| blob | 329fd2c4be7aea422deebd4e86d64a1167856189 |
1 ? config.h
2 ? inetutils-shishi-2003-08-12.tar.gz
3 ? stamp-h1
4 Index: README
5 ===================================================================
6 RCS file: /cvsroot/inetutils/inetutils/README,v
7 retrieving revision 1.10
8 diff -u -p -r1.10 README
9 --- README 25 Dec 2001 18:47:44 -0000 1.10
10 +++ README 31 Aug 2003 20:33:07 -0000
11 @@ -47,6 +47,12 @@ not want to install these files.
12 install setuid root to work correctly they use priviledge ports
13 for communication.
15 +3) If both Kerberos 5 (MIT and Heimdal) and Shishi is specified, the
16 +applications that have been ported to use Shishi will use Shishi only,
17 +and the applications that have not been ported to use Shishi will use
18 +MIT or Heimdal Kerberos. If you want MIT or Heimdal instead of
19 +Shishi, don't specify --with-shishi.
20 +
21 Some known deficiencies:
22 o Many programs do not support long options, such as --version or --help.
23 o The authentication and encryption options have not been tested.
24 Index: configure.ac
25 ===================================================================
26 RCS file: /cvsroot/inetutils/inetutils/configure.ac,v
27 retrieving revision 1.18
28 diff -u -p -r1.18 configure.ac
29 --- configure.ac 24 May 2003 23:36:45 -0000 1.18
30 +++ configure.ac 31 Aug 2003 20:33:07 -0000
31 @@ -1,6 +1,6 @@
32 # Configuration for inetutils
33 #
34 -# Copyright (C) 1995, 1996, 1997, 1998, 2000, 2001, 2002 Free Software Foundation, Inc.
35 +# Copyright (C) 1995, 1996, 1997, 1998, 2000, 2001, 2002, 2003 Free Software Foundation, Inc.
36 #
37 # Written by Miles Bader <miles@gnu.ai.mit.edu>
38 #
39 @@ -63,6 +63,10 @@ AC_ARG_WITH(krb4, [ --with-krb4[[=PATH]
40 AC_ARG_WITH(krb5, [ --with-krb5[[=PATH]] Compile with Kerberos V],
41 [KERBEROS_VERSION=5
42 KERBEROS_DIR=$withval])
43 +AC_ARG_WITH(shishi, AC_HELP_STRING([--with-shishi[[=PATH]]],
44 + [Compile with Shishi (Kerberos 5)]),
45 + [KERBEROS_VERSION=Shishi
46 + KERBEROS_DIR=$withval])
47 AC_ARG_WITH(wrap, [ --with-wrap add tcp wrapper support])
48 AC_ARG_WITH(pam, [ --with-pam add support for PAM])
50 @@ -242,6 +246,7 @@ if test "$enable_encryption" = yes -o "$
51 AH_TEMPLATE(KERBEROS, [Define to one if you have Kerberos])
52 AH_TEMPLATE(KRB4, [Define to one if you have Kerberos IV])
53 AH_TEMPLATE(KRB5, [Define to one if you have Kerberos V])
54 + AH_TEMPLATE(SHISHI, [Define to 1 if you have Shishi])
55 AH_TEMPLATE(DES_ENCRYPTION, [FIXME])
57 if test "$KERBEROS_VERSION" = 4; then
58 @@ -261,11 +266,11 @@ if test "$enable_encryption" = yes -o "$
59 test "$enable_encryption" = yes -a "$ac_cv_lib_des_des_key_sched" = yes \
60 && AC_DEFINE(DES_ENCRYPTION)
61 fi
62 - else
63 + elif test "$KERBEROS_VERSION" = 5; then
