40 |
#include "auth.h" |
#include "auth.h" |
41 |
#include "misc.h" |
#include "misc.h" |
42 |
|
|
43 |
|
#ifdef ENCRYPTION |
44 |
|
#include "encrypt.h" |
45 |
|
#endif |
46 |
|
|
47 |
|
Shishi_key *enckey = NULL; |
48 |
|
|
49 |
static unsigned char str_data[2048] = { IAC, SB, TELOPT_AUTHENTICATION, 0, |
static unsigned char str_data[2048] = { IAC, SB, TELOPT_AUTHENTICATION, 0, |
50 |
AUTHTYPE_KERBEROS_V5, |
AUTHTYPE_KERBEROS_V5, |
51 |
}; |
}; |
94 |
return (net_write (str_data, p - str_data)); |
return (net_write (str_data, p - str_data)); |
95 |
} |
} |
96 |
|
|
97 |
|
Shishi * shishi_telnet = NULL; |
98 |
|
|
99 |
/* FIXME: Reverse return code! */ |
/* FIXME: Reverse return code! */ |
100 |
int |
int |
101 |
krb5shishi_init (TN_Authenticator * ap, int server) |
krb5shishi_init (TN_Authenticator * ap, int server) |
179 |
return 0; |
return 0; |
180 |
} |
} |
181 |
|
|
182 |
|
#ifdef ENCRYPTION |
183 |
|
if (enckey) |
184 |
|
{ |
185 |
|
shishi_key_done (enckey); |
186 |
|
enckey = NULL; |
187 |
|
} |
188 |
|
|
189 |
|
rc = shishi_authenticator_get_subkey (shishi_handle, shishi_ap_authenticator (auth_handle), &enckey); |
190 |
|
if ((rc != SHISHI_OK) || ((shishi_key_type (enckey) != SHISHI_DES_CBC_CRC) && |
191 |
|
(shishi_key_type (enckey) != SHISHI_DES_CBC_MD5))) |
192 |
|
{ |
193 |
|
DEBUG (("telnet: Kerberos V5: could get encryption key (%s)\r\n", |
194 |
|
shishi_strerror (rc))); |
195 |
|
return 0; |
196 |
|
} |
197 |
|
#endif |
198 |
|
|
199 |
rc = shishi_ap_req_der (auth_handle, &apreq, &apreq_len); |
rc = shishi_ap_req_der (auth_handle, &apreq, &apreq_len); |
200 |
if (rc != SHISHI_OK) |
if (rc != SHISHI_OK) |
201 |
{ |
{ |
230 |
return 1; |
return 1; |
231 |
} |
} |
232 |
|
|
233 |
|
#ifdef ENCRYPTION |
234 |
|
void |
235 |
|
shishi_init_key (Session_Key * skey, int type) |
236 |
|
{ |
237 |
|
skey->type = SK_DES; |
238 |
|
skey->length = 8; |
239 |
|
skey->data = shishi_key_value (enckey); |
240 |
|
encrypt_session_key (skey, type); |
241 |
|
} |
242 |
|
#endif |
243 |
|
|
244 |
void |
void |
245 |
krb5shishi_reply (TN_Authenticator * ap, unsigned char *data, int cnt) |
krb5shishi_reply (TN_Authenticator * ap, unsigned char *data, int cnt) |
246 |
{ |
{ |
247 |
static int mutual_complete = 0; |
static int mutual_complete = 0; |
248 |
|
#ifdef ENCRYPTION |
249 |
|
Session_Key skey; |
250 |
|
#endif |
251 |
|
|
252 |
if (cnt-- < 1) |
if (cnt-- < 1) |
253 |
return; |
return; |
273 |
auth_send_retry (); |
auth_send_retry (); |
274 |
break; |
break; |
275 |
} |
} |
276 |
|
#ifdef ENCRYPTION |
277 |
|
shishi_init_key (&skey, 0); |
278 |
|
#endif |
279 |
} |
} |
280 |
|
|
281 |
if (cnt) |
if (cnt) |
306 |
(auth_handle)); |
(auth_handle)); |
307 |
} |
} |
308 |
|
|
309 |
|
#ifdef ENCRYPTION |
310 |
|
shishi_init_key (&skey, 0); |
311 |
|
#endif |
312 |
mutual_complete = 1; |
mutual_complete = 1; |
313 |
} |
} |
314 |
break; |
break; |
315 |
|
|
316 |
default: |
default: |
