1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Copyright 2002 Sun Microsystems, Inc. All rights reserved.
3*0Sstevel@tonic-gate * Use is subject to license terms.
4*0Sstevel@tonic-gate */
5*0Sstevel@tonic-gate
6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
7*0Sstevel@tonic-gate
8*0Sstevel@tonic-gate /*
9*0Sstevel@tonic-gate * usr/src/cmd/cmd-inet/usr.bin/telnet/auth.c
10*0Sstevel@tonic-gate */
11*0Sstevel@tonic-gate
12*0Sstevel@tonic-gate /*
13*0Sstevel@tonic-gate * Copyright (c) 1991, 1993
14*0Sstevel@tonic-gate * The Regents of the University of California. All rights reserved.
15*0Sstevel@tonic-gate *
16*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
17*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
18*0Sstevel@tonic-gate * are met:
19*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
20*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
21*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
22*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
23*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
24*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software
25*0Sstevel@tonic-gate * must display the following acknowledgement:
26*0Sstevel@tonic-gate * This product includes software developed by the University of
27*0Sstevel@tonic-gate * California, Berkeley and its contributors.
28*0Sstevel@tonic-gate * 4. Neither the name of the University nor the names of its contributors
29*0Sstevel@tonic-gate * may be used to endorse or promote products derived from this software
30*0Sstevel@tonic-gate * without specific prior written permission.
31*0Sstevel@tonic-gate *
32*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
33*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
34*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
35*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
36*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
37*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
38*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
39*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
40*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
41*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42*0Sstevel@tonic-gate * SUCH DAMAGE.
43*0Sstevel@tonic-gate */
44*0Sstevel@tonic-gate
45*0Sstevel@tonic-gate /* based on @(#)auth.c 8.1 (Berkeley) 6/4/93 */
46*0Sstevel@tonic-gate
47*0Sstevel@tonic-gate /*
48*0Sstevel@tonic-gate * Copyright (C) 1990 by the Massachusetts Institute of Technology
49*0Sstevel@tonic-gate *
50*0Sstevel@tonic-gate * Export of this software from the United States of America may
51*0Sstevel@tonic-gate * require a specific license from the United States Government.
52*0Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
53*0Sstevel@tonic-gate * export to obtain such a license before exporting.
54*0Sstevel@tonic-gate *
55*0Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
56*0Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
57*0Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
58*0Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
59*0Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
60*0Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
61*0Sstevel@tonic-gate * to distribution of the software without specific, written prior
62*0Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
63*0Sstevel@tonic-gate * your software as modified software and not distribute it in such a
64*0Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
65*0Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
66*0Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
67*0Sstevel@tonic-gate * or implied warranty.
68*0Sstevel@tonic-gate */
69*0Sstevel@tonic-gate
70*0Sstevel@tonic-gate
71*0Sstevel@tonic-gate #include <stdio.h>
72*0Sstevel@tonic-gate #include <sys/types.h>
73*0Sstevel@tonic-gate #include <signal.h>
74*0Sstevel@tonic-gate
75*0Sstevel@tonic-gate #define AUTHTYPE_NAMES /* this is needed for arpa/telnet.h */
76*0Sstevel@tonic-gate #include <arpa/telnet.h>
77*0Sstevel@tonic-gate
78*0Sstevel@tonic-gate #ifdef __STDC__
79*0Sstevel@tonic-gate #include <stdlib.h>
80*0Sstevel@tonic-gate #endif
81*0Sstevel@tonic-gate
82*0Sstevel@tonic-gate #include <string.h>
83*0Sstevel@tonic-gate
84*0Sstevel@tonic-gate #include "externs.h"
85*0Sstevel@tonic-gate #include "encrypt.h"
86*0Sstevel@tonic-gate #include "auth.h"
87*0Sstevel@tonic-gate
88*0Sstevel@tonic-gate #define typemask(x) ((x) > 0 ? 1 << ((x)-1) : 0)
89*0Sstevel@tonic-gate
90*0Sstevel@tonic-gate static int auth_onoff(const char *type, boolean_t on);
91*0Sstevel@tonic-gate static void auth_gen_printsub(uchar_t *, uint_t, uchar_t *, uint_t);
92*0Sstevel@tonic-gate
93*0Sstevel@tonic-gate boolean_t auth_debug_mode = B_FALSE;
94*0Sstevel@tonic-gate boolean_t auth_has_failed = B_FALSE;
95*0Sstevel@tonic-gate boolean_t auth_enable_encrypt = B_FALSE;
96*0Sstevel@tonic-gate
97*0Sstevel@tonic-gate static char *Name = "Noname";
98*0Sstevel@tonic-gate static Authenticator *authenticated = NULL;
99*0Sstevel@tonic-gate static uchar_t _auth_send_data[BUFSIZ];
100*0Sstevel@tonic-gate static uchar_t *auth_send_data;
101*0Sstevel@tonic-gate static int auth_send_cnt = 0;
102*0Sstevel@tonic-gate
103*0Sstevel@tonic-gate /*
104*0Sstevel@tonic-gate * Authentication types supported. Note that these are stored
105*0Sstevel@tonic-gate * in priority order, i.e. try the first one first.