64 IU_CHECK_KRB5($KERBEROS_VERSION,$KERBEROS_DIR)
65 LIBAUTH=$KRB5_LIBS
66 INCAUTH=$KRB_CFLAGS
67 - if test ".$LIBAUTH" != . ;then
68 + if test ".LIBAUTH" != . ;then
69 case $KERBEROS_VERSION in
70 4) AC_DEFINE(KERBEROS)
71 AC_DEFINE(KRB4)
72 @@ -275,6 +280,22 @@ if test "$enable_encryption" = yes -o "$
73 ;;
74 esac
75 fi
76 + else
77 + if test x$KERBEROS_DIR != x; then
78 + LIBAUTH=-L$KERBEROS_DIR/lib
79 + INCAUTH=-I$KERBEROS_DIR/include
80 + fi
81 + LIBAUTH="$LIBAUTH -lshishi"
82 + save_LIBS=$LIBS
83 + LIBS="$LIBS $LIBAUTH"
84 + save_CPPFLAGS=$CPPFLAGS
85 + CPPFLAGS="$CPPFLAGS $INCAUTH"
86 + AC_CHECK_HEADER(shishi.h,
87 + AC_CHECK_LIB(shishi, shishi_check_version,
88 + AC_DEFINE(SHISHI),
89 + [INCAUTH= LIBAUTH=]))
90 + LIBS=$save_LIBS
91 + CPPFLAGS=$save_CPPFLAGS
92 fi
93 fi
94 AC_SUBST(LIBAUTH)
95 Index: libtelnet/Makefile.am
96 ===================================================================
97 RCS file: /cvsroot/inetutils/inetutils/libtelnet/Makefile.am,v
98 retrieving revision 1.5
99 diff -u -p -r1.5 Makefile.am
100 --- libtelnet/Makefile.am 8 Apr 2002 14:02:39 -0000 1.5
101 +++ libtelnet/Makefile.am 31 Aug 2003 20:33:07 -0000
102 @@ -4,6 +4,6 @@ INCLUDES = -I$(top_builddir)/include @IN
104 noinst_LIBRARIES = libtelnet.a
106 -libtelnet_a_SOURCES = auth.c enc_des.c encrypt.c forward.c genget.c getent.c kerberos.c kerberos5.c misc.c read_passwd.c
107 +libtelnet_a_SOURCES = auth.c enc_des.c encrypt.c forward.c genget.c getent.c kerberos.c kerberos5.c misc.c read_passwd.c shishi.c
109 noinst_HEADERS = auth-proto.h auth.h enc-proto.h encrypt.h key-proto.h misc-proto.h misc.h
110 Index: libtelnet/auth-proto.h
111 ===================================================================
112 RCS file: /cvsroot/inetutils/inetutils/libtelnet/auth-proto.h,v
113 retrieving revision 1.3
114 diff -u -p -r1.3 auth-proto.h
115 --- libtelnet/auth-proto.h 6 Dec 2002 16:09:06 -0000 1.3
116 +++ libtelnet/auth-proto.h 31 Aug 2003 20:33:07 -0000
117 @@ -89,4 +89,14 @@ void kerberos5_reply P((TN_Authenticator
118 int kerberos5_status P((TN_Authenticator *, char *, int));
119 void kerberos5_printsub P((unsigned char *, int, unsigned char *, int));
120 #endif
121 +
122 +#ifdef SHISHI
123 +int krb5shishi_init P((TN_Authenticator *, int));
124 +int krb5shishi_send P((TN_Authenticator *));
125 +void krb5shishi_is P((TN_Authenticator *, unsigned char *, int));
126 +void krb5shishi_reply P((TN_Authenticator *, unsigned char *, int));
127 +int krb5shishi_status P((TN_Authenticator *, char *, int));
128 +void krb5shishi_printsub P((unsigned char *, int, unsigned char *, int));
129 +void krb5shishi_cleanup P((TN_Authenticator *));
130 +#endif
131 #endif
132 Index: libtelnet/auth.c
133 ===================================================================
