===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/sshconnect2.c,v
retrieving revision 1.124.2.2
retrieving revision 1.125
diff -u -r1.124.2.2 -r1.125
--- src/usr.bin/ssh/sshconnect2.c	2004/08/19 22:37:33	1.124.2.2
+++ src/usr.bin/ssh/sshconnect2.c	2003/10/07 01:47:27	1.125
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.124.2.2 2004/08/19 22:37:33 brad Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.125 2003/10/07 01:47:27 dtucker Exp $");
 
 #include "ssh.h"
 #include "ssh2.h"
@@ -41,7 +41,7 @@
 #include "authfd.h"
 #include "log.h"
 #include "readconf.h"
-#include "misc.h"
+#include "readpass.h"
 #include "match.h"
 #include "dispatch.h"
 #include "canohost.h"
@@ -118,7 +118,6 @@
 	/* start key exchange */
 	kex = kex_setup(myproposal);
 	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
-	kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
 	kex->client_version_string=client_version_string;
 	kex->server_version_string=server_version_string;
@@ -221,7 +220,7 @@
 
 Authmethod authmethods[] = {
 #ifdef GSSAPI
-	{"gssapi-with-mic",
+	{"gssapi",
 		userauth_gssapi,
 		&options.gss_authentication,
 		NULL},
@@ -357,7 +356,6 @@
 input_userauth_banner(int type, u_int32_t seq, void *ctxt)
 {
 	char *msg, *lang;
-
 	debug3("input_userauth_banner");
 	msg = packet_get_string(NULL);
 	lang = packet_get_string(NULL);
@@ -373,14 +371,10 @@
 	Authctxt *authctxt = ctxt;
 	if (authctxt == NULL)
 		fatal("input_userauth_success: no authentication context");
-	if (authctxt->authlist) {
+	if (authctxt->authlist)
 		xfree(authctxt->authlist);
-		authctxt->authlist = NULL;
-	}
-	if (authctxt->methoddata) {
+	if (authctxt->methoddata)
 		xfree(authctxt->methoddata);
-		authctxt->methoddata = NULL;
-	}
 	authctxt->success = 1;			/* break out */
 }
 
@@ -452,12 +446,7 @@
 	debug2("input_userauth_pk_ok: fp %s", fp);
 	xfree(fp);
 
-	/*
-	 * search keys in the reverse order, because last candidate has been
-	 * moved to the end of the queue.  this also avoids confusion by
-	 * duplicate keys
-	 */
-	TAILQ_FOREACH_REVERSE(id, &authctxt->keys, next, idlist) {
+	TAILQ_FOREACH(id, &authctxt->keys, next) {
 		if (key_equal(key, id->key)) {
 			sent = sign_and_send_pubkey(authctxt, id);
 			break;
@@ -475,11 +464,11 @@
 }
 
 #ifdef GSSAPI
-int
+int 
 userauth_gssapi(Authctxt *authctxt)
 {
 	Gssctxt *gssctxt = NULL;
-	static gss_OID_set gss_supported = NULL;
+	static gss_OID_set supported = NULL;
 	static int mech = 0;
 	OM_uint32 min;
 	int ok = 0;
@@ -487,18 +476,18 @@
 	/* Try one GSSAPI method at a time, rather than sending them all at
 	 * once. */
 
-	if (gss_supported == NULL)
-		gss_indicate_mechs(&min, &gss_supported);
+	if (supported == NULL)
+		gss_indicate_mechs(&min, &supported);
 
 	/* Check to see if the mechanism is usable before we offer it */
-	while (mech < gss_supported->count && !ok) {
+	while (mech<supported->count && !ok) {
 		if (gssctxt)
 			ssh_gssapi_delete_ctx(&gssctxt);
 		ssh_gssapi_build_ctx(&gssctxt);
-		ssh_gssapi_set_oid(gssctxt, &gss_supported->elements[mech]);
+		ssh_gssapi_set_oid(gssctxt, &supported->elements[mech]);
 
 		/* My DER encoding requires length<128 */
-		if (gss_supported->elements[mech].length < 128 &&
+		if (supported->elements[mech].length < 128 &&
 		    !GSS_ERROR(ssh_gssapi_import_name(gssctxt,
 		    authctxt->host))) {
 			ok = 1; /* Mechanism works */
@@ -518,11 +507,17 @@
 
 	packet_put_int(1);
 
