diff options
author | Damien Miller <djm@mindrot.org> | 2006-08-19 00:33:34 +1000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2006-08-19 00:33:34 +1000 |
commit | a1cb9f334bcc6ebd7bf2b5229b7645d995de0a15 (patch) | |
tree | b01a3cf18b4100472c9f90e0d5599ddcf0acfba9 /gss-genr.c | |
parent | bdf00ca0bda672d07516d65eaea999931dafdac3 (diff) |
- djm@cvs.openbsd.org 2006/08/18 13:54:54
[gss-genr.c ssh-gss.h sshconnect2.c]
bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk
ok markus@
Diffstat (limited to 'gss-genr.c')
-rw-r--r-- | gss-genr.c | 33 |
1 files changed, 31 insertions, 2 deletions
diff --git a/gss-genr.c b/gss-genr.c index da39479e1..1bb67e84f 100644 --- a/gss-genr.c +++ b/gss-genr.c | |||
@@ -1,7 +1,7 @@ | |||
1 | /* $OpenBSD: gss-genr.c,v 1.13 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: gss-genr.c,v 1.14 2006/08/18 13:54:54 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | 4 | * Copyright (c) 2001-2006 Simon Wilkinson. All rights reserved. |
5 | * | 5 | * |
6 | * Redistribution and use in source and binary forms, with or without | 6 | * Redistribution and use in source and binary forms, with or without |
7 | * modification, are permitted provided that the following conditions | 7 | * modification, are permitted provided that the following conditions |
@@ -291,4 +291,33 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) | |||
291 | return (ssh_gssapi_acquire_cred(*ctx)); | 291 | return (ssh_gssapi_acquire_cred(*ctx)); |
292 | } | 292 | } |
293 | 293 | ||
294 | int | ||
295 | ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, char *host) | ||
296 | { | ||
297 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | ||
298 | OM_uint32 major, minor; | ||
299 | gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"}; | ||
300 | |||
301 | /* RFC 4462 says we MUST NOT do SPNEGO */ | ||
302 | if (oid->length == spnego_oid.length && | ||
303 | (memcmp(oid->elements, spnego_oid.elements, oid->length) == 0)) | ||
304 | return -1; | ||
305 | |||
306 | ssh_gssapi_build_ctx(ctx); | ||
307 | ssh_gssapi_set_oid(*ctx, oid); | ||
308 | major = ssh_gssapi_import_name(*ctx, host); | ||
309 | if (!GSS_ERROR(major)) { | ||
310 | major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, | ||
311 | NULL); | ||
312 | gss_release_buffer(&minor, &token); | ||
313 | gss_delete_sec_context(&minor, &(*ctx)->context, | ||
314 | GSS_C_NO_BUFFER); | ||
315 | } | ||
316 | |||
317 | if (GSS_ERROR(major)) | ||
318 | ssh_gssapi_delete_ctx(ctx); | ||
319 | |||
320 | return (!GSS_ERROR(major)); | ||
321 | } | ||
322 | |||
294 | #endif /* GSSAPI */ | 323 | #endif /* GSSAPI */ |