134 RCS file: /cvsroot/inetutils/inetutils/libtelnet/auth.c,v
135 retrieving revision 1.6
136 diff -u -p -r1.6 auth.c
137 --- libtelnet/auth.c 6 Dec 2002 16:10:07 -0000 1.6
138 +++ libtelnet/auth.c 31 Aug 2003 20:33:07 -0000
139 @@ -126,6 +126,24 @@ TN_Authenticator authenticators[] = {
140 spx_status,
141 spx_printsub },
142 #endif
143 +#ifdef SHISHI
144 + { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
145 + krb5shishi_init,
146 + krb5shishi_send,
147 + krb5shishi_is,
148 + krb5shishi_reply,
149 + krb5shishi_status,
150 + krb5shishi_printsub,
151 + krb5shishi_cleanup },
152 + { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
153 + krb5shishi_init,
154 + krb5shishi_send,
155 + krb5shishi_is,
156 + krb5shishi_reply,
157 + krb5shishi_status,
158 + krb5shishi_printsub,
159 + krb5shishi_cleanup },
160 +#endif
161 #ifdef KRB5
162 # ifdef ENCRYPTION
163 { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
164 @@ -610,6 +628,8 @@ auth_finished(ap, result)
165 TN_Authenticator *ap;
166 int result;
167 {
168 + if (ap && ap->cleanup)
169 + (*ap->cleanup) (ap);
170 if (!(authenticated = ap))
171 authenticated = &NoAuth;
172 validuser = result;
173 Index: libtelnet/auth.h
174 ===================================================================
175 RCS file: /cvsroot/inetutils/inetutils/libtelnet/auth.h,v
176 retrieving revision 1.4
177 diff -u -p -r1.4 auth.h
178 --- libtelnet/auth.h 6 Dec 2002 16:09:06 -0000 1.4
179 +++ libtelnet/auth.h 31 Aug 2003 20:33:08 -0000
180 @@ -75,6 +75,7 @@ typedef struct XauthP {
181 void (*reply) P((struct XauthP *, unsigned char *, int));
182 int (*status) P((struct XauthP *, char *, int));
183 void (*printsub) P((unsigned char *, int, unsigned char *, int));
184 + void (*cleanup) P((struct XauthP *));
185 } TN_Authenticator;
187 #include "auth-proto.h"
188 Index: libtelnet/shishi.c
189 ===================================================================
190 RCS file: libtelnet/shishi.c
191 diff -N libtelnet/shishi.c
192 --- /dev/null 1 Jan 1970 00:00:00 -0000
193 +++ libtelnet/shishi.c 31 Aug 2003 20:33:08 -0000
194 @@ -0,0 +1,497 @@
195 +/* Copyright (C) 2002, 2003 Free Software Foundation, Inc.
196 +
197 +This file is part of GNU Inetutils.
198 +
199 +GNU Inetutils is free software; you can redistribute it and/or modify
200 +it under the terms of the GNU General Public License as published by
201 +the Free Software Foundation; either version 2, or (at your option)
202 +any later version.
203 +
204 +GNU Inetutils is distributed in the hope that it will be useful,
205 +but WITHOUT ANY WARRANTY; without even the implied warranty of
206 +MERCHANTABILITY or FITNESS FOR PARTICULAR PURPOSE. See the
207 +GNU General Public License for more details.
208 +
209 +You should have received a copy of the GNU General Public License
210 +along with GNU Inetutils; see the file COPYING. If not, write to
211 +the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
212 +Boston, MA 02111-1307, USA. */
213 +
214 +#ifdef HAVE_CONFIG_H
215 +#include <config.h>
216 +#endif
217 +
218 +#ifdef SHISHI
219 +#include <stdlib.h>
220 +#include <stdio.h>
221 +#include <arpa/telnet.h>
222 +#include <shishi.h>
223 +#include <assert.h>
224 +
225 +#include <netdb.h>
226 +#include <ctype.h>
227 +#include <syslog.h>
228 +#ifdef HAVE_STRING_H
229 +# include <string.h>
230 +#else
231 +# include <strings.h>
232 +#endif
233 +
234 +#include "auth.h"
235 +#include "misc.h"
236 +
237 +static unsigned char str_data[2048] = { IAC, SB, TELOPT_AUTHENTICATION, 0,
238 + AUTHTYPE_KERBEROS_V5,
239 +};
240 +
241 +#define KRB_AUTH 0 /* Authentication data follows */
242 +#define KRB_REJECT 1 /* Rejected (reason might follow) */
243 +#define KRB_ACCEPT 2 /* Accepted */
244 +#define KRB_RESPONSE 3 /* Response for mutual auth. */
245 +
246 +Shishi *shishi_handle = 0;
247 +Shishi_ap *auth_handle;
248 +
249 +#define DEBUG(c) if (auth_debug_mode) printf c
250 +
251 +static int
252 +Data (TN_Authenticator * ap, int type, unsigned char *d, int c)
253 +{
254 + unsigned char *p = str_data + 4;
255 + unsigned char *cd = (unsigned char *) d;
256 +
257 + if (c == -1)
258 + c = strlen (cd);
259 +
260 + if (auth_debug_mode)
261 + {
262 + printf ("%s:%d: [%d] (%d)",
263 + str_data[3] == TELQUAL_IS ? ">>>IS" : ">>>REPLY",
264 + str_data[3], type, c);
265 + printd (d, c);
266 + printf ("\r\n");
267 + }
268 +
269 + *p++ = ap->type;
270 + *p++ = ap->way;
271 + *p++ = type;
272 +
273 + while (c-- > 0)
274 + {
275 + if ((*p++ = *cd++) == IAC)
276 + *p++ = IAC;
277 + }
278 + *p++ = IAC;
279 + *p++ = SE;
280 + if (str_data[3] == TELQUAL_IS)
281 + printsub ('>', &str_data[2], p - &str_data[2]);
282 + return (net_write (str_data, p - str_data));
283 +}
284 +
285 +/* FIXME: Reverse return code! */
286 +int
287 +krb5shishi_init (TN_Authenticator * ap, int server)
288 +{
289 + if (server)
290 + {
291 + str_data[3] = TELQUAL_REPLY;
292 + if (!shishi_handle && shishi_init_server (&shishi_handle) != SHISHI_OK)
293 + return 0;
294 + }
295 + else
296 + {
297 + str_data[3] = TELQUAL_IS;
298 + if (!shishi_handle && shishi_init (&shishi_handle) != SHISHI_OK)
299 + return 0;
300 + }
301 +
302 + return 1;
303 +}
304 +
305 +void
306 +krb5shishi_cleanup (TN_Authenticator * ap)
307 +{
308 + if (shishi_handle == 0)
309 + return;
310 +
311 + shishi_done (shishi_handle);
312 + shishi_handle = 0;
313 +}
314 +
315 +int
316 +krb5shishi_send (TN_Authenticator * ap)
317 +{
318 + int ap_opts;
319 + char type_check[2];
320 + Shishi_tkt *tkt;
321 + Shishi_tkts_hint hint;
322 + int rc;
323 + char *tmp;
324 + char *apreq;
325 + size_t apreq_len;
326 +
327 + tmp = malloc (strlen ("host/") + strlen (RemoteHostName) + 1);
