28 |
*/ |
*/ |
29 |
|
|
30 |
#ifndef lint |
#ifndef lint |
31 |
static char sccsid[] = "@(#)auth.c 8.3 (Berkeley) 5/30/95"; |
static char sccsid[] = "@(#)auth.c 8.3 (Berkeley) 5/30/95"; |
32 |
#endif /* not lint */ |
#endif /* not lint */ |
33 |
|
|
34 |
/* |
/* |
78 |
#define typemask(x) (1<<((x)-1)) |
#define typemask(x) (1<<((x)-1)) |
79 |
|
|
80 |
#ifdef KRB4_ENCPWD |
#ifdef KRB4_ENCPWD |
81 |
extern krb4encpwd_init(); |
extern krb4encpwd_init (); |
82 |
extern krb4encpwd_send(); |
extern krb4encpwd_send (); |
83 |
extern krb4encpwd_is(); |
extern krb4encpwd_is (); |
84 |
extern krb4encpwd_reply(); |
extern krb4encpwd_reply (); |
85 |
extern krb4encpwd_status(); |
extern krb4encpwd_status (); |
86 |
extern krb4encpwd_printsub(); |
extern krb4encpwd_printsub (); |
87 |
#endif |
#endif |
88 |
|
|
89 |
#ifdef RSA_ENCPWD |
#ifdef RSA_ENCPWD |
90 |
extern rsaencpwd_init(); |
extern rsaencpwd_init (); |
91 |
extern rsaencpwd_send(); |
extern rsaencpwd_send (); |
92 |
extern rsaencpwd_is(); |
extern rsaencpwd_is (); |
93 |
extern rsaencpwd_reply(); |
extern rsaencpwd_reply (); |
94 |
extern rsaencpwd_status(); |
extern rsaencpwd_status (); |
95 |
extern rsaencpwd_printsub(); |
extern rsaencpwd_printsub (); |
96 |
#endif |
#endif |
97 |
|
|
98 |
int auth_debug_mode = 0; |
int auth_debug_mode = 0; |
99 |
static char *Name = "Noname"; |
static char *Name = "Noname"; |
100 |
static int Server = 0; |
static int Server = 0; |
101 |
static TN_Authenticator *authenticated = 0; |
static TN_Authenticator *authenticated = 0; |
102 |
static int authenticating = 0; |
static int authenticating = 0; |
103 |
static int validuser = 0; |
static int validuser = 0; |
104 |
static unsigned char _auth_send_data[256]; |
static unsigned char _auth_send_data[256]; |
105 |
static unsigned char *auth_send_data; |
static unsigned char *auth_send_data; |
106 |
static int auth_send_cnt = 0; |
static int auth_send_cnt = 0; |
107 |
|
|
108 |
/* |
/* |
109 |
* Authentication types supported. Plese note that these are stored |
* Authentication types supported. Plese note that these are stored |
111 |
*/ |
*/ |
112 |
TN_Authenticator authenticators[] = { |
TN_Authenticator authenticators[] = { |
113 |
#ifdef SPX |
#ifdef SPX |
114 |
{ AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, |
{AUTHTYPE_SPX, AUTH_WHO_CLIENT | AUTH_HOW_MUTUAL, |
115 |
spx_init, |
spx_init, |
116 |
spx_send, |
spx_send, |
117 |
spx_is, |
spx_is, |
118 |
spx_reply, |
spx_reply, |
119 |
spx_status, |
spx_status, |
120 |
spx_printsub }, |
spx_printsub}, |
121 |
{ AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, |
{AUTHTYPE_SPX, AUTH_WHO_CLIENT | AUTH_HOW_ONE_WAY, |
122 |
spx_init, |
spx_init, |
123 |
spx_send, |
spx_send, |
124 |
spx_is, |
spx_is, |
125 |
spx_reply, |
spx_reply, |
126 |
spx_status, |
spx_status, |
127 |
spx_printsub }, |
spx_printsub}, |
128 |
|
#endif |
129 |
|
#ifdef SHISHI |
130 |
|
{AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT | AUTH_HOW_MUTUAL, |
131 |
|
krb5shishi_init, |
132 |
|
krb5shishi_send, |
133 |
|
krb5shishi_is, |
134 |
|
krb5shishi_reply, |
135 |
|
krb5shishi_status, |
136 |
|
krb5shishi_printsub, |
137 |
|
krb5shishi_cleanup}, |
138 |
|
{AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT | AUTH_HOW_ONE_WAY, |
139 |
|
krb5shishi_init, |
140 |
|
krb5shishi_send, |
141 |
|
krb5shishi_is, |
142 |
|
krb5shishi_reply, |
143 |
|
krb5shishi_status, |
144 |
|
krb5shishi_printsub, |
145 |
|
krb5shishi_cleanup}, |
146 |
#endif |
#endif |
147 |
#ifdef KRB5 |
#ifdef KRB5 |
148 |
# ifdef ENCRYPTION |
# ifdef ENCRYPTION |
149 |
{ AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, |
{AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT | AUTH_HOW_MUTUAL, |
150 |
kerberos5_init, |
kerberos5_init, |
151 |
kerberos5_send, |
kerberos5_send, |
152 |
kerberos5_is, |
kerberos5_is, |
153 |
kerberos5_reply, |
kerberos5_reply, |
154 |
kerberos5_status, |
kerberos5_status, |
155 |
kerberos5_printsub }, |
kerberos5_printsub}, |
156 |
# endif /* ENCRYPTION */ |
# endif /* ENCRYPTION */ |
157 |
{ AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, |
{AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT | AUTH_HOW_ONE_WAY, |
158 |
kerberos5_init, |
kerberos5_init, |
159 |
kerberos5_send, |
kerberos5_send, |
160 |
kerberos5_is, |
kerberos5_is, |
161 |
kerberos5_reply, |
kerberos5_reply, |
162 |
kerberos5_status, |
kerberos5_status, |
163 |
kerberos5_printsub }, |
kerberos5_printsub}, |
164 |
#endif |
#endif |
165 |
#ifdef KRB4 |
#ifdef KRB4 |
166 |
# ifdef ENCRYPTION |
# ifdef ENCRYPTION |
167 |
{ AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, |
{AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT | AUTH_HOW_MUTUAL, |
168 |
kerberos4_init, |
kerberos4_init, |
169 |
kerberos4_send, |
kerberos4_send, |
170 |
kerberos4_is, |
kerberos4_is, |
171 |
kerberos4_reply, |
kerberos4_reply, |
172 |
kerberos4_status, |
kerberos4_status, |
173 |
kerberos4_printsub }, |
kerberos4_printsub}, |
174 |
# endif /* ENCRYPTION */ |
# endif /* ENCRYPTION */ |
175 |
{ AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, |
{AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT | AUTH_HOW_ONE_WAY, |
176 |
kerberos4_init, |
kerberos4_init, |
177 |
kerberos4_send, |
kerberos4_send, |
178 |
kerberos4_is, |
kerberos4_is, |
179 |
kerberos4_reply, |
kerberos4_reply, |
180 |
kerberos4_status, |
kerberos4_status, |
181 |
kerberos4_printsub }, |
kerberos4_printsub}, |
182 |
#endif |
#endif |
183 |
#ifdef KRB4_ENCPWD |
#ifdef KRB4_ENCPWD |
184 |
{ AUTHTYPE_KRB4_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, |
{AUTHTYPE_KRB4_ENCPWD, AUTH_WHO_CLIENT | AUTH_HOW_MUTUAL, |
185 |
krb4encpwd_init, |
krb4encpwd_init, |
186 |
krb4encpwd_send, |
krb4encpwd_send, |
187 |
krb4encpwd_is, |
krb4encpwd_is, |
188 |
krb4encpwd_reply, |
krb4encpwd_reply, |
189 |
krb4encpwd_status, |
krb4encpwd_status, |
190 |
krb4encpwd_printsub }, |
krb4encpwd_printsub}, |
191 |
#endif |
#endif |
192 |
#ifdef RSA_ENCPWD |
#ifdef RSA_ENCPWD |
193 |
{ AUTHTYPE_RSA_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, |
{AUTHTYPE_RSA_ENCPWD, AUTH_WHO_CLIENT | AUTH_HOW_ONE_WAY, |
194 |
rsaencpwd_init, |
rsaencpwd_init, |
195 |
rsaencpwd_send, |
rsaencpwd_send, |
196 |
rsaencpwd_is, |
rsaencpwd_is, |
197 |
rsaencpwd_reply, |
rsaencpwd_reply, |
198 |
rsaencpwd_status, |
rsaencpwd_status, |
199 |
rsaencpwd_printsub }, |
rsaencpwd_printsub}, |
200 |
#endif |
#endif |
201 |
{ 0, }, |
{0,}, |
202 |
}; |
}; |
203 |
|
|
204 |
static TN_Authenticator NoAuth = { 0 }; |
static TN_Authenticator NoAuth = { 0 }; |
205 |
|
|
206 |
static int i_support = 0; |
static int i_support = 0; |
207 |
static int i_wont_support = 0; |
static int i_wont_support = 0; |
208 |
|
|
209 |
TN_Authenticator * |
TN_Authenticator * |
210 |
findauthenticator(type, way) |
findauthenticator (int type, int way) |
|
int type; |
|
|
int way; |
|
|
{ |
|
|
TN_Authenticator *ap = authenticators; |
|
|
|
|
|
while (ap->type && (ap->type != type || ap->way != way)) |
|
|
++ap; |
|
|
return(ap->type ? ap : 0); |
|
|
} |
|
|
|
|
|
void |
|
|
auth_init(name, server) |
|
|
char *name; |
|
|
int server; |
|
|
{ |
|
|
TN_Authenticator *ap = authenticators; |
|
|
|
|
|
Server = server; |
|
|
Name = name; |
|
|
|
|
|
i_support = 0; |
|
|
authenticated = 0; |
|
|
authenticating = 0; |
|
|
while (ap->type) { |
|
|
if (!ap->init || (*ap->init)(ap, server)) { |
|
|
i_support |= typemask(ap->type); |
|
|
if (auth_debug_mode) |
|
|
printf(">>>%s: I support auth type %s (%d) %s (%d)\r\n", |
|
|
Name, |
|
|
AUTHTYPE_NAME_OK(ap->type) ? |
|
|
AUTHTYPE_NAME(ap->type) : |
|
|
"unknown", |
|
|
ap->type, |
|
|
ap->way & |
|
|
AUTH_HOW_MASK & |
|
|
AUTH_HOW_MUTUAL ? |
|
|
"MUTUAL" : |
|
|
"ONEWAY", |
|
|
ap->way); |
|
|
} |
|
|
else if (auth_debug_mode) |
|
|
printf(">>>%s: Init failed: auth type %d %d\r\n", |
|
|
Name, ap->type, ap->way); |
|
|
++ap; |
|
|
} |
|
|
} |
|
|
|
|
|
void |
|
|
auth_disable_name(name) |
|
|
char *name; |
|
|
{ |
|
|
int x; |
|
|
for (x = 0; x < AUTHTYPE_CNT; ++x) { |
|
|
if (!strcasecmp(name, AUTHTYPE_NAME(x))) { |
|
|
i_wont_support |= typemask(x); |
|
|
break; |
|
|
} |
|
|
} |
|
|
} |
|
|
|
|
|
int |
|
|
getauthmask(type, maskp) |
|
|
char *type; |
|
|
int *maskp; |
|
|
{ |
|
|
register int x; |
|
|
|
|
|
if (!strcasecmp(type, AUTHTYPE_NAME(0))) { |
|
|
*maskp = -1; |
|
|
return(1); |
|
|
} |
|
|
|
|
|
for (x = 1; x < AUTHTYPE_CNT; ++x) { |
|
|
if (!strcasecmp(type, AUTHTYPE_NAME(x))) { |
|
|
*maskp = typemask(x); |
|
|
return(1); |
|
|
} |
|
|
} |
|
|
return(0); |
|
|
} |
|
|
|
|
|
int |
|
|
auth_enable(type) |
|
|
char *type; |
|
211 |
{ |
{ |
212 |
return(auth_onoff(type, 1)); |
TN_Authenticator *ap = authenticators; |
|
} |
|
213 |
|
|
214 |
int |
while (ap->type && (ap->type != type || ap->way != way)) |
215 |
auth_disable(type) |
++ap; |
216 |
char *type; |
return (ap->type ? ap : 0); |
217 |
{ |
} |
218 |
return(auth_onoff(type, 0)); |
|
219 |
} |
void |
220 |
|
auth_init (char *name, int server) |
221 |
int |
{ |
222 |
auth_onoff(type, on) |
TN_Authenticator *ap = authenticators; |
223 |
char *type; |
|
224 |
int on; |
Server = server; |
225 |
{ |
Name = name; |
226 |
int i, mask = -1; |
|
227 |
TN_Authenticator *ap; |
i_support = 0; |
228 |
|
authenticated = 0; |
229 |
if (!strcasecmp(type, "?") || !strcasecmp(type, "help")) { |
authenticating = 0; |
230 |
printf("auth %s 'type'\n", on ? "enable" : "disable"); |
while (ap->type) |
231 |
printf("Where 'type' is one of:\n"); |
{ |
232 |
printf("\t%s\n", AUTHTYPE_NAME(0)); |
if (!ap->init || (*ap->init) (ap, server)) |
233 |
mask = 0; |
{ |
234 |
for (ap = authenticators; ap->type; ap++) { |
i_support |= typemask (ap->type); |
235 |
if ((mask & (i = typemask(ap->type))) != 0) |
if (auth_debug_mode) |
236 |
continue; |
printf (">>>%s: I support auth type %s (%d) %s (%d)\r\n", |
237 |
mask |= i; |
Name, |
238 |
printf("\t%s\n", AUTHTYPE_NAME(ap->type)); |
AUTHTYPE_NAME_OK (ap->type) ? |
239 |
} |
AUTHTYPE_NAME (ap->type) : |
240 |
return(0); |
"unknown", |
241 |
} |
ap->type, |
242 |
|
ap->way & |
243 |
if (!getauthmask(type, &mask)) { |
AUTH_HOW_MASK & |
244 |
printf("%s: invalid authentication type\n", type); |
AUTH_HOW_MUTUAL ? "MUTUAL" : "ONEWAY", ap->way); |
245 |
return(0); |
} |
246 |
} |
else if (auth_debug_mode) |
247 |
if (on) |
printf (">>>%s: Init failed: auth type %d %d\r\n", |
248 |
i_wont_support &= ~mask; |
Name, ap->type, ap->way); |
249 |
else |
++ap; |
250 |
i_wont_support |= mask; |
} |
251 |
return(1); |
} |
252 |
} |
|
253 |
|
void |
254 |
int |
auth_disable_name (char *name) |
255 |
auth_togdebug(on) |
{ |
256 |
int on; |
int x; |
257 |
{ |
|
258 |
if (on < 0) |
for (x = 0; x < AUTHTYPE_CNT; ++x) |
259 |
auth_debug_mode ^= 1; |
{ |
260 |
else |
if (!strcasecmp (name, AUTHTYPE_NAME (x))) |
261 |
auth_debug_mode = on; |
{ |
262 |
printf("auth debugging %s\n", auth_debug_mode ? "enabled" : "disabled"); |
i_wont_support |= typemask (x); |
263 |
return(1); |
break; |
264 |
} |
} |
265 |
|
} |
266 |
int |
} |
267 |
auth_status() |
|
268 |
{ |
int |
269 |
TN_Authenticator *ap; |
getauthmask (char *type, int *maskp) |
270 |
int i, mask; |
{ |
271 |
|
register int x; |
272 |
if (i_wont_support == -1) |
|
273 |
printf("Authentication disabled\n"); |
if (!strcasecmp (type, AUTHTYPE_NAME (0))) |
274 |
else |
{ |
275 |
printf("Authentication enabled\n"); |
*maskp = -1; |
276 |
|
return (1); |
277 |
mask = 0; |
} |
278 |
for (ap = authenticators; ap->type; ap++) { |
|
279 |
if ((mask & (i = typemask(ap->type))) != 0) |
for (x = 1; x < AUTHTYPE_CNT; ++x) |
