1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
|
#!/usr/bin/perl
use strict;
use warnings;
use Getopt::Long;
use IO::Socket::INET;
use GSSAPI;
use MIME::Base64;
my %opt;
unless(GetOptions(\%opt, qw(prodid=s hostname=s port=s mutual))) {
print "$0 needs arguments, provide at least -prodid and -hostname, optionally -port (defauly 10000) or -mutual (for two sided authentication)\n";
exit(1);
}
if(! $opt{hostname}) {
die "$0: must specify -hostname\n";
}
if(! $opt{prodid}) {
die "$0: must specify -prodid\n";
}
if(! $opt{port}) {
warn "$0: -port not specified, defaulting to 10000\n";
$opt{port} = 10000;
}
if(! $opt{prodid}) {
$opt{prodid} = "host";
}
warn "$0: using [$opt{prodid}\@$opt{hostname}:$opt{port}]\n";
#
# GSSAPI::Name->import produces $gss_server_name
# which is then passed in to GSSAPI::Context::init
# $gss_server_name represents the principcal name
# of the app server to which we are authenticating
#
my $server_name = "$opt{prodid}\@$opt{hostname}";
my $status = GSSAPI::Name->import(my $gss_server_name, $server_name, gss_nt_service_name);
$status || gss_exit("CLIENT::Unable to import server name: $server_name", $status);
$status = $gss_server_name->display(my $display_name, my $type);
print "CLIENT::principal [$server_name] means going to communicate with server name [$display_name]\n";
my $gss_input_token = q{};
my $socket = IO::Socket::INET->new
(
PeerAddr => $opt{hostname},
PeerPort => $opt{port},
Proto => 'tcp',
Type => SOCK_STREAM,
);
die "socket/connect: $!\n" unless ($socket);
#
# The main purpose of GSSAPI::Context::init is to produce
# an authentication token ($gss_output_token) which will
# be sent by the app client to app server. Note the output
# is binary data.
#
my $gss_auth_flags;
if($opt{mutual}) {
$gss_auth_flags = GSS_C_MUTUAL_FLAG;
} else {
$gss_auth_flags = 0;
}
my $client_context;
my $counter = 0;
my $error = 0;
do {
$counter++;
$status = GSSAPI::Context::init($client_context, # output context
GSS_C_NO_CREDENTIAL,
$gss_server_name, # authenticate to this name
GSS_C_NO_OID, # use default mechanism (krb5)
$gss_auth_flags, # input flags
0, # input time
GSS_C_NO_CHANNEL_BINDINGS, # no channel binding
$gss_input_token, # input token
my $out_mech,
my $gss_output_token,
my $out_flags,
my $out_time);
$status || gss_exit("CLIENT::Unable to initialize security context", $status);
print "CLIENT::gss_init_sec_context success\n";
# The GSS protocol can do mutual authentication. If this is requested, the token
# that we generate in the first pass will indicate this to the server. The major
# status will have the GSS_S_CONTINUE_NEEDED bit set to indicate that we are
# expecting a reply with a server identity token. This loop will continue until
# that bit is no longer set. It should go through only once (non-mutual) or twice
# (mutual).
if ($counter == 1) {
print "CLIENT::going to identify client to server\n";
} elsif ($counter == 2) {
print "CLIENT::confirmed server identity from mutual token\n";
my $server_name;
$status = $gss_server_name->display($server_name);
$status || gss_exit("CLIENT::Unable to display server name", $status);
print "CLIENT::authenticated server name is $server_name\n" if $server_name;
} else {
print "CLIENT::iteration [$counter] successful, but should not be here\n";
}
if($gss_output_token) {
print "CLIENT::have token to send ...\n";
print "CLIENT::GSS token length is " . length($gss_output_token) . "\n";
#
# $gss_output_token is binary data
#
print $socket encode_base64($gss_output_token, '') . "\n";
print "CLIENT::sent token to server\n";
}
if ($status->major & GSS_S_CONTINUE_NEEDED) {
print "CLIENT::Mutual auth requested ...\n";
$gss_input_token = <$socket>;
if ($gss_input_token) {
print "CLIENT::got mutual auth token from server\n";
$gss_input_token = decode_base64($gss_input_token);
print "CLIENT::mutual auth token length is " . length($gss_input_token) . "\n";
} else {
print "CLIENT::server did not send needed continue token back\n";
$error = 1;
}
}
} while (!$error and $status->major & GSS_S_CONTINUE_NEEDED);
$socket->shutdown(2);
exit(0);
################################################################################
sub gss_exit {
my $errmsg = shift;
my $status = shift;
my @major_errors = $status->generic_message();
my @minor_errors = $status->specific_message();
print STDERR "$errmsg:\n";
foreach my $s (@major_errors) {
print STDERR " MAJOR::$s\n";
}
foreach my $s (@minor_errors) {
print STDERR " MINOR::$s\n";
}
exit(1);
}
|