328 + sprintf (tmp, "host/%s", RemoteHostName);
329 + memset (&hint, 0, sizeof (hint));
330 + hint.server = tmp;
331 + hint.etype = SHISHI_DES_CBC_MD5;
332 + tkt = shishi_tkts_get (shishi_tkts_default (shishi_handle), &hint);
333 + free (tmp);
334 + if (!tkt)
335 + {
336 + DEBUG (("telnet: Kerberos V5: no shishi ticket for server\r\n"));
337 + return 0;
338 + }
339 +
340 + if (auth_debug_mode)
341 + shishi_tkt_pretty_print (tkt, stdout);
342 +
343 + if (!UserNameRequested)
344 + {
345 + DEBUG (("telnet: Kerberos V5: no user name supplied\r\n"));
346 + return 0;
347 + }
348 +
349 + if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL)
350 + ap_opts = SHISHI_APOPTIONS_MUTUAL_REQUIRED;
351 + else
352 + ap_opts = 0;
353 +
354 + type_check[0] = ap->type;
355 + type_check[1] = ap->way;
356 +
357 + if (tkt)
358 + {
359 + rc = shishi_ap_tktoptionsdata (shishi_handle, &auth_handle, tkt,
360 + ap_opts, (char *) &type_check, 2);
361 + if (rc != SHISHI_OK)
362 + {
363 + DEBUG (("telnet: Kerberos V5: Could not make AP-REQ (%s)\r\n",
364 + shishi_strerror (rc)));
365 + return 0;
366 + }
367 +
368 + rc = shishi_ap_req_der (auth_handle, &apreq, &apreq_len);
369 + if (rc != SHISHI_OK)
370 + {
371 + DEBUG (("telnet: Kerberos V5: could not DER encode (%s)\r\n",
372 + shishi_strerror (rc)));
373 + return 0;
374 + }
375 +
376 + if (auth_debug_mode)
377 + {
378 + shishi_authenticator_print
379 + (shishi_handle, stdout, shishi_ap_authenticator (auth_handle));
380 + shishi_apreq_print (shishi_handle, stdout,
381 + shishi_ap_req (auth_handle));
382 + }
383 +
384 + if (!auth_sendname (UserNameRequested, strlen (UserNameRequested)))
385 + {
386 + DEBUG (("telnet: Not enough room for user name\r\n"));
387 + return 0;
388 + }
389 +
390 + if (!Data (ap, KRB_AUTH, apreq, apreq_len))
391 + {
392 + DEBUG (("telnet: Not enough room for authentication data\r\n"));
393 + return 0;
394 + }
395 + }
396 +
397 + DEBUG (("telnet: Sent Kerberos V5 credentials to server\r\n"));
398 +
399 + return 1;
400 +}
401 +
402 +void
403 +krb5shishi_reply (TN_Authenticator * ap, unsigned char *data, int cnt)
404 +{
405 + static int mutual_complete = 0;
406 +
407 + if (cnt-- < 1)
408 + return;
409 +
410 + switch (*data++)
411 + {
412 + case KRB_REJECT:
413 + if (cnt > 0)
414 + printf ("[ Kerberos V5 refuses authentication because %.*s ]\r\n",
415 + cnt, data);
416 + else
417 + printf ("[ Kerberos V5 refuses authentication ]\r\n");
418 + auth_send_retry ();
419 + return;
420 +
421 + case KRB_ACCEPT:
422 + if (!mutual_complete)
423 + {
424 + if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL)
425 + {
426 + printf ("[ Kerberos V5 accepted you, "
427 + "but didn't provide mutual authentication! ]\r\n");
428 + auth_send_retry ();
429 + break;
430 + }
431 + }
432 +
433 + if (cnt)
434 + printf ("[ Kerberos V5 accepts you as ``%.*s''%s ]\r\n", cnt, data,
435 + mutual_complete ?