106*0Sstevel@tonic-gate */
107*0Sstevel@tonic-gate static Authenticator authenticators[] = {
108*0Sstevel@tonic-gate { AUTHTYPE_KERBEROS_V5,
109*0Sstevel@tonic-gate AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL|AUTH_ENCRYPT_ON,
110*0Sstevel@tonic-gate kerberos5_init,
111*0Sstevel@tonic-gate kerberos5_send,
112*0Sstevel@tonic-gate kerberos5_reply,
113*0Sstevel@tonic-gate kerberos5_status,
114*0Sstevel@tonic-gate kerberos5_printsub },
115*0Sstevel@tonic-gate { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
116*0Sstevel@tonic-gate kerberos5_init,
117*0Sstevel@tonic-gate kerberos5_send,
118*0Sstevel@tonic-gate kerberos5_reply,
119*0Sstevel@tonic-gate kerberos5_status,
120*0Sstevel@tonic-gate kerberos5_printsub },
121*0Sstevel@tonic-gate { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
122*0Sstevel@tonic-gate kerberos5_init,
123*0Sstevel@tonic-gate kerberos5_send,
124*0Sstevel@tonic-gate kerberos5_reply,
125*0Sstevel@tonic-gate kerberos5_status,
126*0Sstevel@tonic-gate kerberos5_printsub },
127*0Sstevel@tonic-gate { 0, },
128*0Sstevel@tonic-gate };
129*0Sstevel@tonic-gate
130*0Sstevel@tonic-gate static Authenticator NoAuth = { 0 };
131*0Sstevel@tonic-gate
132*0Sstevel@tonic-gate static uint_t i_support = 0;
133*0Sstevel@tonic-gate static uint_t i_wont_support = 0;
134*0Sstevel@tonic-gate
135*0Sstevel@tonic-gate /*
136*0Sstevel@tonic-gate * Traverse the Authenticator array until we find the authentication type
137*0Sstevel@tonic-gate * and matching direction we are looking for. Return a pointer into the
138*0Sstevel@tonic-gate * Authenticator type array.
139*0Sstevel@tonic-gate *
140*0Sstevel@tonic-gate * Returns: 0 - type not found (error)
141*0Sstevel@tonic-gate * nonzero - pointer to authenticator
142*0Sstevel@tonic-gate */
143*0Sstevel@tonic-gate static Authenticator *
findauthenticator(int type,int way)144*0Sstevel@tonic-gate findauthenticator(int type, int way)
145*0Sstevel@tonic-gate {
146*0Sstevel@tonic-gate Authenticator *ap = authenticators;
147*0Sstevel@tonic-gate
148*0Sstevel@tonic-gate while (ap->type && (ap->type != type || ap->way != way))
149*0Sstevel@tonic-gate ++ap;
150*0Sstevel@tonic-gate return (ap->type ? ap : NULL);
151*0Sstevel@tonic-gate }
152*0Sstevel@tonic-gate
153*0Sstevel@tonic-gate /*
154*0Sstevel@tonic-gate * For each authentication type in the Authenticator array,
155*0Sstevel@tonic-gate * call the associated init routine, and update the i_support bitfield.
156*0Sstevel@tonic-gate */
157*0Sstevel@tonic-gate void
auth_init(const char * name)158*0Sstevel@tonic-gate auth_init(const char *name)
159*0Sstevel@tonic-gate {
160*0Sstevel@tonic-gate Authenticator *ap = authenticators;
161*0Sstevel@tonic-gate
162*0Sstevel@tonic-gate Name = name ? strdup(name) : "Noname";
163*0Sstevel@tonic-gate
164*0Sstevel@tonic-gate i_support = 0;
165*0Sstevel@tonic-gate authenticated = NULL;
166*0Sstevel@tonic-gate while (ap->type) {
167*0Sstevel@tonic-gate if (!ap->init || (*ap->init)(ap)) {
168*0Sstevel@tonic-gate i_support |= typemask(ap->type);
169*0Sstevel@tonic-gate if (auth_debug_mode)
170*0Sstevel@tonic-gate (void) printf(gettext
171*0Sstevel@tonic-gate (">>>%s: I support auth type %d %d\r\n"),
172*0Sstevel@tonic-gate Name, ap->type, ap->way);
173*0Sstevel@tonic-gate }
174*0Sstevel@tonic-gate ++ap;
175*0Sstevel@tonic-gate }
176*0Sstevel@tonic-gate }
177*0Sstevel@tonic-gate
178*0Sstevel@tonic-gate /*
179*0Sstevel@tonic-gate * Search the Authenticator array for the authentication type 'name',
180*0Sstevel@tonic-gate * and disable this type by updating the i_wont_support bitfield.
181*0Sstevel@tonic-gate */
182*0Sstevel@tonic-gate void
auth_disable_name(const char * name)183*0Sstevel@tonic-gate auth_disable_name(const char *name)
184*0Sstevel@tonic-gate {
185*0Sstevel@tonic-gate uint_t x;
186*0Sstevel@tonic-gate for (x = 0; x < AUTHTYPE_CNT; ++x) {
187*0Sstevel@tonic-gate if (!strcasecmp(name, AUTHTYPE_NAME(x))) {
188*0Sstevel@tonic-gate i_wont_support |= typemask(x);
189*0Sstevel@tonic-gate break;
190*0Sstevel@tonic-gate }
191*0Sstevel@tonic-gate }
192*0Sstevel@tonic-gate
193*0Sstevel@tonic-gate if (!i_wont_support)
194*0Sstevel@tonic-gate (void) printf(
195*0Sstevel@tonic-gate gettext("%s : invalid authentication type\n"),
196*0Sstevel@tonic-gate name);
197*0Sstevel@tonic-gate }
198*0Sstevel@tonic-gate
199*0Sstevel@tonic-gate /*
200*0Sstevel@tonic-gate * Search the Authenticator array for the authentication type given
201*0Sstevel@tonic-gate * by the character string 'type', and return its integer bitmask
202*0Sstevel@tonic-gate * in maskp.
203*0Sstevel@tonic-gate *
204*0Sstevel@tonic-gate * Returns: 1 - no error
205*0Sstevel@tonic-gate * 0 - type not found (error)
206*0Sstevel@tonic-gate */
207*0Sstevel@tonic-gate static int
getauthmask(const char * type,uint_t * maskp)208*0Sstevel@tonic-gate getauthmask(const char *type, uint_t *maskp)
209*0Sstevel@tonic-gate {
210*0Sstevel@tonic-gate uint_t x;
211*0Sstevel@tonic-gate
212*0Sstevel@tonic-gate if (!strcasecmp(type, AUTHTYPE_NAME(0))) {
213*0Sstevel@tonic-gate *maskp = (uint_t)-1;
214*0Sstevel@tonic-gate return (1);
215*0Sstevel@tonic-gate }
216*0Sstevel@tonic-gate
217*0Sstevel@tonic-gate for (x = 1; x < AUTHTYPE_CNT; ++x) {
218*0Sstevel@tonic-gate if (!strcasecmp(type, AUTHTYPE_NAME(x))) {
219*0Sstevel@tonic-gate *maskp = typemask(x);
220*0Sstevel@tonic-gate return (1);
221*0Sstevel@tonic-gate }
222*0Sstevel@tonic-gate }
223*0Sstevel@tonic-gate return (0);
224*0Sstevel@tonic-gate }
225*0Sstevel@tonic-gate
226*0Sstevel@tonic-gate int
auth_enable(char * type)227*0Sstevel@tonic-gate auth_enable(char *type)
228*0Sstevel@tonic-gate {
229*0Sstevel@tonic-gate return (auth_onoff(type, B_TRUE));
230*0Sstevel@tonic-gate }
231*0Sstevel@tonic-gate
232*0Sstevel@tonic-gate int
auth_disable(char * type)233*0Sstevel@tonic-gate auth_disable(char *type)
234*0Sstevel@tonic-gate {
235*0Sstevel@tonic-gate return (auth_onoff(type, B_FALSE));
236*0Sstevel@tonic-gate }
237*0Sstevel@tonic-gate
238*0Sstevel@tonic-gate /*
239*0Sstevel@tonic-gate * Responds to the 'auth enable <option>' and 'auth disable <option>' commands.
