diff options
author | Colin Watson <cjwatson@debian.org> | 2009-12-29 20:42:47 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2009-12-29 20:42:47 +0000 |
commit | 9ad7b718d42e43f3a285fcbc8f91193931fce324 (patch) | |
tree | 95afe9b315fb73da54752d5bb71c682485b2d370 /monitor.c | |
parent | 5d05471f6657646d1d6500c7c43134462c407ee6 (diff) |
import openssh-4.0p1-gssapikex.patch
Diffstat (limited to 'monitor.c')
-rw-r--r-- | monitor.c | 54 |
1 files changed, 54 insertions, 0 deletions
@@ -141,6 +141,7 @@ int mm_answer_gss_setup_ctx(int, Buffer *); | |||
141 | int mm_answer_gss_accept_ctx(int, Buffer *); | 141 | int mm_answer_gss_accept_ctx(int, Buffer *); |
142 | int mm_answer_gss_userok(int, Buffer *); | 142 | int mm_answer_gss_userok(int, Buffer *); |
143 | int mm_answer_gss_checkmic(int, Buffer *); | 143 | int mm_answer_gss_checkmic(int, Buffer *); |
144 | int mm_answer_gss_sign(int, Buffer *); | ||
144 | #endif | 145 | #endif |
145 | 146 | ||
146 | #ifdef SSH_AUDIT_EVENTS | 147 | #ifdef SSH_AUDIT_EVENTS |
@@ -209,11 +210,17 @@ struct mon_table mon_dispatch_proto20[] = { | |||
209 | {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx}, | 210 | {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx}, |
210 | {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok}, | 211 | {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok}, |
211 | {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic}, | 212 | {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic}, |
213 | {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign}, | ||
212 | #endif | 214 | #endif |
213 | {0, 0, NULL} | 215 | {0, 0, NULL} |
214 | }; | 216 | }; |
215 | 217 | ||
216 | struct mon_table mon_dispatch_postauth20[] = { | 218 | struct mon_table mon_dispatch_postauth20[] = { |
219 | #ifdef GSSAPI | ||
220 | {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx}, | ||
221 | {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx}, | ||
222 | {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign}, | ||
223 | #endif | ||
217 | {MONITOR_REQ_MODULI, 0, mm_answer_moduli}, | 224 | {MONITOR_REQ_MODULI, 0, mm_answer_moduli}, |
218 | {MONITOR_REQ_SIGN, 0, mm_answer_sign}, | 225 | {MONITOR_REQ_SIGN, 0, mm_answer_sign}, |
219 | {MONITOR_REQ_PTY, 0, mm_answer_pty}, | 226 | {MONITOR_REQ_PTY, 0, mm_answer_pty}, |
@@ -316,6 +323,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor) | |||
316 | /* Permit requests for moduli and signatures */ | 323 | /* Permit requests for moduli and signatures */ |
317 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | 324 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); |
318 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | 325 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); |
326 | #ifdef GSSAPI | ||
327 | /* and for the GSSAPI key exchange */ | ||
328 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
329 | #endif | ||
319 | } else { | 330 | } else { |
320 | mon_dispatch = mon_dispatch_proto15; | 331 | mon_dispatch = mon_dispatch_proto15; |
321 | 332 | ||
@@ -389,6 +400,10 @@ monitor_child_postauth(struct monitor *pmonitor) | |||
389 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | 400 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); |
390 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | 401 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); |
391 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); | 402 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); |
403 | #ifdef GSSAPI | ||
404 | /* and for the GSSAPI key exchange */ | ||
405 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
406 | #endif | ||
392 | } else { | 407 | } else { |
393 | mon_dispatch = mon_dispatch_postauth15; | 408 | mon_dispatch = mon_dispatch_postauth15; |
394 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); | 409 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); |
@@ -1623,6 +1638,9 @@ mm_get_kex(Buffer *m) | |||
1623 | kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; | 1638 | kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; |
1624 | kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; | 1639 | kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; |
1625 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; | 1640 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; |
1641 | #ifdef GSSAPI | ||
1642 | kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
1643 | #endif | ||
1626 | kex->server = 1; | 1644 | kex->server = 1; |
1627 | kex->hostkey_type = buffer_get_int(m); | 1645 | kex->hostkey_type = buffer_get_int(m); |
1628 | kex->kex_type = buffer_get_int(m); | 1646 | kex->kex_type = buffer_get_int(m); |
@@ -1865,6 +1883,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m) | |||
1865 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0); | 1883 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0); |
1866 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); | 1884 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); |
1867 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1); | 1885 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1); |
1886 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1); | ||
1868 | } | 1887 | } |
1869 | return (0); | 1888 | return (0); |
1870 | } | 1889 | } |
@@ -1915,4 +1934,39 @@ mm_answer_gss_userok(int sock, Buffer *m) | |||
1915 | /* Monitor loop will terminate if authenticated */ | 1934 | /* Monitor loop will terminate if authenticated */ |
1916 | return (authenticated); | 1935 | return (authenticated); |
1917 | } | 1936 | } |
1937 | |||
1938 | int | ||
1939 | mm_answer_gss_sign(int socket, Buffer *m) | ||
1940 | { | ||
1941 | gss_buffer_desc data, hash; | ||
1942 | OM_uint32 major, minor; | ||
1943 | |||
1944 | data.value = buffer_get_string(m, &data.length); | ||
1945 | if (data.length != 20) | ||
1946 | fatal("%s: data length incorrect: %d", __func__, data.length); | ||
1947 | |||
1948 | /* Save the session ID on the first time around */ | ||
1949 | if (session_id2_len == 0) { | ||
1950 | session_id2_len = data.length; | ||
1951 | session_id2 = xmalloc(session_id2_len); | ||
1952 | memcpy(session_id2, data.value, session_id2_len); | ||
1953 | } | ||
1954 | major = ssh_gssapi_sign(gsscontext, &data, &hash); | ||
1955 | |||
1956 | xfree(data.value); | ||
1957 | |||
1958 | buffer_clear(m); | ||
1959 | buffer_put_int(m, major); | ||
1960 | buffer_put_string(m, hash.value, hash.length); | ||
1961 | |||
1962 | mm_request_send(socket, MONITOR_ANS_GSSSIGN, m); | ||
1963 | |||
1964 | gss_release_buffer(&minor, &hash); | ||
1965 | |||
1966 | /* Turn on getpwnam permissions */ | ||
1967 | monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1); | ||
1968 | |||
1969 | return (0); | ||
1970 | } | ||
1971 | |||
1918 | #endif /* GSSAPI */ | 1972 | #endif /* GSSAPI */ |