* Changes to not use streams on HPUX

* Changes to abort the session if telnetd receives certain options
such as environment or DISPLAY options before authentication and
encryption is negotiated or not negotiated.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@7818 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/telnet/telnetd/ChangeLog b/src/appl/telnet/telnetd/ChangeLog
index 2c66434f8c6fee9f5d03351833fd8b3bb7b21a8d..2c7c36b63f240467716e7f7b4dd38e5896e053aa 100644 (file)
--- a/src/appl/telnet/telnetd/ChangeLog
+++ b/src/appl/telnet/telnetd/ChangeLog
@@ -1,3 +1,16 @@
+Tue Apr 16 12:23:02 1996  Sam Hartman  <hartmans@mit.edu>
+
+       * configure.in : Treat HPUX as if it doesn't have streams.
+
+       * state.c (suboption): For certain options like environment and X
+       display, require authentication and encryption to be established
+       or not established before processing the option.
+       (sb_auth_complete): Fail and kill telnetd if authentication
+       negotiation is not complete.
+
+       * ext.h: Define new global variable indicating whether encryption
+       wait has happened.
+
 Thu Apr 11 21:44:39 1996  Richard Basch  <basch@lehman.com>
 
        * sys_term.c (cleanup): Call the Kerberos 5 cleanup routine, also.

diff --git a/src/appl/telnet/telnetd/configure.in b/src/appl/telnet/telnetd/configure.in
index 9a4648b94629ddd4deba61bc3255ccba4a1554f7..42a3c7ed80212d44b44cbd22b1b4de86dda6e58b 100644 (file)
--- a/src/appl/telnet/telnetd/configure.in
+++ b/src/appl/telnet/telnetd/configure.in
@@ -29,12 +29,15 @@ dnl Make our operating system-specific security checks and definitions for
 dnl login.
 dnl
 case $krb5_cv_host in
+*-*-hpux-*)
+     broken_streams=yes
+     ;;
 *-*-irix*)
      # Irix doesn't have a working granpt, and more over
      # you can't push anything onto a pty, so telnetd really
      # Really wants to treat it as if it doesn't have streams
     broken_streams=yes
-;;
+     ;;
 esac
 if test -z "$broken_streams" ; then
     AC_FUNC_CHECK(grantpt,AC_DEFINE(STREAMSPTY))

diff --git a/src/appl/telnet/telnetd/ext.h b/src/appl/telnet/telnetd/ext.h
index 2f577da496ebcbf2c5d85f1d60792765a17cfea3..37e2a19709716cdeec6017c3def1ca4465d3fb80 100644 (file)
--- a/src/appl/telnet/telnetd/ext.h
+++ b/src/appl/telnet/telnetd/ext.h
@@ -63,7 +63,7 @@ extern int    require_SecurID;
 #if    defined(AUTHENTICATION)
 extern int     auth_level;
 #endif
-
+extern int auth_negotiated; /* Have we finished all authentication negotiation we plan to finish?*/
 extern slcfun  slctab[NSLC + 1];       /* slc mapping table */
 
 extern char    *terminaltype;

diff --git a/src/appl/telnet/telnetd/state.c b/src/appl/telnet/telnetd/state.c
index b61879297c1629baa20d1a9ad607716a8792c5cf..0f19371ce5324810affa91d5020e4ef18f076492 100644 (file)
--- a/src/appl/telnet/telnetd/state.c
+++ b/src/appl/telnet/telnetd/state.c
@@ -81,6 +81,17 @@ unsigned char *subsave;
 #define        TS_DO           7       /* do " */
 #define        TS_DONT         8       /* dont " */
 
+static void sb_auth_complete()
+{
+  if (!auth_negotiated) {
+    static char *error =
+      "An environment option was sent before authentication negotiation completed.\r\nThis may create a security hazard. Connection dropped.\r\n";
+    writenet(error, strlen(error));
+    netflush();
+    exit(1);
+  }
+}
+
        void
 telrcv()
 {
@@ -1108,6 +1119,8 @@ suboption()
        if (his_state_is_wont(TELOPT_TSPEED))   /* Ignore if option disabled */
                break;
 
+       sb_auth_complete();
+       
        settimer(tspeedsubopt);
 
        if (SB_EOF() || SB_GET() != TELQUAL_IS)
@@ -1131,6 +1144,7 @@ suboption()
 
        if (his_state_is_wont(TELOPT_TTYPE))    /* Ignore if option disabled */
                break;
+sb_auth_complete();
        settimer(ttypesubopt);
 
        if (SB_EOF() || SB_GET() != TELQUAL_IS) {
@@ -1250,6 +1264,7 @@ suboption()
     case TELOPT_XDISPLOC: {
        if (SB_EOF() || SB_GET() != TELQUAL_IS)
                return;
+sb_auth_complete();
        settimer(xdisplocsubopt);
        subpointer[SB_LEN()] = '\0';
        (void)setenv("DISPLAY", (char *)subpointer, 1);
@@ -1265,6 +1280,7 @@ suboption()
 
        if (SB_EOF())
                return;
+sb_auth_complete();
        c = SB_GET();
        if (c == TELQUAL_IS) {
                if (subchar == TELOPT_OLD_ENVIRON)

diff --git a/src/appl/telnet/telnetd/telnetd.c b/src/appl/telnet/telnetd/telnetd.c
index cbf76f855722abae10f472e14cd6ae13435ff3f5..1fd55e62451ab26024771a6dfe957aa873c54a69 100644 (file)
--- a/src/appl/telnet/telnetd/telnetd.c
+++ b/src/appl/telnet/telnetd/telnetd.c
@@ -713,6 +713,9 @@ getterminaltype(name)
        }
     }
 #endif /* ENCRYPTION */
+    /* Options like environment require authentication and encryption
+       negotiation to be completed.*/
+    auth_negotiated = 1;
     if (his_state_is_will(TELOPT_TSPEED)) {
        static unsigned char sb[] =
                        { IAC, SB, TELOPT_TSPEED, TELQUAL_SEND, IAC, SE };