240*0Sstevel@tonic-gate *
241*0Sstevel@tonic-gate * If <option> is:
242*0Sstevel@tonic-gate * - a valid authentication type, turns support on / off
243*0Sstevel@tonic-gate * - "?" or "help", print a usage message
244*0Sstevel@tonic-gate * - not recognized, print an error message.
245*0Sstevel@tonic-gate *
246*0Sstevel@tonic-gate * Returns: 1 - no error, authentication is enabled or disabled
247*0Sstevel@tonic-gate * 0 - error, or help requested
248*0Sstevel@tonic-gate */
249*0Sstevel@tonic-gate static int
auth_onoff(const char * type,boolean_t on)250*0Sstevel@tonic-gate auth_onoff(const char *type, boolean_t on)
251*0Sstevel@tonic-gate {
252*0Sstevel@tonic-gate uint_t i, mask = 0;
253*0Sstevel@tonic-gate Authenticator *ap;
254*0Sstevel@tonic-gate
255*0Sstevel@tonic-gate if (!strcasecmp(type, "?") || !strcasecmp(type, "help")) {
256*0Sstevel@tonic-gate (void) printf(on ?
257*0Sstevel@tonic-gate gettext("auth enable 'type'\n") :
258*0Sstevel@tonic-gate gettext("auth disable 'type'\n"));
259*0Sstevel@tonic-gate (void) printf(
260*0Sstevel@tonic-gate gettext("Where 'type' is one of:\n"));
261*0Sstevel@tonic-gate (void) printf("\t%s\n", AUTHTYPE_NAME(0));
262*0Sstevel@tonic-gate for (ap = authenticators; ap->type; ap++) {
263*0Sstevel@tonic-gate if ((mask & (i = typemask(ap->type))) != 0)
264*0Sstevel@tonic-gate continue;
265*0Sstevel@tonic-gate mask |= i;
266*0Sstevel@tonic-gate (void) printf("\t%s\n", AUTHTYPE_NAME(ap->type));
267*0Sstevel@tonic-gate }
268*0Sstevel@tonic-gate return (0);
269*0Sstevel@tonic-gate }
270*0Sstevel@tonic-gate
271*0Sstevel@tonic-gate if (!getauthmask(type, &mask)) {
272*0Sstevel@tonic-gate (void) printf(
273*0Sstevel@tonic-gate gettext("%s: invalid authentication type\n"), type);
274*0Sstevel@tonic-gate return (0);
275*0Sstevel@tonic-gate }
276*0Sstevel@tonic-gate if (on)
277*0Sstevel@tonic-gate i_wont_support &= ~mask;
278*0Sstevel@tonic-gate else
279*0Sstevel@tonic-gate i_wont_support |= mask;
280*0Sstevel@tonic-gate return (1);
281*0Sstevel@tonic-gate }
282*0Sstevel@tonic-gate
283*0Sstevel@tonic-gate /*
284*0Sstevel@tonic-gate * Responds to the 'toggle authdebug' command.
285*0Sstevel@tonic-gate *
286*0Sstevel@tonic-gate * Returns: 1 - always
287*0Sstevel@tonic-gate */
288*0Sstevel@tonic-gate int
auth_togdebug(int on)289*0Sstevel@tonic-gate auth_togdebug(int on)
290*0Sstevel@tonic-gate {
291*0Sstevel@tonic-gate if (on < 0)
292*0Sstevel@tonic-gate auth_debug_mode = !auth_debug_mode;
293*0Sstevel@tonic-gate else
294*0Sstevel@tonic-gate auth_debug_mode = on > 0 ? B_TRUE : B_FALSE;
295*0Sstevel@tonic-gate (void) printf(auth_debug_mode ?
296*0Sstevel@tonic-gate gettext("auth debugging enabled\n") :
297*0Sstevel@tonic-gate gettext("auth debugging disabled\n"));
298*0Sstevel@tonic-gate return (1);
299*0Sstevel@tonic-gate }
300*0Sstevel@tonic-gate
301*0Sstevel@tonic-gate /*
302*0Sstevel@tonic-gate * Responds to the 'auth status' command.