280 |
continue; |
{ |
281 |
mask |= i; |
if (!strcasecmp (type, AUTHTYPE_NAME (x))) |
282 |
printf("%s: %s\n", AUTHTYPE_NAME(ap->type), |
{ |
283 |
(i_wont_support & typemask(ap->type)) ? |
*maskp = typemask (x); |
284 |
"disabled" : "enabled"); |
return (1); |
285 |
} |
} |
286 |
return(1); |
} |
287 |
|
return (0); |
288 |
|
} |
289 |
|
|
290 |
|
int |
291 |
|
auth_enable (char *type) |
292 |
|
{ |
293 |
|
return (auth_onoff (type, 1)); |
294 |
|
} |
295 |
|
|
296 |
|
int |
297 |
|
auth_disable (char *type) |
298 |
|
{ |
299 |
|
return (auth_onoff (type, 0)); |
300 |
|
} |
301 |
|
|
302 |
|
int |
303 |
|
auth_onoff (char *type, int on) |
304 |
|
{ |
305 |
|
int i, mask = -1; |
306 |
|
TN_Authenticator *ap; |
307 |
|
|
308 |
|
if (!strcasecmp (type, "?") || !strcasecmp (type, "help")) |
309 |
|
{ |
310 |
|
printf ("auth %s 'type'\n", on ? "enable" : "disable"); |
311 |
|
printf ("Where 'type' is one of:\n"); |
312 |
|
printf ("\t%s\n", AUTHTYPE_NAME (0)); |
313 |
|
mask = 0; |
314 |
|
for (ap = authenticators; ap->type; ap++) |
315 |
|
{ |
316 |
|
if ((mask & (i = typemask (ap->type))) != 0) |
317 |
|
continue; |
318 |
|
mask |= i; |
319 |
|
printf ("\t%s\n", AUTHTYPE_NAME (ap->type)); |
320 |
|
} |
321 |
|
return (0); |
322 |
|
} |
323 |
|
|
324 |
|
if (!getauthmask (type, &mask)) |
325 |
|
{ |
326 |
|
printf ("%s: invalid authentication type\n", type); |
327 |
|
return (0); |
328 |
|
} |
329 |
|
if (on) |
330 |
|
i_wont_support &= ~mask; |
331 |
|
else |
332 |
|
i_wont_support |= mask; |
333 |
|
return (1); |
334 |
|
} |
335 |
|
|
336 |
|
int |
337 |
|
auth_togdebug (int on) |
338 |
|
{ |
339 |
|
if (on < 0) |
340 |
|
auth_debug_mode ^= 1; |
341 |
|
else |
342 |
|
auth_debug_mode = on; |
343 |
|
printf ("auth debugging %s\n", auth_debug_mode ? "enabled" : "disabled"); |
344 |
|
return (1); |
345 |
|
} |
346 |
|
|
347 |
|
int |
348 |
|
auth_status () |
349 |
|
{ |
350 |
|
TN_Authenticator *ap; |
351 |
|
int i, mask; |
352 |
|
|
353 |
|
if (i_wont_support == -1) |
354 |
|
printf ("Authentication disabled\n"); |
355 |
|
else |
356 |
|
printf ("Authentication enabled\n"); |
357 |
|
|
358 |
|
mask = 0; |
359 |
|
for (ap = authenticators; ap->type; ap++) |
360 |
|
{ |
361 |
|
if ((mask & (i = typemask (ap->type))) != 0) |
362 |
|
continue; |
363 |
|
mask |= i; |
364 |
|
printf ("%s: %s\n", AUTHTYPE_NAME (ap->type), |
365 |
|
(i_wont_support & typemask (ap->type)) ? |
366 |
|
"disabled" : "enabled"); |
367 |
|
} |
368 |
|
return (1); |
369 |
} |
} |
370 |
|
|
371 |
/* |
/* |
372 |
* This routine is called by the server to start authentication |
* This routine is called by the server to start authentication |
373 |
* negotiation. |
* negotiation. |
374 |
*/ |
*/ |
375 |
void |
void |
376 |
auth_request() |
auth_request () |
377 |
{ |
{ |
378 |
static unsigned char str_request[64] = { IAC, SB, |
static unsigned char str_request[64] = { IAC, SB, |
379 |
TELOPT_AUTHENTICATION, |
TELOPT_AUTHENTICATION, |
380 |
TELQUAL_SEND, }; |
TELQUAL_SEND, |
381 |
TN_Authenticator *ap = authenticators; |
}; |
382 |
unsigned char *e = str_request + 4; |
TN_Authenticator *ap = authenticators; |
383 |
|
unsigned char *e = str_request + 4; |
384 |
if (!authenticating) { |
|
385 |
authenticating = 1; |
if (!authenticating) |
386 |
while (ap->type) { |
{ |
387 |
if (i_support & ~i_wont_support & typemask(ap->type)) { |
authenticating = 1; |
388 |
if (auth_debug_mode) { |
while (ap->type) |
389 |
printf(">>>%s: Sending type %d %d\r\n", |
{ |
390 |
Name, ap->type, ap->way); |
if (i_support & ~i_wont_support & typemask (ap->type)) |
391 |
} |
{ |
392 |
*e++ = ap->type; |
if (auth_debug_mode) |
393 |
*e++ = ap->way; |
{ |
394 |
} |
printf (">>>%s: Sending type %d %d\r\n", |
395 |
++ap; |
Name, ap->type, ap->way); |
396 |
} |
} |
397 |
*e++ = IAC; |
*e++ = ap->type; |
398 |
*e++ = SE; |
