From 2a3e00306c9b3b4db71a777a7c3ccb70e470c675 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Fri, 12 May 2006 09:46:51 +0000 Subject: * Update to current GSSAPI patch from http://www.sxw.org.uk/computing/patches/openssh-4.3p2-gsskex-20060223.patch (closes: #352042). --- sshconnect2.c | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) (limited to 'sshconnect2.c') diff --git a/sshconnect2.c b/sshconnect2.c index 7ee71763a..3fb5df233 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -87,6 +87,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr) #ifdef GSSAPI char *orig, *gss = NULL; int len; + char *gss_host; #endif xxx_host = host; @@ -94,10 +95,17 @@ ssh_kex2(char *host, struct sockaddr *hostaddr) #ifdef GSSAPI if (options.gss_authentication) { + /* Add the GSSAPI mechanisms currently supported on this + * client to the key exchange algorithm proposal */ orig = myproposal[PROPOSAL_KEX_ALGS]; - gss = ssh_gssapi_client_mechanisms(get_canonical_hostname(1)); - debug("Offering GSSAPI proposal: %s",gss); + if (options.gss_trust_dns) + gss_host = (char *)get_canonical_hostname(1); + else + gss_host = host; + + gss = ssh_gssapi_client_mechanisms(gss_host); if (gss) { + debug("Offering GSSAPI proposal: %s", gss); len = strlen(orig) + strlen(gss) + 2; myproposal[PROPOSAL_KEX_ALGS] = xmalloc(len); snprintf(myproposal[PROPOSAL_KEX_ALGS], len, "%s,%s", @@ -134,6 +142,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr) options.hostkeyalgorithms; #ifdef GSSAPI + /* If we've got GSSAPI algorithms, then we also support the + * 'null' hostkey, as a last resort */ if (gss) { orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]; len = strlen(orig) + sizeof(",null"); @@ -152,8 +162,10 @@ ssh_kex2(char *host, struct sockaddr *hostaddr) kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client; kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; #ifdef GSSAPI - if (options.gss_authentication) + if (options.gss_authentication) { kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client; + kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client; + } #endif kex->client_version_string=client_version_string; kex->server_version_string=server_version_string; @@ -161,6 +173,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr) #ifdef GSSAPI kex->gss_deleg_creds = options.gss_deleg_creds; + kex->gss_trust_dns = options.gss_trust_dns; + kex->gss_host = gss_host; #endif xxx_kex = kex; @@ -245,7 +259,7 @@ void input_gssapi_token(int type, u_int32_t, void *); void input_gssapi_hash(int type, u_int32_t, void *); void input_gssapi_error(int, u_int32_t, void *); void input_gssapi_errtok(int, u_int32_t, void *); -int userauth_gsskeyx(Authctxt *authctxt); +int userauth_gsskeyex(Authctxt *authctxt); #endif void userauth(Authctxt *, char *); @@ -261,8 +275,8 @@ static char *authmethods_get(void); Authmethod authmethods[] = { #ifdef GSSAPI - {"gssapi-keyx", - userauth_gsskeyx, + {"gssapi-keyex", + userauth_gsskeyex, &options.gss_authentication, NULL}, {"gssapi-with-mic", @@ -775,10 +789,11 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt) } int -userauth_gsskeyx(Authctxt *authctxt) +userauth_gsskeyex(Authctxt *authctxt) { Buffer b; - gss_buffer_desc gssbuf, mic; + gss_buffer_desc gssbuf; + gss_buffer_desc mic = GSS_C_EMPTY_BUFFER; OM_uint32 ms; static int attempt = 0; -- cgit v1.2.3