303*0Sstevel@tonic-gate * Traverses the authenticator array and prints enabled or disabled for
304*0Sstevel@tonic-gate * each authentication type, depencing on the i_wont_support bitfield.
305*0Sstevel@tonic-gate *
306*0Sstevel@tonic-gate * Returns: 1 - always
307*0Sstevel@tonic-gate */
308*0Sstevel@tonic-gate int
auth_status(void)309*0Sstevel@tonic-gate auth_status(void)
310*0Sstevel@tonic-gate {
311*0Sstevel@tonic-gate Authenticator *ap;
312*0Sstevel@tonic-gate uint_t i, mask;
313*0Sstevel@tonic-gate
314*0Sstevel@tonic-gate if (i_wont_support == (uint_t)-1)
315*0Sstevel@tonic-gate (void) printf(gettext("Authentication disabled\n"));
316*0Sstevel@tonic-gate else
317*0Sstevel@tonic-gate (void) printf(gettext("Authentication enabled\n"));
318*0Sstevel@tonic-gate
319*0Sstevel@tonic-gate mask = 0;
320*0Sstevel@tonic-gate for (ap = authenticators; ap->type; ap++) {
321*0Sstevel@tonic-gate if ((mask & (i = typemask(ap->type))) != 0)
322*0Sstevel@tonic-gate continue;
323*0Sstevel@tonic-gate mask |= i;
324*0Sstevel@tonic-gate (void) printf("%s: %s\n", AUTHTYPE_NAME(ap->type),
325*0Sstevel@tonic-gate (i_wont_support & typemask(ap->type)) ?
326*0Sstevel@tonic-gate gettext("disabled") : gettext("enabled"));
327*0Sstevel@tonic-gate }
328*0Sstevel@tonic-gate return (1);
329*0Sstevel@tonic-gate }
330*0Sstevel@tonic-gate
331*0Sstevel@tonic-gate /*
332*0Sstevel@tonic-gate * This is called when an AUTH SEND is received.
333*0Sstevel@tonic-gate * data is a list of authentication mechanisms we support
334*0Sstevel@tonic-gate */
335*0Sstevel@tonic-gate void
auth_send(uchar_t * data,int cnt)336*0Sstevel@tonic-gate auth_send(uchar_t *data, int cnt)
337*0Sstevel@tonic-gate {
338*0Sstevel@tonic-gate
339*0Sstevel@tonic-gate if (auth_debug_mode) {
340*0Sstevel@tonic-gate (void) printf(gettext(">>>%s: auth_send got:"), Name);
341*0Sstevel@tonic-gate printd(data, cnt);
342*0Sstevel@tonic-gate (void) printf("\r\n");
343*0Sstevel@tonic-gate }
344*0Sstevel@tonic-gate
345*0Sstevel@tonic-gate /*
346*0Sstevel@tonic-gate * Save the list of authentication mechanisms
347*0Sstevel@tonic-gate */
348*0Sstevel@tonic-gate auth_send_cnt = cnt;
349*0Sstevel@tonic-gate if (auth_send_cnt > sizeof (_auth_send_data))
350*0Sstevel@tonic-gate auth_send_cnt = sizeof (_auth_send_data);
351*0Sstevel@tonic-gate (void) memcpy((void *)_auth_send_data, (void *)data, auth_send_cnt);
352*0Sstevel@tonic-gate auth_send_data = _auth_send_data;
353*0Sstevel@tonic-gate
354*0Sstevel@tonic-gate auth_send_retry();
355*0Sstevel@tonic-gate }
356*0Sstevel@tonic-gate
357*0Sstevel@tonic-gate /*
358*0Sstevel@tonic-gate * Try the next authentication mechanism on the list, and see if it
359*0Sstevel@tonic-gate * works.