*e++ = ap->way; |
399 |
net_write(str_request, e - str_request); |
} |
400 |
printsub('>', &str_request[2], e - str_request - 2); |
++ap; |
401 |
} |
} |
402 |
|
*e++ = IAC; |
403 |
|
*e++ = SE; |
404 |
|
net_write (str_request, e - str_request); |
405 |
|
printsub ('>', &str_request[2], e - str_request - 2); |
406 |
|
} |
407 |
} |
} |
408 |
|
|
409 |
/* |
/* |
417 |
* with KERBEROS instead of LOGIN (which is against what the |
* with KERBEROS instead of LOGIN (which is against what the |
418 |
* protocol says)) you will have to hack this code... |
* protocol says)) you will have to hack this code... |
419 |
*/ |
*/ |
420 |
void |
void |
421 |
auth_send(data, cnt) |
auth_send (unsigned char *data, int cnt) |
422 |
unsigned char *data; |
{ |
423 |
int cnt; |
TN_Authenticator *ap; |
424 |
{ |
static unsigned char str_none[] = { IAC, SB, TELOPT_AUTHENTICATION, |
425 |
TN_Authenticator *ap; |
TELQUAL_IS, AUTHTYPE_NULL, 0, |
426 |
static unsigned char str_none[] = { IAC, SB, TELOPT_AUTHENTICATION, |
IAC, SE |
427 |
TELQUAL_IS, AUTHTYPE_NULL, 0, |
}; |
428 |
IAC, SE }; |
if (Server) |
429 |
if (Server) { |
{ |
430 |
if (auth_debug_mode) { |
if (auth_debug_mode) |
431 |
printf(">>>%s: auth_send called!\r\n", Name); |
{ |
432 |
} |
printf (">>>%s: auth_send called!\r\n", Name); |
433 |
return; |
} |
434 |
} |
return; |
435 |
|
} |
436 |
if (auth_debug_mode) { |
|
437 |
printf(">>>%s: auth_send got:", Name); |
if (auth_debug_mode) |
438 |
printd(data, cnt); printf("\r\n"); |
{ |
439 |
} |
printf (">>>%s: auth_send got:", Name); |
440 |
|
printd (data, cnt); |
441 |
/* |
printf ("\r\n"); |
442 |
* Save the data, if it is new, so that we can continue looking |
} |
443 |
* at it if the authorization we try doesn't work |
|
444 |
*/ |
/* |
445 |
if (data < _auth_send_data || |
* Save the data, if it is new, so that we can continue looking |
446 |
data > _auth_send_data + sizeof(_auth_send_data)) { |
* at it if the authorization we try doesn't work |
447 |
auth_send_cnt = cnt > sizeof(_auth_send_data) |
*/ |
448 |
? sizeof(_auth_send_data) |
if (data < _auth_send_data || |
449 |
: cnt; |
data > _auth_send_data + sizeof (_auth_send_data)) |
450 |
memmove((void *)_auth_send_data, (void *)data, auth_send_cnt); |
{ |
451 |
auth_send_data = _auth_send_data; |
auth_send_cnt = cnt > sizeof (_auth_send_data) |
452 |
} else { |
? sizeof (_auth_send_data) : cnt; |
453 |
/* |
memmove ((void *) _auth_send_data, (void *) data, auth_send_cnt); |
454 |
* This is probably a no-op, but we just make sure |
auth_send_data = _auth_send_data; |
455 |
*/ |
} |
456 |
auth_send_data = data; |
else |
457 |
auth_send_cnt = cnt; |
{ |
458 |
} |
/* |
459 |
while ((auth_send_cnt -= 2) >= 0) { |
* This is probably a no-op, but we just make sure |
460 |
if (auth_debug_mode) |
*/ |
461 |
printf(">>>%s: He supports %s (%d) %s (%d)\r\n", |
auth_send_data = data; |
462 |
Name, AUTHTYPE_NAME_OK(auth_send_data[0]) ? |
auth_send_cnt = cnt; |
463 |
AUTHTYPE_NAME(auth_send_data[0]) : |
} |
464 |
"unknown", |
while ((auth_send_cnt -= 2) >= 0) |
465 |
auth_send_data[0], |
{ |
466 |
auth_send_data[1] & |
if (auth_debug_mode) |
467 |
AUTH_HOW_MASK & |
printf (">>>%s: He supports %s (%d) %s (%d)\r\n", |
468 |
AUTH_HOW_MUTUAL ? |
Name, AUTHTYPE_NAME_OK (auth_send_data[0]) ? |
469 |
"MUTUAL" : |
AUTHTYPE_NAME (auth_send_data[0]) : |
470 |
"ONEWAY", |
"unknown", |
471 |
auth_send_data[1]); |
auth_send_data[0], |
472 |
if ((i_support & ~i_wont_support) & typemask(*auth_send_data)) { |
auth_send_data[1] & |
473 |
ap = findauthenticator(auth_send_data[0], |
AUTH_HOW_MASK & |
474 |
auth_send_data[1]); |
AUTH_HOW_MUTUAL ? "MUTUAL" : "ONEWAY", auth_send_data[1]); |
475 |
if (ap && ap->send) { |
if ((i_support & ~i_wont_support) & typemask (*auth_send_data)) |
476 |
if (auth_debug_mode) |
{ |
477 |
printf(">>>%s: Trying %s (%d) %s (%d)\r\n", |
ap = findauthenticator (auth_send_data[0], auth_send_data[1]); |
478 |
Name, |
if (ap && ap->send) |
479 |
AUTHTYPE_NAME_OK(auth_send_data[0]) ? |
{ |
480 |
AUTHTYPE_NAME(auth_send_data[0]) : |
if (auth_debug_mode) |
481 |
"unknown", |
printf (">>>%s: Trying %s (%d) %s (%d)\r\n", |
482 |
auth_send_data[0], |
Name, |
483 |
auth_send_data[1] & |
AUTHTYPE_NAME_OK (auth_send_data[0]) ? |
484 |
AUTH_HOW_MASK & |
AUTHTYPE_NAME (auth_send_data[0]) : |
485 |
AUTH_HOW_MUTUAL ? |
"unknown", |
486 |
"MUTUAL" : |
auth_send_data[0], |
487 |
"ONEWAY", |
auth_send_data[1] & |
488 |
auth_send_data[1]); |
AUTH_HOW_MASK & |
489 |
if ((*ap->send)(ap)) { |
AUTH_HOW_MUTUAL ? |
490 |
/* |
"MUTUAL" : "ONEWAY", auth_send_data[1]); |
491 |
* Okay, we found one we like |
if ((*ap->send) (ap)) |
492 |
* and did it. |
{ |
493 |
* we can go home now. |
/* |
494 |
*/ |
* Okay, we found one we like |
495 |
if (auth_debug_mode) |
* and did it. |
496 |
printf(">>>%s: Using type %s (%d)\r\n", |
* we can go home now. |
497 |
Name, |
*/ |
498 |
AUTHTYPE_NAME_OK(*auth_send_data) ? |
if (auth_debug_mode) |
499 |
AUTHTYPE_NAME(*auth_send_data) : |
printf (">>>%s: Using type %s (%d)\r\n", |
500 |
"unknown", |
Name, |
501 |
*auth_send_data); |
AUTHTYPE_NAME_OK (*auth_send_data) ? |
502 |
auth_send_data += 2; |
AUTHTYPE_NAME (*auth_send_data) : |
503 |
return; |
"unknown", *auth_send_data); |
504 |
} |
auth_send_data += 2; |
505 |
} |
return; |
|
/* else |
|
|
* just continue on and look for the |
|
|
* next one if we didn't do anything. |
|
|
*/ |
|
506 |
} |
} |
507 |
auth_send_data += 2; |
} |
508 |
} |
/* else |
509 |
net_write(str_none, sizeof(str_none)); |
* just continue on and look for the |
510 |
printsub('>', &str_none[2], sizeof(str_none) - 2); |
* next one if we didn't do anything. |
511 |
if (auth_debug_mode) |
*/ |
512 |
printf(">>>%s: Sent failure message\r\n", Name); |
} |
513 |
auth_finished(0, AUTH_REJECT); |
auth_send_data += 2; |
514 |
|
} |
515 |
|
net_write (str_none, sizeof (str_none)); |
516 |
|
printsub ('>', &str_none[2], sizeof (str_none) - 2); |
517 |
|
if (auth_debug_mode) |
518 |
|
printf (">>>%s: Sent failure message\r\n", Name); |
519 |
|
auth_finished (0, AUTH_REJECT); |
520 |
#ifdef KANNAN |
#ifdef KANNAN |
521 |
/* |
/* |
522 |
* We requested strong authentication, however no mechanisms worked. |
* We requested strong authentication, however no mechanisms worked. |
523 |
* Therefore, exit on client end. |
* Therefore, exit on client end. |
524 |
*/ |
*/ |
525 |
printf("Unable to securely authenticate user ... exit\n"); |
printf ("Unable to securely authenticate user ... exit\n"); |
526 |
exit(0); |
exit (0); |
527 |
#endif /* KANNAN */ |
#endif /* KANNAN */ |
528 |
} |
} |
529 |
|
|
530 |
void |
void |
531 |
auth_send_retry() |
auth_send_retry () |
532 |
{ |
{ |
533 |
/* |
/* |
534 |
* if auth_send_cnt <= 0 then auth_send will end up rejecting |
* if auth_send_cnt <= 0 then auth_send will end up rejecting |
535 |
* the authentication and informing the other side of this. |
* the authentication and informing the other side of this. |
536 |
*/ |
*/ |
537 |
auth_send(auth_send_data, auth_send_cnt); |
auth_send (auth_send_data, auth_send_cnt); |
538 |
} |
} |
539 |
|
|
540 |
void |
void |
541 |
auth_is(data, cnt) |
auth_is (unsigned char *data, int cnt) |
542 |
unsigned char *data; |
{ |
543 |
int cnt; |
TN_Authenticator *ap; |
544 |
{ |
|
545 |
TN_Authenticator *ap; |
if (cnt < 2) |
546 |
|
return; |
547 |
if (cnt < 2) |
|
548 |
return; |
if (data[0] == AUTHTYPE_NULL) |
549 |
|
{ |
550 |
if (data[0] == AUTHTYPE_NULL) { |
auth_finished (0, AUTH_REJECT); |
551 |
auth_finished(0, AUTH_REJECT); |
return; |
552 |
return; |
} |
553 |
} |
|
554 |
|
if (ap = findauthenticator (data[0], data[1])) |
555 |
if (ap = findauthenticator(data[0], data[1])) { |
{ |
556 |
if (ap->is) |
if (ap->is) |
557 |
(*ap->is)(ap, data+2, cnt-2); |
(*ap->is) (ap, data + 2, cnt - 2); |
558 |
} else if (auth_debug_mode) |
} |
559 |
printf(">>>%s: Invalid authentication in IS: %d\r\n", |
else if (auth_debug_mode) |
560 |
Name, *data); |
printf (">>>%s: Invalid authentication in IS: %d\r\n", Name, *data); |
561 |
} |
} |
562 |
|
|
563 |
void |
void |
564 |
auth_reply(data, cnt) |
auth_reply (unsigned char *data, int cnt) |
565 |
unsigned char *data; |
{ |
566 |
int cnt; |
TN_Authenticator *ap; |
567 |
{ |
|
568 |
TN_Authenticator *ap; |
if (cnt < 2) |
569 |
|
return; |
570 |
if (cnt < 2) |
|
571 |
return; |
if (ap = findauthenticator (data[0], data[1])) |
572 |
|
{ |
573 |
if (ap = findauthenticator(data[0], data[1])) { |
if (ap->reply) |
574 |
if (ap->reply) |
(*ap->reply) (ap, data + 2, cnt - 2); |
575 |
(*ap->reply)(ap, data+2, cnt-2); |
} |
576 |
} else if (auth_debug_mode) |
else if (auth_debug_mode) |
577 |
printf(">>>%s: Invalid authentication in SEND: %d\r\n", |
printf (">>>%s: Invalid authentication in SEND: %d\r\n", Name, *data); |
578 |
Name, *data); |
} |
579 |
} |
|
580 |
|
void |
581 |
void |
auth_name (unsigned char *data, int cnt) |
582 |
auth_name(data, cnt) |
{ |
583 |
unsigned char *data; |
TN_Authenticator *ap; |
584 |
int cnt; |
unsigned char savename[256]; |
585 |
{ |
|
586 |
TN_Authenticator *ap; |
if (cnt < 1) |
587 |
unsigned char savename[256]; |
{ |
588 |
|
if (auth_debug_mode) |
589 |
if (cnt < 1) { |
printf (">>>%s: Empty name in NAME\r\n", Name); |
590 |
if (auth_debug_mode) |
return; |
591 |
printf(">>>%s: Empty name in NAME\r\n", Name); |
} |
592 |
return; |
if (cnt > sizeof (savename) - 1) |
593 |
} |
{ |
594 |
if (cnt > sizeof(savename) - 1) { |
if (auth_debug_mode) |
595 |
if (auth_debug_mode) |
printf (">>>%s: Name in NAME (%d) exceeds %d length\r\n", |
596 |
printf(">>>%s: Name in NAME (%d) exceeds %d length\r\n", |
Name, cnt, sizeof (savename) - 1); |
597 |
Name, cnt, sizeof(savename)-1); |
return; |
598 |
return; |
} |
599 |
} |
memmove ((void *) savename, (void *) data, cnt); |
600 |
memmove((void *)savename, (void *)data, cnt); |
savename[cnt] = '\0'; /* Null terminate */ |
601 |
savename[cnt] = '\0'; /* Null terminate */ |
if (auth_debug_mode) |
602 |
if (auth_debug_mode) |
printf (">>>%s: Got NAME [%s]\r\n", Name, savename); |
603 |
printf(">>>%s: Got NAME [%s]\r\n", Name, savename); |
auth_encrypt_user (savename); |
604 |
auth_encrypt_user(savename); |
} |
605 |
} |
|
606 |
|
int |
607 |
int |
auth_sendname (unsigned char *cp, int len) |
608 |
auth_sendname(cp, len) |
{ |
609 |
unsigned char *cp; |
static unsigned char str_request[256 + 6] |
610 |
int len; |
= { IAC, SB, TELOPT_AUTHENTICATION, TELQUAL_NAME, }; |
611 |
{ |
register unsigned char *e = str_request + 4; |
612 |
static unsigned char str_request[256+6] |
register unsigned char *ee = &str_request[sizeof (str_request) - 2]; |
613 |
= { IAC, SB, TELOPT_AUTHENTICATION, TELQUAL_NAME, }; |
|
614 |
register unsigned char *e = str_request + 4; |
while (--len >= 0) |
615 |
register unsigned char *ee = &str_request[sizeof(str_request)-2]; |
{ |
616 |
|
if ((*e++ = *cp++) == IAC) |
|
while (--len >= 0) { |
|
|
if ((*e++ = *cp++) == IAC) |
|
|
*e++ = IAC; |
|
|
if (e >= ee) |
|
|
return(0); |
|
|
} |
|
617 |
*e++ = IAC; |
*e++ = IAC; |
618 |
*e++ = SE; |
if (e >= ee) |
619 |
net_write(str_request, e - str_request); |
return (0); |
620 |
printsub('>', &str_request[2], e - &str_request[2]); |
} |
621 |
return(1); |
*e++ = IAC; |
622 |
|
*e++ = SE; |
623 |
|
net_write (str_request, e - str_request); |
624 |
|
printsub ('>', &str_request[2], e - &str_request[2]); |
625 |
|
return (1); |
626 |
} |
} |
627 |
|
|
628 |
void |
void |
629 |
auth_finished(ap, result) |
auth_finished (TN_Authenticator * ap, int result) |
|
TN_Authenticator *ap; |
|
|
int result; |
|
630 |
{ |
{ |
631 |
