Annotation of src/usr.bin/ssh/auth2-gss.c, Revision 1.22
1.22 ! markus 1: /* $OpenBSD: auth2-gss.c,v 1.21 2014/02/26 20:28:44 djm Exp $ */
1.1 markus 2:
3: /*
4: * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
1.16 dtucker 27: #ifdef GSSAPI
28:
1.15 deraadt 29: #include <sys/types.h>
1.1 markus 30:
1.15 deraadt 31: #include "xmalloc.h"
32: #include "key.h"
33: #include "hostfile.h"
1.1 markus 34: #include "auth.h"
35: #include "ssh2.h"
36: #include "log.h"
37: #include "dispatch.h"
1.15 deraadt 38: #include "buffer.h"
1.1 markus 39: #include "servconf.h"
40: #include "packet.h"
1.15 deraadt 41: #include "ssh-gss.h"
1.1 markus 42: #include "monitor_wrap.h"
43:
44: extern ServerOptions options;
45:
1.22 ! markus 46: static int input_gssapi_token(int type, u_int32_t plen, void *ctxt);
! 47: static int input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
! 48: static int input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
! 49: static int input_gssapi_errtok(int, u_int32_t, void *);
1.1 markus 50:
51: /*
52: * We only support those mechanisms that we know about (ie ones that we know
1.12 stevesk 53: * how to check local user kuserok and the like)
1.1 markus 54: */
55: static int
56: userauth_gssapi(Authctxt *authctxt)
57: {
1.8 avsm 58: gss_OID_desc goid = {0, NULL};
1.1 markus 59: Gssctxt *ctxt = NULL;
60: int mechs;
61: int present;
62: OM_uint32 ms;
63: u_int len;
1.9 djm 64: u_char *doid = NULL;
1.1 markus 65:
66: if (!authctxt->valid || authctxt->user == NULL)
67: return (0);
68:
69: mechs = packet_get_int();
70: if (mechs == 0) {
71: debug("Mechanism negotiation is not supported");
72: return (0);
73: }
74:
75: do {
76: mechs--;
77:
1.20 djm 78: free(doid);
1.1 markus 79:
1.5 markus 80: present = 0;
1.1 markus 81: doid = packet_get_string(&len);
82:
1.10 djm 83: if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
84: doid[1] == len - 2) {
1.8 avsm 85: goid.elements = doid + 2;
86: goid.length = len - 2;
1.21 djm 87: ssh_gssapi_test_oid_supported(&ms, &goid, &present);
1.1 markus 88: } else {
1.5 markus 89: logit("Badly formed OID received");
1.1 markus 90: }
91: } while (mechs > 0 && !present);
92:
93: if (!present) {
1.20 djm 94: free(doid);
1.17 djm 95: authctxt->server_caused_failure = 1;
1.1 markus 96: return (0);
97: }
98:
1.8 avsm 99: if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
1.13 djm 100: if (ctxt != NULL)
101: ssh_gssapi_delete_ctx(&ctxt);
1.20 djm 102: free(doid);
1.17 djm 103: authctxt->server_caused_failure = 1;
1.1 markus 104: return (0);
1.3 markus 105: }
1.1 markus 106:
1.12 stevesk 107: authctxt->methoddata = (void *)ctxt;
1.1 markus 108:
109: packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
110:
1.5 markus 111: /* Return the OID that we received */
1.1 markus 112: packet_put_string(doid, len);
113:
114: packet_send();
1.20 djm 115: free(doid);
1.1 markus 116:
117: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
118: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
119: authctxt->postponed = 1;
120:
121: return (0);
122: }
123:
1.22 ! markus 124: static int
1.1 markus 125: input_gssapi_token(int type, u_int32_t plen, void *ctxt)
126: {
127: Authctxt *authctxt = ctxt;
128: Gssctxt *gssctxt;
129: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
130: gss_buffer_desc recv_tok;
1.6 markus 131: OM_uint32 maj_status, min_status, flags;
1.1 markus 132: u_int len;
133:
134: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
135: fatal("No authentication or GSSAPI context");
136:
137: gssctxt = authctxt->methoddata;
138: recv_tok.value = packet_get_string(&len);
139: recv_tok.length = len; /* u_int vs. size_t */
140:
141: packet_check_eom();
142:
143: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
1.6 markus 144: &send_tok, &flags));
1.1 markus 145:
1.20 djm 146: free(recv_tok.value);
1.1 markus 147:
148: if (GSS_ERROR(maj_status)) {
149: if (send_tok.length != 0) {
150: packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
151: packet_put_string(send_tok.value, send_tok.length);
152: packet_send();
153: }
154: authctxt->postponed = 0;
155: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.18 djm 156: userauth_finish(authctxt, 0, "gssapi-with-mic", NULL);
1.1 markus 157: } else {
158: if (send_tok.length != 0) {
159: packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
160: packet_put_string(send_tok.value, send_tok.length);
161: packet_send();
162: }
163: if (maj_status == GSS_S_COMPLETE) {
164: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.6 markus 165: if (flags & GSS_C_INTEG_FLAG)
166: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
167: &input_gssapi_mic);
168: else
169: dispatch_set(
170: SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
171: &input_gssapi_exchange_complete);
1.1 markus 172: }
173: }
174:
175: gss_release_buffer(&min_status, &send_tok);
1.22 ! markus 176: return 0;
1.1 markus 177: }
178:
1.22 ! markus 179: static int
1.1 markus 180: input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
181: {
182: Authctxt *authctxt = ctxt;
183: Gssctxt *gssctxt;
184: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
185: gss_buffer_desc recv_tok;
186: OM_uint32 maj_status;
1.2 deraadt 187: u_int len;
1.1 markus 188:
189: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
190: fatal("No authentication or GSSAPI context");
191:
192: gssctxt = authctxt->methoddata;
1.2 deraadt 193: recv_tok.value = packet_get_string(&len);
194: recv_tok.length = len;
1.1 markus 195:
196: packet_check_eom();
197:
198: /* Push the error token into GSSAPI to see what it says */
199: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
200: &send_tok, NULL));
201:
1.20 djm 202: free(recv_tok.value);
1.1 markus 203:
204: /* We can't return anything to the client, even if we wanted to */
205: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
206: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
207:
208: /* The client will have already moved on to the next auth */
209:
210: gss_release_buffer(&maj_status, &send_tok);
1.22 ! markus 211: return 0;
1.1 markus 212: }
213:
214: /*
215: * This is called when the client thinks we've completed authentication.
216: * It should only be enabled in the dispatch handler by the function above,
217: * which only enables it once the GSSAPI exchange is complete.
218: */
219:
1.22 ! markus 220: static int
1.1 markus 221: input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
222: {
223: Authctxt *authctxt = ctxt;
224: int authenticated;
225:
226: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
227: fatal("No authentication or GSSAPI context");
228:
229: /*
1.6 markus 230: * We don't need to check the status, because we're only enabled in
231: * the dispatcher once the exchange is complete
1.1 markus 232: */
233:
234: packet_check_eom();
235:
236: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
237:
238: authctxt->postponed = 0;
239: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
240: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
1.6 markus 241: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
242: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
1.18 djm 243: userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
1.22 ! markus 244: return 0;
1.6 markus 245: }
246:
1.22 ! markus 247: static int
1.6 markus 248: input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
249: {
250: Authctxt *authctxt = ctxt;
251: Gssctxt *gssctxt;
252: int authenticated = 0;
253: Buffer b;
254: gss_buffer_desc mic, gssbuf;
255: u_int len;
1.7 djm 256:
1.6 markus 257: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
258: fatal("No authentication or GSSAPI context");
1.7 djm 259:
1.6 markus 260: gssctxt = authctxt->methoddata;
1.7 djm 261:
1.6 markus 262: mic.value = packet_get_string(&len);
263: mic.length = len;
1.7 djm 264:
1.6 markus 265: ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
266: "gssapi-with-mic");
1.7 djm 267:
1.6 markus 268: gssbuf.value = buffer_ptr(&b);
269: gssbuf.length = buffer_len(&b);
1.7 djm 270:
1.6 markus 271: if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
272: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
273: else
274: logit("GSSAPI MIC check failed");
275:
276: buffer_free(&b);
1.20 djm 277: free(mic.value);
1.7 djm 278:
1.6 markus 279: authctxt->postponed = 0;
280: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
281: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
282: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
1.1 markus 283: dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
1.18 djm 284: userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
1.22 ! markus 285: return 0;
1.1 markus 286: }
287:
288: Authmethod method_gssapi = {
1.6 markus 289: "gssapi-with-mic",
1.1 markus 290: userauth_gssapi,
291: &options.gss_authentication
292: };
1.16 dtucker 293: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to auth2-gss.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh