summaryrefslogtreecommitdiff
path: root/clientloop.c
diff options
context:
space:
mode:
authorSimon Wilkinson <simon@sxw.org.uk>2014-02-09 16:09:48 +0000
committerColin Watson <cjwatson@debian.org>2017-01-16 15:02:41 +0000
commit48fbb156bdc676fb6ba6817770e4e971fbf85b1f (patch)
treef35c67c09472bddc3337b1c74b0cb6a1d9b58670 /clientloop.c
parent971a7653746a6972b907dfe0ce139c06e4a6f482 (diff)
GSSAPI key exchange support
This patch has been rejected upstream: "None of the OpenSSH developers are in favour of adding this, and this situation has not changed for several years. This is not a slight on Simon's patch, which is of fine quality, but just that a) we don't trust GSSAPI implementations that much and b) we don't like adding new KEX since they are pre-auth attack surface. This one is particularly scary, since it requires hooks out to typically root-owned system resources." However, quite a lot of people rely on this in Debian, and it's better to have it merged into the main openssh package rather than having separate -krb5 packages (as we used to have). It seems to have a generally good security history. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 Last-Updated: 2017-01-16 Patch-Name: gssapi.patch
Diffstat (limited to 'clientloop.c')
-rw-r--r--clientloop.c15
1 files changed, 14 insertions, 1 deletions
diff --git a/clientloop.c b/clientloop.c
index 4289a4081..99c68b690 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -113,6 +113,10 @@
113#include "ssherr.h" 113#include "ssherr.h"
114#include "hostfile.h" 114#include "hostfile.h"
115 115
116#ifdef GSSAPI
117#include "ssh-gss.h"
118#endif
119
116/* import options */ 120/* import options */
117extern Options options; 121extern Options options;
118 122
@@ -1664,9 +1668,18 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
1664 break; 1668 break;
1665 1669
1666 /* Do channel operations unless rekeying in progress. */ 1670 /* Do channel operations unless rekeying in progress. */
1667 if (!ssh_packet_is_rekeying(active_state)) 1671 if (!ssh_packet_is_rekeying(active_state)) {
1668 channel_after_select(readset, writeset); 1672 channel_after_select(readset, writeset);
1669 1673
1674#ifdef GSSAPI
1675 if (options.gss_renewal_rekey &&
1676 ssh_gssapi_credentials_updated(NULL)) {
1677 debug("credentials updated - forcing rekey");
1678 need_rekeying = 1;
1679 }
1680#endif
1681 }
1682
1670 /* Buffer input from the connection. */ 1683 /* Buffer input from the connection. */
1671 client_process_net_input(readset); 1684 client_process_net_input(readset);
1672 1685