1 /* $NetBSD: auth2-krb5.c,v 1.11 2024/07/08 22:33:43 christos Exp $ */
2 /*
3 * Copyright (c) 2003 Markus Friedl. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include "includes.h"
27 __RCSID("$NetBSD: auth2-krb5.c,v 1.11 2024/07/08 22:33:43 christos Exp $");
28
29 #include <krb5.h>
30 #include <stdio.h>
31
32 #include "ssh2.h"
33 #include "xmalloc.h"
34 #include "packet.h"
35 #include "log.h"
36 #include "hostfile.h"
37 #include "auth.h"
38 #ifdef GSSAPI
39 #include "ssh-gss.h"
40 #endif
41 #include "ssherr.h"
42 #include "monitor_wrap.h"
43 #include "misc.h"
44 #include "servconf.h"
45
46 /* import */
47 extern ServerOptions options;
48 extern struct authmethod_cfg methodcfg_krb5;
49
50 static int
userauth_kerberos(struct ssh * ssh,const char * method)51 userauth_kerberos(struct ssh *ssh, const char *method)
52 {
53 krb5_data tkt, reply;
54 size_t dlen;
55 char *passwd;
56 char *client = NULL;
57 int authenticated = 0, r;
58
59 if ((r = sshpkt_get_cstring(ssh, &passwd, &dlen)) != 0 ||
60 (r = sshpkt_get_end(ssh)) != 0)
61 fatal("%s: %s", __func__, ssh_err(r));
62
63 tkt.data = passwd;
64 tkt.length = dlen;
65 if (mm_auth_krb5(ssh, &tkt, &client, &reply)) {
66 authenticated = 1;
67 if (reply.length)
68 free(reply.data);
69 }
70 if (client)
71 free(client);
72 free(tkt.data);
73 return (authenticated);
74 }
75
76 Authmethod method_kerberos = {
77 &methodcfg_krb5,
78 userauth_kerberos,
79 };
80