-	packet_put_int((gss_supported->elements[mech].length) + 2);
-	packet_put_char(SSH_GSS_OIDTYPE);
-	packet_put_char(gss_supported->elements[mech].length);
-	packet_put_raw(gss_supported->elements[mech].elements,
-	    gss_supported->elements[mech].length);
+	/* Some servers encode the OID incorrectly (as we used to) */
+	if (datafellows & SSH_BUG_GSSAPI_BER) {
+		packet_put_string(supported->elements[mech].elements,
+		    supported->elements[mech].length);
+	} else {
+		packet_put_int((supported->elements[mech].length)+2);
+		packet_put_char(SSH_GSS_OIDTYPE);
+		packet_put_char(supported->elements[mech].length);
+		packet_put_raw(supported->elements[mech].elements,
+		    supported->elements[mech].length);
+	}
 
 	packet_send();
 
@@ -536,66 +531,15 @@
 	return 1;
 }
 
-static OM_uint32
-process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
-{
-	Authctxt *authctxt = ctxt;
-	Gssctxt *gssctxt = authctxt->methoddata;
-	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-	gss_buffer_desc gssbuf, mic;
-	OM_uint32 status, ms, flags;
-	Buffer b;
-
-	status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
-	    recv_tok, &send_tok, &flags);
-
-	if (send_tok.length > 0) {
-		if (GSS_ERROR(status))
-			packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
-		else
-			packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
-
-		packet_put_string(send_tok.value, send_tok.length);
-		packet_send();
-		gss_release_buffer(&ms, &send_tok);
-	}
-
-	if (status == GSS_S_COMPLETE) {
-		/* send either complete or MIC, depending on mechanism */
-		if (!(flags & GSS_C_INTEG_FLAG)) {
-			packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
-			packet_send();
-		} else {
-			ssh_gssapi_buildmic(&b, authctxt->server_user,
-			    authctxt->service, "gssapi-with-mic");
-
-			gssbuf.value = buffer_ptr(&b);
-			gssbuf.length = buffer_len(&b);
-
-			status = ssh_gssapi_sign(gssctxt, &gssbuf, &mic);
-
-			if (!GSS_ERROR(status)) {
-				packet_start(SSH2_MSG_USERAUTH_GSSAPI_MIC);
-				packet_put_string(mic.value, mic.length);
-
-				packet_send();
-			}
-
-			buffer_free(&b);
-			gss_release_buffer(&ms, &mic);
-		}
-	}
-
-	return status;
-}
-
 void
 input_gssapi_response(int type, u_int32_t plen, void *ctxt)
 {
 	Authctxt *authctxt = ctxt;
 	Gssctxt *gssctxt;
+	OM_uint32 status, ms;
 	int oidlen;
 	char *oidv;
+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 
 	if (authctxt == NULL)
 		fatal("input_gssapi_response: no authentication context");
@@ -604,55 +548,94 @@
 	/* Setup our OID */
 	oidv = packet_get_string(&oidlen);
 
-	if (oidlen <= 2 ||
-	    oidv[0] != SSH_GSS_OIDTYPE ||
-	    oidv[1] != oidlen - 2) {
-		xfree(oidv);
-		debug("Badly encoded mechanism OID received");
-		userauth(authctxt, NULL);
-		return;
+	if (datafellows & SSH_BUG_GSSAPI_BER) {
+		if (!ssh_gssapi_check_oid(gssctxt, oidv, oidlen))
+			fatal("Server returned different OID than expected");
+	} else {
+		if(oidv[0] != SSH_GSS_OIDTYPE || oidv[1] != oidlen-2) {
+			debug("Badly encoded mechanism OID received");
+			userauth(authctxt, NULL);
+			xfree(oidv);
+			return;
+		}
+		if (!ssh_gssapi_check_oid(gssctxt, oidv+2, oidlen-2))
+			fatal("Server returned different OID than expected");
 	}
 
-	if (!ssh_gssapi_check_oid(gssctxt, oidv + 2, oidlen - 2))
-		fatal("Server returned different OID than expected");
-
 	packet_check_eom();
 
 	xfree(oidv);
 
-	if (GSS_ERROR(process_gssapi_token(ctxt, GSS_C_NO_BUFFER))) {
+	status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
+	    GSS_C_NO_BUFFER, &send_tok, NULL);
+	if (GSS_ERROR(status)) {
+		if (send_tok.length > 0) {
+			packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
+			packet_put_string(send_tok.value, send_tok.length);
+			packet_send();
+			gss_release_buffer(&ms, &send_tok);
+		}
 		/* Start again with next method on list */
 		debug("Trying to start again");
 		userauth(authctxt, NULL);
 		return;
 	}
+
+	/* We must have data to send */
+	packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
+	packet_put_string(send_tok.value, send_tok.length);
+	packet_send();
+	gss_release_buffer(&ms, &send_tok);
 }
 
 void
 input_gssapi_token(int type, u_int32_t plen, void *ctxt)
 {
 	Authctxt *authctxt = ctxt;
+	Gssctxt *gssctxt;
+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 	gss_buffer_desc recv_tok;
-	OM_uint32 status;
+	OM_uint32 status, ms;
 	u_int slen;
 
 	if (authctxt == NULL)
 		fatal("input_gssapi_response: no authentication context");
+	gssctxt = authctxt->methoddata;
 
 	recv_tok.value = packet_get_string(&slen);
 	recv_tok.length = slen;	/* safe typecast */
 
 	packet_check_eom();
 
-	status = process_gssapi_token(ctxt, &recv_tok);
+	status=ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
+	    &recv_tok, &send_tok, NULL);
 
 	xfree(recv_tok.value);
 
 	if (GSS_ERROR(status)) {
+		if (send_tok.length > 0) {
+			packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
+			packet_put_string(send_tok.value, send_tok.length);
+			packet_send();
+			gss_release_buffer(&ms, &send_tok);
+		}
 		/* Start again with the next method in the list */
 		userauth(authctxt, NULL);
 		return;
 	}
+
+	if (send_tok.length > 0) {
+		packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
+		packet_put_string(send_tok.value, send_tok.length);
+		packet_send();
+		gss_release_buffer(&ms, &send_tok);
+	}
+
+	if (status == GSS_S_COMPLETE) {
+		/* If that succeeded, send a exchange complete message */
+		packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
+		packet_send();
+	}
 }
 
 void
@@ -1032,7 +1015,7 @@
 		    key = ssh_get_next_identity(ac, &comment, 2)) {
 			found = 0;
 			TAILQ_FOREACH(id, &files, next) {
-				/* agent keys from the config file are preferred */
+				/* agent keys from the config file are preferred */ 
 				if (key_equal(key, id->key)) {
 					key_free(key);
 					xfree(comment);
@@ -1043,7 +1026,7 @@
 					break;
 				}
 			}
-			if (!found && !options.identities_only) {
+			if (!found) {
 				id = xmalloc(sizeof(*id));
 				memset(id, 0, sizeof(*id));
 				id->key = key;
@@ -1096,7 +1079,6 @@
 	while ((id = TAILQ_FIRST(&authctxt->keys))) {
 		if (id->tried++)
 			return (0);
-		/* move key to the end of the queue */
 		TAILQ_REMOVE(&authctxt->keys, id, next);
 		TAILQ_INSERT_TAIL(&authctxt->keys, id, next);
 		/*
@@ -1261,12 +1243,11 @@
 	buffer_init(&b);
 	buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
 	buffer_put_string(&b, data, datalen);
-	if (ssh_msg_send(to[1], version, &b) == -1)
-		fatal("ssh_keysign: couldn't send request");
+	ssh_msg_send(to[1], version, &b);
 
 	if (ssh_msg_recv(from[0], &b) < 0) {
 		error("ssh_keysign: no reply");
-		buffer_free(&b);
+		buffer_clear(&b);
 		return -1;
 	}
 	close(from[0]);
@@ -1278,11 +1259,11 @@
 
 	if (buffer_get_char(&b) != version) {
 		error("ssh_keysign: bad version");
-		buffer_free(&b);
+		buffer_clear(&b);
 		return -1;
 	}
 	*sigp = buffer_get_string(&b, lenp);
-	buffer_free(&b);
+	buffer_clear(&b);
 
 	return 0;
 }