360*0Sstevel@tonic-gate */
361*0Sstevel@tonic-gate void
auth_send_retry(void)362*0Sstevel@tonic-gate auth_send_retry(void)
363*0Sstevel@tonic-gate {
364*0Sstevel@tonic-gate Authenticator *ap;
365*0Sstevel@tonic-gate static uchar_t str_none[] = { IAC, SB, TELOPT_AUTHENTICATION,
366*0Sstevel@tonic-gate TELQUAL_IS, AUTHTYPE_NULL, 0, IAC, SE };
367*0Sstevel@tonic-gate
368*0Sstevel@tonic-gate for (; (auth_send_cnt -= 2) >= 0; auth_send_data += 2) {
369*0Sstevel@tonic-gate if (auth_debug_mode)
370*0Sstevel@tonic-gate (void) printf(
371*0Sstevel@tonic-gate gettext(">>>%s: Remote host supports %d\r\n"),
372*0Sstevel@tonic-gate Name, *auth_send_data);
373*0Sstevel@tonic-gate if (!(i_support & typemask(*auth_send_data)))
374*0Sstevel@tonic-gate continue;
375*0Sstevel@tonic-gate if (i_wont_support & typemask(*auth_send_data))
376*0Sstevel@tonic-gate continue;
377*0Sstevel@tonic-gate ap = findauthenticator(auth_send_data[0], auth_send_data[1]);
378*0Sstevel@tonic-gate if (!ap || !ap->send)
379*0Sstevel@tonic-gate continue;
380*0Sstevel@tonic-gate if ((ap->way & AUTH_ENCRYPT_MASK) && !auth_enable_encrypt)
381*0Sstevel@tonic-gate continue;
382*0Sstevel@tonic-gate
383*0Sstevel@tonic-gate if (auth_debug_mode)
384*0Sstevel@tonic-gate (void) printf(
385*0Sstevel@tonic-gate gettext(">>>%s: Trying %d %d\r\n"), Name,
386*0Sstevel@tonic-gate auth_send_data[0], auth_send_data[1]);
387*0Sstevel@tonic-gate if ((*ap->send)(ap)) {
388*0Sstevel@tonic-gate /*
389*0Sstevel@tonic-gate * Okay, we found one we like and did it. we can go
390*0Sstevel@tonic-gate * home now.
391*0Sstevel@tonic-gate */
392*0Sstevel@tonic-gate if (auth_debug_mode)
393*0Sstevel@tonic-gate (void) printf(gettext(">>>%s: Using type %d\r\n"),
394*0Sstevel@tonic-gate Name, *auth_send_data);
395*0Sstevel@tonic-gate auth_send_data += 2;
396*0Sstevel@tonic-gate return;
397*0Sstevel@tonic-gate }
398*0Sstevel@tonic-gate }
399*0Sstevel@tonic-gate (void) net_write(str_none, sizeof (str_none));
400*0Sstevel@tonic-gate printsub('>', &str_none[2], sizeof (str_none) - 2);
401*0Sstevel@tonic-gate if (auth_debug_mode)
402*0Sstevel@tonic-gate (void) printf(
403*0Sstevel@tonic-gate gettext(">>>%s: Sent failure message\r\n"), Name);
404*0Sstevel@tonic-gate auth_finished(0, AUTH_REJECT);
405*0Sstevel@tonic-gate auth_has_failed = B_TRUE;
406*0Sstevel@tonic-gate }
407*0Sstevel@tonic-gate
408*0Sstevel@tonic-gate void
auth_reply(uchar_t * data,int cnt)409*0Sstevel@tonic-gate auth_reply(uchar_t *data, int cnt)
410*0Sstevel@tonic-gate {
411*0Sstevel@tonic-gate Authenticator *ap;
412*0Sstevel@tonic-gate
413*0Sstevel@tonic-gate if (cnt < 2)
414*0Sstevel@tonic-gate return;
415*0Sstevel@tonic-gate
416*0Sstevel@tonic-gate if (ap = findauthenticator(data[0], data[1])) {
417*0Sstevel@tonic-gate if (ap->reply)
418*0Sstevel@tonic-gate (*ap->reply)(ap, data+2, cnt-2);
419*0Sstevel@tonic-gate } else if (auth_debug_mode)
420*0Sstevel@tonic-gate (void) printf(gettext
421*0Sstevel@tonic-gate (">>>%s: Invalid authentication in SEND: %d\r\n"),
422*0Sstevel@tonic-gate Name, *data);
423*0Sstevel@tonic-gate }
424*0Sstevel@tonic-gate
