Annotation of src/usr.bin/ssh/auth2-gss.c, Revision 1.18
1.18 ! djm 1: /* $OpenBSD: auth2-gss.c,v 1.17 2011/03/10 02:52:57 djm Exp $ */
1.1 markus 2:
3: /*
4: * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
1.16 dtucker 27: #ifdef GSSAPI
28:
1.15 deraadt 29: #include <sys/types.h>
1.1 markus 30:
1.15 deraadt 31: #include "xmalloc.h"
32: #include "key.h"
33: #include "hostfile.h"
1.1 markus 34: #include "auth.h"
35: #include "ssh2.h"
36: #include "log.h"
37: #include "dispatch.h"
1.15 deraadt 38: #include "buffer.h"
1.1 markus 39: #include "servconf.h"
40: #include "packet.h"
1.15 deraadt 41: #include "ssh-gss.h"
1.1 markus 42: #include "monitor_wrap.h"
43:
44: extern ServerOptions options;
45:
46: static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
1.6 markus 47: static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
1.1 markus 48: static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
49: static void input_gssapi_errtok(int, u_int32_t, void *);
50:
51: /*
52: * We only support those mechanisms that we know about (ie ones that we know
1.12 stevesk 53: * how to check local user kuserok and the like)
1.1 markus 54: */
55: static int
56: userauth_gssapi(Authctxt *authctxt)
57: {
1.8 avsm 58: gss_OID_desc goid = {0, NULL};
1.1 markus 59: Gssctxt *ctxt = NULL;
60: int mechs;
61: gss_OID_set supported;
62: int present;
63: OM_uint32 ms;
64: u_int len;
1.9 djm 65: u_char *doid = NULL;
1.1 markus 66:
67: if (!authctxt->valid || authctxt->user == NULL)
68: return (0);
69:
70: mechs = packet_get_int();
71: if (mechs == 0) {
72: debug("Mechanism negotiation is not supported");
73: return (0);
74: }
75:
76: ssh_gssapi_supported_oids(&supported);
77: do {
78: mechs--;
79:
80: if (doid)
81: xfree(doid);
82:
1.5 markus 83: present = 0;
1.1 markus 84: doid = packet_get_string(&len);
85:
1.10 djm 86: if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
87: doid[1] == len - 2) {
1.8 avsm 88: goid.elements = doid + 2;
89: goid.length = len - 2;
90: gss_test_oid_set_member(&ms, &goid, supported,
1.5 markus 91: &present);
1.1 markus 92: } else {
1.5 markus 93: logit("Badly formed OID received");
1.1 markus 94: }
95: } while (mechs > 0 && !present);
96:
97: gss_release_oid_set(&ms, &supported);
98:
99: if (!present) {
100: xfree(doid);
1.17 djm 101: authctxt->server_caused_failure = 1;
1.1 markus 102: return (0);
103: }
104:
1.8 avsm 105: if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
1.13 djm 106: if (ctxt != NULL)
107: ssh_gssapi_delete_ctx(&ctxt);
1.3 markus 108: xfree(doid);
1.17 djm 109: authctxt->server_caused_failure = 1;
1.1 markus 110: return (0);
1.3 markus 111: }
1.1 markus 112:
1.12 stevesk 113: authctxt->methoddata = (void *)ctxt;
1.1 markus 114:
115: packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
116:
1.5 markus 117: /* Return the OID that we received */
1.1 markus 118: packet_put_string(doid, len);
119:
120: packet_send();
121: xfree(doid);
122:
123: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
124: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
125: authctxt->postponed = 1;
126:
127: return (0);
128: }
129:
130: static void
131: input_gssapi_token(int type, u_int32_t plen, void *ctxt)
132: {
133: Authctxt *authctxt = ctxt;
134: Gssctxt *gssctxt;
135: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
136: gss_buffer_desc recv_tok;
1.6 markus 137: OM_uint32 maj_status, min_status, flags;
1.1 markus 138: u_int len;
139:
140: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
141: fatal("No authentication or GSSAPI context");
142:
143: gssctxt = authctxt->methoddata;
144: recv_tok.value = packet_get_string(&len);
145: recv_tok.length = len; /* u_int vs. size_t */
146:
147: packet_check_eom();
148:
149: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
1.6 markus 150: &send_tok, &flags));
1.1 markus 151:
152: xfree(recv_tok.value);
153:
154: if (GSS_ERROR(maj_status)) {
155: if (send_tok.length != 0) {
156: packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
157: packet_put_string(send_tok.value, send_tok.length);
158: packet_send();
159: }
160: authctxt->postponed = 0;
161: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.18 ! djm 162: userauth_finish(authctxt, 0, "gssapi-with-mic", NULL);
1.1 markus 163: } else {
164: if (send_tok.length != 0) {
165: packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
166: packet_put_string(send_tok.value, send_tok.length);