if (!(authenticated = ap)) |
if (ap && ap->cleanup) |
632 |
authenticated = &NoAuth; |
(*ap->cleanup) (ap); |
633 |
validuser = result; |
if (!(authenticated = ap)) |
634 |
|
authenticated = &NoAuth; |
635 |
|
validuser = result; |
636 |
} |
} |
637 |
|
|
638 |
/* ARGSUSED */ |
/* ARGSUSED */ |
639 |
static void |
static RETSIGTYPE |
640 |
auth_intr(sig) |
auth_intr (int sig ARG_UNUSED) |
|
int sig; |
|
641 |
{ |
{ |
642 |
auth_finished(0, AUTH_REJECT); |
auth_finished (0, AUTH_REJECT); |
643 |
} |
} |
644 |
|
|
645 |
int |
int |
646 |
auth_wait(name) |
auth_wait (char *name) |
|
char *name; |
|
647 |
{ |
{ |
648 |
if (auth_debug_mode) |
if (auth_debug_mode) |
649 |
printf(">>>%s: in auth_wait.\r\n", Name); |
printf (">>>%s: in auth_wait.\r\n", Name); |
650 |
|
|
651 |
if (Server && !authenticating) |
if (Server && !authenticating) |
652 |
return(0); |
return (0); |
653 |
|
|
654 |
(void) signal(SIGALRM, auth_intr); |
signal (SIGALRM, auth_intr); |
655 |
alarm(30); |
alarm (30); |
656 |
while (!authenticated) |
while (!authenticated) |
657 |
if (telnet_spin()) |
if (telnet_spin ()) |
658 |
break; |
break; |
659 |
alarm(0); |
alarm (0); |
660 |
(void) signal(SIGALRM, SIG_DFL); |
signal (SIGALRM, SIG_DFL); |
661 |
|
|
662 |
/* |
/* |
663 |
* Now check to see if the user is valid or not |
* Now check to see if the user is valid or not |
664 |
*/ |
*/ |
665 |
if (!authenticated || authenticated == &NoAuth) |
if (!authenticated || authenticated == &NoAuth) |
666 |
return(AUTH_REJECT); |
return (AUTH_REJECT); |
667 |
|
|
668 |
if (validuser == AUTH_VALID) |
if (validuser == AUTH_VALID) |
669 |
validuser = AUTH_USER; |
validuser = AUTH_USER; |
670 |
|
|
671 |
if (authenticated->status) |
if (authenticated->status) |
672 |
validuser = (*authenticated->status)(authenticated, |
validuser = (*authenticated->status) (authenticated, name, validuser); |
673 |
name, validuser); |
return (validuser); |
|
return(validuser); |
|
674 |
} |
} |
675 |
|
|
676 |
void |
void |
677 |
auth_debug(mode) |
auth_debug (int mode) |
|
int mode; |
|
678 |
{ |
{ |
679 |
auth_debug_mode = mode; |
auth_debug_mode = mode; |
680 |
} |
} |
681 |
|
|
682 |
void |
void |
683 |
auth_printsub(data, cnt, buf, buflen) |
auth_printsub (unsigned char *data, int cnt, unsigned char *buf, int buflen) |
|
unsigned char *data, *buf; |
|
|
int cnt, buflen; |
|
684 |
{ |
{ |
685 |
TN_Authenticator *ap; |
TN_Authenticator *ap; |
686 |
|
|
687 |
if ((ap = findauthenticator(data[1], data[2])) && ap->printsub) |
if ((ap = findauthenticator (data[1], data[2])) && ap->printsub) |
688 |
(*ap->printsub)(data, cnt, buf, buflen); |
(*ap->printsub) (data, cnt, buf, buflen); |
689 |
else |
else |
690 |
auth_gen_printsub(data, cnt, buf, buflen); |
auth_gen_printsub (data, cnt, buf, buflen); |
691 |
} |
} |
692 |
|
|
693 |
void |
void |
694 |
auth_gen_printsub(data, cnt, buf, buflen) |
auth_gen_printsub (unsigned char *data, int cnt, unsigned char *buf, |
695 |
unsigned char *data, *buf; |
int buflen) |
|
int cnt, buflen; |
|
696 |
{ |
{ |
697 |
register unsigned char *cp; |
register unsigned char *cp; |
698 |
unsigned char tbuf[16]; |
unsigned char tbuf[16]; |
699 |
|
|
700 |
cnt -= 3; |
cnt -= 3; |
701 |
data += 3; |
data += 3; |
702 |
buf[buflen-1] = '\0'; |
buf[buflen - 1] = '\0'; |
703 |
buf[buflen-2] = '*'; |
buf[buflen - 2] = '*'; |
704 |
buflen -= 2; |
buflen -= 2; |
705 |
for (; cnt > 0; cnt--, data++) { |
for (; cnt > 0; cnt--, data++) |
706 |
sprintf((char *)tbuf, " %d", *data); |
{ |
707 |
for (cp = tbuf; *cp && buflen > 0; --buflen) |
sprintf ((char *) tbuf, " %d", *data); |
708 |
*buf++ = *cp++; |
for (cp = tbuf; *cp && buflen > 0; --buflen) |
709 |
if (buflen <= 0) |
*buf++ = *cp++; |
710 |
return; |
if (buflen <= 0) |
711 |
} |
return; |
712 |
*buf = '\0'; |
} |
713 |
|
*buf = '\0'; |
714 |
} |
} |
715 |
#endif |
#endif |