436 + " (server authenticated)" : " (server NOT authenticated)");
437 + else
438 + printf ("[ Kerberos V5 accepts you ]\r\n");
439 + auth_finished (ap, AUTH_USER);
440 + break;
441 +
442 + case KRB_RESPONSE:
443 + if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL)
444 + {
445 + if (shishi_ap_rep_verify_der (auth_handle, data, cnt) != SHISHI_OK)
446 + {
447 + printf ("[ Mutual authentication failed ]\r\n");
448 + auth_send_retry ();
449 + break;
450 + }
451 +
452 + if (auth_debug_mode)
453 + {
454 + shishi_aprep_print (shishi_handle, stdout,
455 + shishi_ap_rep (auth_handle));
456 + shishi_encapreppart_print (shishi_handle, stdout,
457 + shishi_ap_encapreppart
458 + (auth_handle));
459 + }
460 +
461 + mutual_complete = 1;
462 + }
463 + break;
464 +
465 + default:
466 + DEBUG (("Unknown Kerberos option %d\r\n", data[-1]));
467 + }
468 +}
469 +
470 +int
471 +krb5shishi_status (TN_Authenticator * ap, char *name, int level)
472 +{
473 + char cname[BUFSIZ];
474 + int cnamelen;
475 + int rc;
476 +
477 + if (level < AUTH_USER)
478 + return level;
479 +
480 + cnamelen = sizeof (cname);
481 + rc = shishi_encticketpart_cname_get
482 + (shishi_handle, shishi_tkt_encticketpart (shishi_ap_tkt (auth_handle)),
483 + cname, &cnamelen);
484 +
485 + if (UserNameRequested && rc == SHISHI_OK &&
486 + cnamelen == strlen (UserNameRequested) &&
487 + memcmp (UserNameRequested, cname, cnamelen) == 0)
488 + {
489 + /* FIXME: Check buffer length */
490 + strcpy (name, UserNameRequested);
491 + return AUTH_VALID;
492 + }
493 +
494 + return AUTH_USER;
495 +}
496 +
497 +int
498 +krb5shishi_is_auth (TN_Authenticator * a, unsigned char *data, int cnt,
499 + char *errbuf, int errbuflen)
500 +{
501 + Shishi_key *key, *key2;
502 + int rc;
503 + char cnamerealm[BUFSIZ];
504 + int cnamerealmlen;
505 +
506 + rc = shishi_ap (shishi_handle, &auth_handle);
507 + if (rc != SHISHI_OK)
508 + {
509 + snprintf (errbuf, errbuflen,
510 + "Cannot allocate authentication structures: %s",
511 + shishi_strerror (rc));
512 + return 1;
513 + }
514 +
515 + rc = shishi_ap_req_der_set (auth_handle, data, cnt);
516 + if (rc != SHISHI_OK)
517 + {
518 + snprintf (errbuf, errbuflen,
519 + "Cannot parse authentication information: %s",
520 + shishi_strerror (rc));
521 + return 1;
522 + }
523 +
524 + key = shishi_hostkeys_for_localservice (shishi_handle, "host");
525 + if (key == NULL)
526 + {
527 + snprintf (errbuf, errbuflen, "Could not find key:\n%s\n",
528 + shishi_strerror_details (shishi_handle));
529 + return 1;
530 + }
531 +
532 + rc = shishi_ap_req_process (auth_handle, key);
533 + if (rc != SHISHI_OK)
534 + {
535 + snprintf (errbuf, errbuflen, "Could not process AP-REQ: %s\n",
536 + shishi_strerror (rc));
537 + return 1;
538 + }
539 +
540 + if (shishi_apreq_mutual_required_p
541 + (shishi_handle, shishi_ap_req (auth_handle)))
542 + {
543 + Shishi_asn1 aprep;
544 + char der[BUFSIZ];
545 + int derlen = BUFSIZ;;
546 +
547 + rc = shishi_ap_rep_asn1 (auth_handle, &aprep);
548 + if (rc != SHISHI_OK)
549 + {
550 + snprintf (errbuf, errbuflen, "Error creating AP-REP: %s\n",
551 + shishi_strerror (rc));
552 + return 1;
553 + }
554 +
555 + rc = shishi_a2d (shishi_handle, aprep, der, &derlen);