167: packet_send();
168: }
169: if (maj_status == GSS_S_COMPLETE) {
170: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.6 markus 171: if (flags & GSS_C_INTEG_FLAG)
172: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
173: &input_gssapi_mic);
174: else
175: dispatch_set(
176: SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
177: &input_gssapi_exchange_complete);
1.1 markus 178: }
179: }
180:
181: gss_release_buffer(&min_status, &send_tok);
182: }
183:
184: static void
185: input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
186: {
187: Authctxt *authctxt = ctxt;
188: Gssctxt *gssctxt;
189: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
190: gss_buffer_desc recv_tok;
191: OM_uint32 maj_status;
1.2 deraadt 192: u_int len;
1.1 markus 193:
194: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
195: fatal("No authentication or GSSAPI context");
196:
197: gssctxt = authctxt->methoddata;
1.2 deraadt 198: recv_tok.value = packet_get_string(&len);
199: recv_tok.length = len;
1.1 markus 200:
201: packet_check_eom();
202:
203: /* Push the error token into GSSAPI to see what it says */
204: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
205: &send_tok, NULL));
206:
207: xfree(recv_tok.value);
208:
209: /* We can't return anything to the client, even if we wanted to */
210: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
211: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
212:
213: /* The client will have already moved on to the next auth */
214:
215: gss_release_buffer(&maj_status, &send_tok);
216: }
217:
218: /*
219: * This is called when the client thinks we've completed authentication.
220: * It should only be enabled in the dispatch handler by the function above,
221: * which only enables it once the GSSAPI exchange is complete.
222: */
223:
224: static void
225: input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
226: {
227: Authctxt *authctxt = ctxt;
228: Gssctxt *gssctxt;
229: int authenticated;
230:
231: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
232: fatal("No authentication or GSSAPI context");
233:
234: gssctxt = authctxt->methoddata;
235:
236: /*
1.6 markus 237: * We don't need to check the status, because we're only enabled in
238: * the dispatcher once the exchange is complete
1.1 markus 239: */
240:
241: packet_check_eom();
242:
243: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
244:
245: authctxt->postponed = 0;
246: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
247: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
1.6 markus 248: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
249: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
1.18 ! djm 250: userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
1.6 markus 251: }
252:
253: static void
254: input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
255: {
256: Authctxt *authctxt = ctxt;
257: Gssctxt *gssctxt;
258: int authenticated = 0;
259: Buffer b;
260: gss_buffer_desc mic, gssbuf;
261: u_int len;
1.7 djm 262:
1.6 markus 263: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
264: fatal("No authentication or GSSAPI context");
1.7 djm 265:
1.6 markus 266: gssctxt = authctxt->methoddata;
1.7 djm 267:
1.6 markus 268: mic.value = packet_get_string(&len);
269: mic.length = len;
1.7 djm 270:
1.6 markus 271: ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
272: "gssapi-with-mic");
1.7 djm 273:
1.6 markus 274: gssbuf.value = buffer_ptr(&b);
275: gssbuf.length = buffer_len(&b);
1.7 djm 276:
1.6 markus 277: if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
278: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
279: else
280: logit("GSSAPI MIC check failed");
281:
282: buffer_free(&b);
283: xfree(mic.value);
1.7 djm 284:
1.6 markus 285: authctxt->postponed = 0;
286: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
287: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
288: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
1.1 markus 289: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
1.18 ! djm 290: userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
1.1 markus 291: }
292:
293: Authmethod method_gssapi = {
1.6 markus 294: "gssapi-with-mic",
1.1 markus 295: userauth_gssapi,
296: &options.gss_authentication
297: };
1.16 dtucker 298: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to auth2-gss.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh