods_get(void);
 
 Authmethod authmethods[] = {
 #ifdef GSSAPI
-       {"gssapi",
+       {"gssapi-with-mic",
                userauth_gssapi,
                &options.gss_authentication,
                NULL},
@@ -476,7 +476,7 @@ done:
 }
 
 #ifdef GSSAPI
-int 
+int
 userauth_gssapi(Authctxt *authctxt)
 {
        Gssctxt *gssctxt = NULL;
@@ -543,28 +543,50 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
        Authctxt *authctxt = ctxt;
        Gssctxt *gssctxt = authctxt->methoddata;
        gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-       OM_uint32 status, ms;
-       
+       gss_buffer_desc gssbuf, mic;
+       OM_uint32 status, ms, flags;
+       Buffer b;
+
        status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
-           recv_tok, &send_tok, NULL);
+           recv_tok, &send_tok, &flags);
 
        if (send_tok.length > 0) {
                if (GSS_ERROR(status))
                        packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
                else
                        packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
-                       
+
                packet_put_string(send_tok.value, send_tok.length);
                packet_send();
                gss_release_buffer(&ms, &send_tok);
        }
-       
+
        if (status == GSS_S_COMPLETE) {
-               /* If that succeeded, send a exchange complete message */
-               packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
-               packet_send();
+               /* send either complete or MIC, depending on mechanism */
+               if (!(flags & GSS_C_INTEG_FLAG)) {
+                       packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
+                       packet_send();
+               } else {
+                       ssh_gssapi_buildmic(&b, authctxt->server_user,
+                           authctxt->service, "gssapi-with-mic");
+
+                       gssbuf.value = buffer_ptr(&b);
+                       gssbuf.length = buffer_len(&b);
+
+                       status = ssh_gssapi_sign(gssctxt, &gssbuf, &mic);
+
+                       if (!GSS_ERROR(status)) {
+                               packet_start(SSH2_MSG_USERAUTH_GSSAPI_MIC);
+                               packet_put_string(mic.value, mic.length);
+
+                               packet_send();
+                       }
+
+                       buffer_free(&b);
+                       gss_release_buffer(&ms, &mic);
+               }
        }
-       
+
        return status;
 }
 
@@ -1011,7 +1033,7 @@ pubkey_prepare(Authctxt *authctxt)
                    key = ssh_get_next_identity(ac, &comment, 2)) {
                        found = 0;
                        TAILQ_FOREACH(id, &files, next) {
-                               /* agent keys from the config file are preferred */ 
+                               /* agent keys from the config file are preferred */
                                if (key_equal(key, id->key)) {
                                        key_free(key);
                                        xfree(comment);
@@ -1245,7 +1267,7 @@ ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
 
        if (ssh_msg_recv(from[0], &b) < 0) {
                error("ssh_keysign: no reply");
-               buffer_clear(&b);
+               buffer_free(&b);
                return -1;
        }
        close(from[0]);
@@ -1257,11 +1279,11 @@ ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
 
        if (buffer_get_char(&b) != version) {
                error("ssh_keysign: bad version");
-               buffer_clear(&b);
+               buffer_free(&b);
                return -1;
        }
        *sigp = buffer_get_string(&b, lenp);
-       buffer_clear(&b);
+       buffer_free(&b);
 
        return 0;
 }