Annotation of src/usr.bin/ssh/auth2-gss.c, Revision 1.13
1.13 ! djm 1: /* $OpenBSD: auth2-gss.c,v 1.12 2005/10/13 22:24:31 stevesk Exp $ */
1.1 markus 2:
3: /*
4: * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
27: #include "includes.h"
28:
29: #ifdef GSSAPI
30:
31: #include "auth.h"
32: #include "ssh2.h"
33: #include "xmalloc.h"
34: #include "log.h"
35: #include "dispatch.h"
36: #include "servconf.h"
37: #include "packet.h"
38: #include "monitor_wrap.h"
39:
40: #include "ssh-gss.h"
41:
42: extern ServerOptions options;
43:
44: static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
1.6 markus 45: static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
1.1 markus 46: static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
47: static void input_gssapi_errtok(int, u_int32_t, void *);
48:
49: /*
50: * We only support those mechanisms that we know about (ie ones that we know
1.12 stevesk 51: * how to check local user kuserok and the like)
1.1 markus 52: */
53: static int
54: userauth_gssapi(Authctxt *authctxt)
55: {
1.8 avsm 56: gss_OID_desc goid = {0, NULL};
1.1 markus 57: Gssctxt *ctxt = NULL;
58: int mechs;
59: gss_OID_set supported;
60: int present;
61: OM_uint32 ms;
62: u_int len;
1.9 djm 63: u_char *doid = NULL;
1.1 markus 64:
65: if (!authctxt->valid || authctxt->user == NULL)
66: return (0);
67:
68: mechs = packet_get_int();
69: if (mechs == 0) {
70: debug("Mechanism negotiation is not supported");
71: return (0);
72: }
73:
74: ssh_gssapi_supported_oids(&supported);
75: do {
76: mechs--;
77:
78: if (doid)
79: xfree(doid);
80:
1.5 markus 81: present = 0;
1.1 markus 82: doid = packet_get_string(&len);
83:
1.10 djm 84: if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
85: doid[1] == len - 2) {
1.8 avsm 86: goid.elements = doid + 2;
87: goid.length = len - 2;
88: gss_test_oid_set_member(&ms, &goid, supported,
1.5 markus 89: &present);
1.1 markus 90: } else {
1.5 markus 91: logit("Badly formed OID received");
1.1 markus 92: }
93: } while (mechs > 0 && !present);
94:
95: gss_release_oid_set(&ms, &supported);
96:
97: if (!present) {
98: xfree(doid);
99: return (0);
100: }
101:
1.8 avsm 102: if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
1.13 ! djm 103: if (ctxt != NULL)
! 104: ssh_gssapi_delete_ctx(&ctxt);
1.3 markus 105: xfree(doid);
1.1 markus 106: return (0);
1.3 markus 107: }
1.1 markus 108:
1.12 stevesk 109: authctxt->methoddata = (void *)ctxt;
1.1 markus 110:
111: packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
112:
1.5 markus 113: /* Return the OID that we received */
1.1 markus 114: packet_put_string(doid, len);
115:
116: packet_send();
117: xfree(doid);
118:
119: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
120: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
121: authctxt->postponed = 1;
122:
123: return (0);
124: }
125:
126: static void
127: input_gssapi_token(int type, u_int32_t plen, void *ctxt)
128: {
129: Authctxt *authctxt = ctxt;
130: Gssctxt *gssctxt;
131: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
132: gss_buffer_desc recv_tok;
1.6 markus 133: OM_uint32 maj_status, min_status, flags;
1.1 markus 134: u_int len;
135:
136: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
137: fatal("No authentication or GSSAPI context");
138:
139: gssctxt = authctxt->methoddata;
140: recv_tok.value = packet_get_string(&len);
141: recv_tok.length = len; /* u_int vs. size_t */
142:
143: packet_check_eom();
144:
145: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
1.6 markus 146: &send_tok, &flags));
1.1 markus 147:
148: xfree(recv_tok.value);
149:
150: if (GSS_ERROR(maj_status)) {
151: if (send_tok.length != 0) {
152: packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
153: packet_put_string(send_tok.value, send_tok.length);
154: packet_send();
155: }
156: authctxt->postponed = 0;
157: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.6 markus 158: userauth_finish(authctxt, 0, "gssapi-with-mic");
1.1 markus 159: } else {
160: if (send_tok.length != 0) {
161: packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
162: packet_put_string(send_tok.value, send_tok.length);
163: packet_send();
164: }
165: if (maj_status == GSS_S_COMPLETE) {
166: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.6 markus 167: if (flags & GSS_C_INTEG_FLAG)
168: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
169: &input_gssapi_mic);
170: else
171: dispatch_set(
172: SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
173: &input_gssapi_exchange_complete);
1.1 markus 174: }
175: }
176:
177: gss_release_buffer(&min_status, &send_tok);
178: }
179:
180: static void
181: input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
182: {
183: Authctxt *authctxt = ctxt;
184: Gssctxt *gssctxt;
185: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
186: gss_buffer_desc recv_tok;
187: OM_uint32 maj_status;
1.2 deraadt 188: u_int len;
1.1 markus 189:
190: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
191: fatal("No authentication or GSSAPI context");
192:
193: gssctxt = authctxt->methoddata;
1.2 deraadt 194: recv_tok.value = packet_get_string(&len);
195: recv_tok.length = len;
1.1 markus 196:
197: packet_check_eom();
198:
199: /* Push the error token into GSSAPI to see what it says */
200: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
201: &send_tok, NULL));
202:
203: xfree(recv_tok.value);
204:
205: /* We can't return anything to the client, even if we wanted to */
206: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
207: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
208:
209: /* The client will have already moved on to the next auth */
210:
211: gss_release_buffer(&maj_status, &send_tok);
212: }
213:
214: /*
215: * This is called when the client thinks we've completed authentication.
216: * It should only be enabled in the dispatch handler by the function above,
217: * which only enables it once the GSSAPI exchange is complete.
218: */
219:
220: static void
221: input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
222: {
223: Authctxt *authctxt = ctxt;
224: Gssctxt *gssctxt;
225: int authenticated;
226:
227: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
228: fatal("No authentication or GSSAPI context");
229:
230: gssctxt = authctxt->methoddata;
231:
232: /*
1.6 markus 233: * We don't need to check the status, because we're only enabled in
234: * the dispatcher once the exchange is complete
1.1 markus 235: */
236:
237: packet_check_eom();
238:
239: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
240:
241: authctxt->postponed = 0;
242: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
243: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
1.6 markus 244: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
245: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
246: userauth_finish(authctxt, authenticated, "gssapi-with-mic");
247: }
248:
249: static void
250: input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
251: {
252: Authctxt *authctxt = ctxt;
253: Gssctxt *gssctxt;
254: int authenticated = 0;
255: Buffer b;
256: gss_buffer_desc mic, gssbuf;
257: u_int len;
1.7 djm 258:
1.6 markus 259: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
260: fatal("No authentication or GSSAPI context");
1.7 djm 261:
1.6 markus 262: gssctxt = authctxt->methoddata;
1.7 djm 263:
1.6 markus 264: mic.value = packet_get_string(&len);
265: mic.length = len;
1.7 djm 266:
1.6 markus 267: ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
268: "gssapi-with-mic");
1.7 djm 269:
1.6 markus 270: gssbuf.value = buffer_ptr(&b);
271: gssbuf.length = buffer_len(&b);
1.7 djm 272:
1.6 markus 273: if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
274: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
275: else
276: logit("GSSAPI MIC check failed");
277:
278: buffer_free(&b);
279: xfree(mic.value);
1.7 djm 280:
1.6 markus 281: authctxt->postponed = 0;
282: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
283: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
284: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
1.1 markus 285: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
1.6 markus 286: userauth_finish(authctxt, authenticated, "gssapi-with-mic");
1.1 markus 287: }
288:
289: Authmethod method_gssapi = {
1.6 markus 290: "gssapi-with-mic",
1.1 markus 291: userauth_gssapi,
292: &options.gss_authentication
293: };
294:
295: #endif /* GSSAPI */
![[BACK]](/icons/back.gif){kind=icon}
Return to auth2-gss.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh