AFS and tokenforwarding

[Serge Droz]

For some reasons the afs tokenforwarding stuff has changed
siginificantly from v 2.9p2 to 2.9.9p2. 
This makes it impossible to use public key authenticication in a
standart AFS environment. 
I don't know the reasons for these changes. 

In any case attached is a patch which restores the old behaviour.

Regards
Serge


-- 
Serge Droz
Paul Scherrer Institut                mailto:serge.droz at psi.ch
CH-5232 Villigen PSI                   Phone: ++41 56 310 3637
                                         Fax: ++41 56 310 3649
-------------- next part --------------
--- openssh-2.9.9p2.orig/sshconnect1.c	Sat Jul 14 04:17:00 2001
+++ openssh-2.9.9p2/sshconnect1.c	Thu Sep 27 09:58:37 2001
@@ -1111,13 +1111,14 @@
 ssh_userauth1(const char *local_user, const char *server_user, char *host,
     Key **keys, int nkeys)
 {
+	
 #ifdef KRB5
 	krb5_context context = NULL;
 	krb5_auth_context auth_context = NULL;
 #endif
 	int i, type;
 	int payload_len;
-	
+
 	if (supported_authentications == 0)
 		fatal("ssh_userauth1: server supports no auth methods");
 
@@ -1139,6 +1140,23 @@
 		goto success;
 	if (type != SSH_SMSG_FAILURE)
 		packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER", type);
+#ifdef AFS
+	/* Try Kerberos v4 TGT passing if the server supports it. */
+	if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
+	    options.kerberos_tgt_passing) {
+		if (options.cipher == SSH_CIPHER_NONE)
+			log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
+		send_krb4_tgt();
+	}
+	/* Try AFS token passing if the server supports it. */
+
+	if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
+	    options.afs_token_passing && k_hasafs()) {
+		if (options.cipher == SSH_CIPHER_NONE)
+			log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
+		send_afs_tokens();
+	}
+#endif /* AFS */
 	
 #ifdef KRB5
 	if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
@@ -1202,6 +1220,7 @@
 				goto success;
 		}
 	}
+
 	/* Try RSA authentication if the server supports it. */
 	if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
 	    options.rsa_authentication) {
@@ -1226,6 +1245,7 @@
 		if (try_challenge_response_authentication())
 			goto success;
 	}
+
 	/* Try password authentication if the server supports it. */
 	if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
 	    options.password_authentication && !options.batch_mode) {
@@ -1255,22 +1275,6 @@
 		krb5_free_context(context);
 #endif
 	
-#ifdef AFS
-	/* Try Kerberos v4 TGT passing if the server supports it. */
-	if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
-	    options.kerberos_tgt_passing) {
-		if (options.cipher == SSH_CIPHER_NONE)
-			log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
-		send_krb4_tgt();
-	}
-	/* Try AFS token passing if the server supports it. */
-	if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
-	    options.afs_token_passing && k_hasafs()) {
-		if (options.cipher == SSH_CIPHER_NONE)
-			log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
-		send_afs_tokens();
-	}
-#endif /* AFS */
 
 	return;	/* need statement after label */
 }
--- openssh-2.9.9p2.orig/auth1.c	Wed Jul  4 06:21:16 2001
+++ openssh-2.9.9p2/auth1.c	Fri Sep 28 08:53:35 2001
@@ -118,6 +118,22 @@
 		/* Process the packet. */
 		switch (type) {
 
+#ifdef AFS
+		case SSH_CMSG_HAVE_AFS_TOKEN:
+			if (!options.afs_token_passing || !k_hasafs()) {
+				verbose("AFS token passing disabled.");
+				break;
+			} else {
+				/* Accept AFS token. */
+				char *token_string = packet_get_string(&dlen);
+				packet_integrity_check(plen, 4 + dlen, type);
+				if (!auth_afs_token(authctxt, token_string))
+					verbose("AFS token REFUSED for %.100s", authctxt->user);
+				xfree(token_string);
+			}
+			//continue;
+#endif /* AFS */
+
 #if defined(KRB4) || defined(KRB5)
 		case SSH_CMSG_AUTH_KERBEROS:
 			if (!options.kerberos_authentication) {
@@ -169,9 +185,9 @@
 			packet_send_debug("Kerberos TGT passing disabled before authentication.");
 			break;
 #ifdef AFS
-		case SSH_CMSG_HAVE_AFS_TOKEN:
-			packet_send_debug("AFS token passing disabled before authentication.");
-			break;
+//		case SSH_CMSG_HAVE_AFS_TOKEN:
+//			packet_send_debug("AFS token passing disabled before authentication.");
+//			break;
 #endif /* AFS */
 #endif /* AFS || KRB5 */
 			
@@ -440,4 +456,5 @@
 
 	/* Perform session preparation. */
 	do_authenticated(authctxt);
+	
 }