317 |
DEBUG (("Unknown Kerberos option %d\r\n", data[-1])); |
DEBUG (("Unknown Kerberos option %d\r\n", data[-1])); |
318 |
} |
} |
319 |
} |
} |
320 |
|
|
321 |
int |
int |
333 |
(shishi_handle, shishi_tkt_encticketpart (shishi_ap_tkt (auth_handle)), |
(shishi_handle, shishi_tkt_encticketpart (shishi_ap_tkt (auth_handle)), |
334 |
cname, &cnamelen); |
cname, &cnamelen); |
335 |
|
|
336 |
if (UserNameRequested && rc == SHISHI_OK && |
if (UserNameRequested && rc == SHISHI_OK && |
337 |
cnamelen == strlen (UserNameRequested) && |
cnamelen == strlen (UserNameRequested) && |
338 |
memcmp (UserNameRequested, cname, cnamelen) == 0) |
memcmp (UserNameRequested, cname, cnamelen) == 0) |
339 |
{ |
{ |
353 |
int rc; |
int rc; |
354 |
char cnamerealm[BUFSIZ]; |
char cnamerealm[BUFSIZ]; |
355 |
int cnamerealmlen; |
int cnamerealmlen; |
356 |
|
#ifdef ENCRYPTION |
357 |
|
Session_Key skey; |
358 |
|
#endif |
359 |
|
|
360 |
rc = shishi_ap (shishi_handle, &auth_handle); |
rc = shishi_ap (shishi_handle, &auth_handle); |
361 |
if (rc != SHISHI_OK) |
if (rc != SHISHI_OK) |
428 |
return 1; |
return 1; |
429 |
} |
} |
430 |
cnamerealm[cnamerealmlen] = '\0'; |
cnamerealm[cnamerealmlen] = '\0'; |
|
|
|
431 |
Data (a, KRB_ACCEPT, cnamerealm, cnamerealm ? -1 : 0); |
Data (a, KRB_ACCEPT, cnamerealm, cnamerealm ? -1 : 0); |
432 |
DEBUG (("telnetd: Kerberos5 identifies him as ``%s''\r\n", |
DEBUG (("telnetd: Kerberos5 identifies him as ``%s''\r\n", |
433 |
cnamerealm ? cnamerealm : "")); |
cnamerealm ? cnamerealm : "")); |
434 |
|
|
435 |
auth_finished (a, AUTH_USER); |
auth_finished (a, AUTH_USER); |
436 |
|
|
437 |
|
#ifdef ENCRYPTION |
438 |
|
if (enckey) |
439 |
|
{ |
440 |
|
shishi_key_done (enckey); |
441 |
|
enckey = NULL; |
442 |
|
} |
443 |
|
|
444 |
|
rc = shishi_authenticator_get_subkey (shishi_handle, shishi_ap_authenticator (auth_handle), &enckey); |
445 |
|
if ((rc != SHISHI_OK) || ((shishi_key_type (enckey) != SHISHI_DES_CBC_CRC) && |
446 |
|
(shishi_key_type (enckey) != SHISHI_DES_CBC_MD5))) |
447 |
|
{ |
448 |
|
Shishi_tkt * tkt; |
449 |
|
|
450 |
|
tkt = shishi_ap_tkt (auth_handle); |
451 |
|
if (tkt == NULL) |
452 |
|
{ |
453 |
|
snprintf (errbuf, errbuflen, "telnet: Kerberos V5: could get encryption key (%s)\r\n", |
454 |
|
shishi_strerror (rc)); |
455 |
|
return 1; |
456 |
|
} |
457 |
|
|
458 |
|
rc = shishi_encticketpart_get_key (shishi_handle, shishi_tkt_encticketpart (tkt), &enckey); |
459 |
|
if ((rc != SHISHI_OK) || ((shishi_key_type (enckey) != SHISHI_DES_CBC_CRC) && |
460 |
|
(shishi_key_type (enckey) != SHISHI_DES_CBC_MD5))) |
461 |
|
{ |
462 |
|
snprintf (errbuf, errbuflen, "telnet: Kerberos V5: could get encryption key (%s)\r\n", |
463 |
|
shishi_strerror (rc)); |
464 |
|
return 1; |
465 |
|
} |
466 |
|
|
467 |
|
shishi_tkt_done (tkt); |
468 |
|
} |
469 |
|
|
470 |
|
shishi_init_key (&skey, 1); |
471 |
|
#endif |
472 |
|
|
473 |
return 0; |
return 0; |
474 |
} |
} |
475 |
|
|