FreeBSD/crypto/openssh/auth2-gss.c
/*
 * We only support those mechanisms that we know about (ie ones that we know
 * how to check local user kuserok and the like)
 */
We only support those mechanisms that we know about
We only support those mechanisms that we know about
static int
userauth_gssapi(Authctxt *authctxt)
{
	gss_OID_desc goid = {0, NULL};
	Gssctxt *ctxt = NULL;
	int mechs;
	int present;
	OM_uint32 ms;
	u_int len;
	u_char *doid = NULL;
	if (!authctxt->valid || authctxt->user == NULL)
		return (0);
	mechs = packet_get_int();
	if (mechs == 0) {
		debug("Mechanism negotiation is not supported");
		return (0);
	}
	do {
		mechs--;
		free(doid);
		present = 0;
		doid = packet_get_string(&len);
		if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
		    doid[1] == len - 2) {
			goid.elements = doid + 2;
			goid.length   = len - 2;
			ssh_gssapi_test_oid_supported(&ms, &goid, &present);
		} else {
			logit("Badly formed OID received");
		}
	} while (mechs > 0 && !present);
	if (!present) {
		free(doid);
		authctxt->server_caused_failure = 1;
		return (0);
	}
	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
		if (ctxt != NULL)
			ssh_gssapi_delete_ctx(&ctxt);
		free(doid);
		authctxt->server_caused_failure = 1;
		return (0);
	}
	authctxt->methoddata = (void *)ctxt;
	packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
	packet_put_string(doid, len);
	packet_send();
	free(doid);
	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
	authctxt->postponed = 1;
	return (0);
}
static int userauth_gssapi ( Authctxt * authctxt ) { gss_OID_desc goid = { 0 , NULL } ; Gssctxt * ctxt = NULL ; int mechs ; int present ; OM_uint32 ms ; u_int len ; u_char * doid = NULL ; if ( ! authctxt -> valid || authctxt -> user == NULL ) return ( 0 ) ; mechs = packet_get_int ( ) ; if ( mechs == 0 ) { debug ( " " ) ; return ( 0 ) ; } do { mechs -- ; free ( doid ) ; present = 0 ; doid = packet_get_string ( & len ) ; if ( len > 2 && doid [ 0 ] == SSH_GSS_OIDTYPE && doid [ 1 ] == len - 2 ) { goid . elements = doid + 2 ; goid . length = len - 2 ; ssh_gssapi_test_oid_supported ( & ms , & goid , & present ) ; } else { logit ( " " ) ; } } while ( mechs > 0 && ! present ) ; if ( ! present ) { free ( doid ) ; authctxt -> server_caused_failure = 1 ; return ( 0 ) ; } if ( GSS_ERROR ( PRIVSEP ( ssh_gssapi_server_ctx ( & ctxt , & goid ) ) ) ) { if ( ctxt != NULL ) ssh_gssapi_delete_ctx ( & ctxt ) ; free ( doid ) ; authctxt -> server_caused_failure = 1 ; return ( 0 ) ; } authctxt -> methoddata = ( void * ) ctxt ; packet_start ( SSH2_MSG_USERAUTH_GSSAPI_RESPONSE ) ; packet_put_string ( doid , len ) ; packet_send ( ) ; free ( doid ) ; dispatch_set ( SSH2_MSG_USERAUTH_GSSAPI_TOKEN , & input_gssapi_token ) ; dispatch_set ( SSH2_MSG_USERAUTH_GSSAPI_ERRTOK , & input_gssapi_errtok ) ; authctxt -> postponed = 1 ; return ( 0 ) ; }
We only support those mechanisms that we know about (ie ones that we know
 how to check local user kuserok and the like)
We only support those mechanisms that we know about ( ie ones that we know how to check local user kuserok and the like )
/* Return the OID that we received */