425*0Sstevel@tonic-gate int
auth_sendname(uchar_t * cp,int len)426*0Sstevel@tonic-gate auth_sendname(uchar_t *cp, int len)
427*0Sstevel@tonic-gate {
428*0Sstevel@tonic-gate static uchar_t str_request[AUTH_NAME_BUFSIZ + 6] = { IAC, SB,
429*0Sstevel@tonic-gate TELOPT_AUTHENTICATION, TELQUAL_NAME, };
430*0Sstevel@tonic-gate register uchar_t *e = str_request + 4;
431*0Sstevel@tonic-gate register uchar_t *ee = &str_request[sizeof (str_request) - 2];
432*0Sstevel@tonic-gate
433*0Sstevel@tonic-gate while (--len >= 0) {
434*0Sstevel@tonic-gate if ((*e++ = *cp++) == IAC)
435*0Sstevel@tonic-gate *e++ = IAC;
436*0Sstevel@tonic-gate if (e >= ee)
437*0Sstevel@tonic-gate return (0);
438*0Sstevel@tonic-gate }
439*0Sstevel@tonic-gate *e++ = IAC;
440*0Sstevel@tonic-gate *e++ = SE;
441*0Sstevel@tonic-gate (void) net_write(str_request, e - str_request);
442*0Sstevel@tonic-gate printsub('>', &str_request[2], e - &str_request[2]);
443*0Sstevel@tonic-gate return (1);
444*0Sstevel@tonic-gate }
445*0Sstevel@tonic-gate
446*0Sstevel@tonic-gate /* ARGSUSED */
447*0Sstevel@tonic-gate void
auth_finished(Authenticator * ap,int result)448*0Sstevel@tonic-gate auth_finished(Authenticator *ap, int result)
449*0Sstevel@tonic-gate {
450*0Sstevel@tonic-gate authenticated = ap;
451*0Sstevel@tonic-gate if (authenticated == NULL)
452*0Sstevel@tonic-gate authenticated = &NoAuth;
453*0Sstevel@tonic-gate }
454*0Sstevel@tonic-gate
455*0Sstevel@tonic-gate void
auth_printsub(uchar_t * data,uint_t cnt,uchar_t * buf,uint_t buflen)456*0Sstevel@tonic-gate auth_printsub(uchar_t *data, uint_t cnt, uchar_t *buf, uint_t buflen)
457*0Sstevel@tonic-gate {
458*0Sstevel@tonic-gate Authenticator *ap;
459*0Sstevel@tonic-gate
460*0Sstevel@tonic-gate ap = findauthenticator(data[1], data[2]);
461*0Sstevel@tonic-gate if (ap && ap->printsub)
462*0Sstevel@tonic-gate (*ap->printsub)(data, cnt, buf, buflen);
463*0Sstevel@tonic-gate else
464*0Sstevel@tonic-gate auth_gen_printsub(data, cnt, buf, buflen);
465*0Sstevel@tonic-gate }
466*0Sstevel@tonic-gate
467*0Sstevel@tonic-gate static void
auth_gen_printsub(uchar_t * data,uint_t cnt,uchar_t * buf,uint_t buflen)468*0Sstevel@tonic-gate auth_gen_printsub(uchar_t *data, uint_t cnt, uchar_t *buf, uint_t buflen)
469*0Sstevel@tonic-gate {
470*0Sstevel@tonic-gate register uchar_t *cp;
471*0Sstevel@tonic-gate uchar_t lbuf[AUTH_LBUF_BUFSIZ];
472*0Sstevel@tonic-gate
473*0Sstevel@tonic-gate if (buflen < 2)
474*0Sstevel@tonic-gate return;
475*0Sstevel@tonic-gate cnt = (cnt > 3) ? cnt - 3 : 0;
476*0Sstevel@tonic-gate data += 3;
477*0Sstevel@tonic-gate buf[buflen - 1] = '\0';
478*0Sstevel@tonic-gate buf[buflen - 2] = '*';
479*0Sstevel@tonic-gate buflen -= 2;
480*0Sstevel@tonic-gate for (; cnt > 0; cnt--, data++) {
481*0Sstevel@tonic-gate (void) snprintf((char *)lbuf, AUTH_LBUF_BUFSIZ, " %d", *data);
482*0Sstevel@tonic-gate for (cp = lbuf; (*cp != '\0') && (buflen > 0); --buflen)
483*0Sstevel@tonic-gate *buf++ = *cp++;
484*0Sstevel@tonic-gate if (buflen == 0)
485*0Sstevel@tonic-gate return;
486*0Sstevel@tonic-gate }
487*0Sstevel@tonic-gate *buf = '\0';
488*0Sstevel@tonic-gate }
489