Viewing file:  gss-client.pl (4.77 KB) -rw-r--r--
Select action/file-type:
 (+) |  (+) |  (+) | Code (+) | Session (+) |  (+) | SDB (+) |  (+) |  (+) |  (+) |  (+) |  (+) |
#!/usr/bin/perl
use strict;
use warnings;
use Getopt::Long;
use IO::Socket::INET;
use GSSAPI;
use MIME::Base64;
my %opt;
unless(GetOptions(\%opt, qw(prodid=s hostname=s port=s mutual))) {
print "$0 needs arguments, provide at least -prodid and -hostname, optionally -port (defauly 10000) or -mutual (for two sided authentication)\n";
exit(1);
}
if(! $opt{hostname}) {
die "$0: must specify -hostname\n";
}
if(! $opt{prodid}) {
die "$0: must specify -prodid\n";
}
if(! $opt{port}) {
warn "$0: -port not specified, defaulting to 10000\n";
$opt{port} = 10000;
}
if(! $opt{prodid}) {
$opt{prodid} = "host";
}
warn "$0: using [$opt{prodid}\@$opt{hostname}:$opt{port}]\n";
#
# GSSAPI::Name->import produces $gss_server_name
# which is then passed in to GSSAPI::Context::init
# $gss_server_name represents the principcal name
# of the app server to which we are authenticating
#
my $server_name = "$opt{prodid}\@$opt{hostname}";
my $status = GSSAPI::Name->import(my $gss_server_name, $server_name, gss_nt_service_name);
$status || gss_exit("CLIENT::Unable to import server name: $server_name", $status);
$status = $gss_server_name->display(my $display_name, my $type);
print "CLIENT::principal [$server_name] means going to communicate with server name [$display_name]\n";
my $gss_input_token = q{};
my $socket = IO::Socket::INET->new
(
PeerAddr => $opt{hostname},
PeerPort => $opt{port},
Proto => 'tcp',
Type => SOCK_STREAM,
);
die "socket/connect: $!\n" unless ($socket);
#
# The main purpose of GSSAPI::Context::init is to produce
# an authentication token ($gss_output_token) which will
# be sent by the app client to app server. Note the output
# is binary data.
#
my $gss_auth_flags;
if($opt{mutual}) {
$gss_auth_flags = GSS_C_MUTUAL_FLAG;
} else {
$gss_auth_flags = 0;
}
my $client_context;
my $counter = 0;
my $error = 0;
do {
$counter++;
$status = GSSAPI::Context::init($client_context, # output context
GSS_C_NO_CREDENTIAL,
$gss_server_name, # authenticate to this name
GSS_C_NO_OID, # use default mechanism (krb5)
$gss_auth_flags, # input flags
0, # input time
GSS_C_NO_CHANNEL_BINDINGS, # no channel binding
$gss_input_token, # input token
my $out_mech,
my $gss_output_token,
my $out_flags,
my $out_time);
$status || gss_exit("CLIENT::Unable to initialize security context", $status);
print "CLIENT::gss_init_sec_context success\n";
# The GSS protocol can do mutual authentication. If this is requested, the token
# that we generate in the first pass will indicate this to the server. The major
# status will have the GSS_S_CONTINUE_NEEDED bit set to indicate that we are
# expecting a reply with a server identity token. This loop will continue until
# that bit is no longer set. It should go through only once (non-mutual) or twice
# (mutual).
if ($counter == 1) {
print "CLIENT::going to identify client to server\n";
} elsif ($counter == 2) {
print "CLIENT::confirmed server identity from mutual token\n";
my $server_name;
$status = $gss_server_name->display($server_name);
$status || gss_exit("CLIENT::Unable to display server name", $status);
print "CLIENT::authenticated server name is $server_name\n" if $server_name;
} else {
print "CLIENT::iteration [$counter] successful, but should not be here\n";
}
if($gss_output_token) {
print "CLIENT::have token to send ...\n";
print "CLIENT::GSS token length is " . length($gss_output_token) . "\n";
#
# $gss_output_token is binary data
#
print $socket encode_base64($gss_output_token, '') . "\n";
print "CLIENT::sent token to server\n";
}
if ($status->major & GSS_S_CONTINUE_NEEDED) {
print "CLIENT::Mutual auth requested ...\n";
$gss_input_token = <$socket>;
if ($gss_input_token) {
print "CLIENT::got mutual auth token from server\n";
$gss_input_token = decode_base64($gss_input_token);
print "CLIENT::mutual auth token length is " . length($gss_input_token) . "\n";
} else {
print "CLIENT::server did not send needed continue token back\n";
$error = 1;
}
}
} while (!$error and $status->major & GSS_S_CONTINUE_NEEDED);
$socket->shutdown(2);
exit(0);
################################################################################
sub gss_exit {
my $errmsg = shift;
my $status = shift;
my @major_errors = $status->generic_message();
my @minor_errors = $status->specific_message();
print STDERR "$errmsg:\n";
foreach my $s (@major_errors) {
print STDERR " MAJOR::$s\n";
}
foreach my $s (@minor_errors) {
print STDERR " MINOR::$s\n";
}
exit(1);
}
|