556 + if (rc != SHISHI_OK)
557 + {
558 + snprintf (errbuf, errbuflen, "Error der encoding aprep: %s\n",
559 + shishi_strerror (rc));
560 + return 1;
561 + }
562 +
563 + Data (a, KRB_RESPONSE, der, derlen);
564 + }
565 +
566 + cnamerealmlen = sizeof (cnamerealm);
567 + rc = shishi_encticketpart_cnamerealm_get
568 + (shishi_handle, shishi_tkt_encticketpart (shishi_ap_tkt (auth_handle)),
569 + cnamerealm, &cnamerealmlen);
570 + if (rc != SHISHI_OK)
571 + {
572 + snprintf (errbuf, errbuflen, "Error getting authenticator name: %s\n",
573 + shishi_strerror (rc));
574 + return 1;
575 + }
576 + cnamerealm[cnamerealmlen] = '\0';
577 +
578 + Data (a, KRB_ACCEPT, cnamerealm, cnamerealm ? -1 : 0);
579 + DEBUG (("telnetd: Kerberos5 identifies him as ``%s''\r\n",
580 + cnamerealm ? cnamerealm : ""));
581 + auth_finished (a, AUTH_USER);
582 +
583 + return 0;
584 +}
585 +
586 +void
587 +krb5shishi_is (TN_Authenticator * ap, unsigned char *data, int cnt)
588 +{
589 + int r = 0;
590 + char errbuf[512];
591 +
592 + puts ("krb5shishi_is");
593 +
594 + if (cnt-- < 1)
595 + return;
596 + errbuf[0] = 0;
597 + switch (*data++)
598 + {
599 + case KRB_AUTH:
600 + r = krb5shishi_is_auth (ap, data, cnt, errbuf, sizeof errbuf);
601 + break;
602 +
603 + default:
604 + DEBUG (("Unknown Kerberos option %d\r\n", data[-1]));
605 + Data (ap, KRB_REJECT, 0, 0);
606 + break;
607 + }
608 +
609 + if (r)
610 + {
611 + if (!errbuf[0])
612 + snprintf (errbuf, sizeof errbuf, "kerberos_is: error");
613 + Data (ap, KRB_REJECT, errbuf, -1);
614 + DEBUG (("%s\r\n", errbuf));
615 + syslog (LOG_ERR, "%s", errbuf);
616 + }
617 +}
618 +
619 +static char *
620 +req_type_str (int type)
621 +{
622 + switch (type)
623 + {
624 + case KRB_REJECT:
625 + return "REJECT";
626 +
627 + case KRB_ACCEPT:
628 + return "ACCEPT";
629 +
630 + case KRB_AUTH:
631 + return "AUTH";
632 +
633 + case KRB_RESPONSE:
634 + return "RESPONSE";
635 +
636 + }
637 + return NULL;
638 +}
639 +
640 +#define ADDC(p,l,c) if ((l) > 0) {*(p)++ = (c); --(l);}
641 +
642 +void
643 +krb5shishi_printsub (unsigned char *data, int cnt,
644 + unsigned char *buf, int buflen)
645 +{
646 + char *p;
647 + int i;
648 +
649 + puts ("krb5shishi_printsub");
650 +
651 + buf[buflen - 1] = '\0'; /* make sure its NULL terminated */
652 + buflen -= 1;
653 +
654 + p = req_type_str (data[3]);
655 + if (!p)
656 + {
657 + int l = snprintf (buf, buflen, " %d (unknown)", data[3]);
658 + buf += l;
659 + buflen -= l;
660 + }
661 + else
662 + {
663 + while (buflen > 0 && (*buf++ = *p++) != 0)
664 + buflen--;
665 + }
666 +
667 + switch (data[3])
668 + {
669 + case KRB_REJECT: /* Rejected (reason might follow) */
670 + case KRB_ACCEPT: /* Accepted (username might follow) */
671 + if (cnt <= 4)
672 + break;
673 + ADDC (buf, buflen, '"');
674 + for (i = 4; i < cnt; i++)
675 + ADDC (buf, buflen, data[i]);
676 + ADDC (buf, buflen, '"');
677 + ADDC (buf, buflen, '\0');
678 + break;
679 +
680 + case KRB_AUTH:
681 + case KRB_RESPONSE:
682 + for (i = 4; buflen > 0 && i < cnt; i++)
683 + {
684 + int l = snprintf (buf, buflen, " %d", data[i]);
685 + buf += l;
686 + buflen -= l;
687 + }
688 + }
689 +}
690 +
691 +#endif /* SHISHI */