Annotation of src/usr.bin/ssh/auth2-gss.c, Revision 1.29
1.29 ! djm 1: /* $OpenBSD: auth2-gss.c,v 1.28 2018/07/10 09:13:30 djm Exp $ */
1.1 markus 2:
3: /*
4: * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
1.16 dtucker 27: #ifdef GSSAPI
28:
1.15 deraadt 29: #include <sys/types.h>
1.1 markus 30:
1.15 deraadt 31: #include "xmalloc.h"
1.27 markus 32: #include "sshkey.h"
1.15 deraadt 33: #include "hostfile.h"
1.1 markus 34: #include "auth.h"
35: #include "ssh2.h"
36: #include "log.h"
37: #include "dispatch.h"
1.27 markus 38: #include "sshbuf.h"
39: #include "ssherr.h"
1.1 markus 40: #include "servconf.h"
41: #include "packet.h"
1.15 deraadt 42: #include "ssh-gss.h"
1.1 markus 43: #include "monitor_wrap.h"
44:
45: extern ServerOptions options;
46:
1.24 markus 47: static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh);
48: static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
49: static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
50: static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
1.1 markus 51:
52: /*
53: * We only support those mechanisms that we know about (ie ones that we know
1.12 stevesk 54: * how to check local user kuserok and the like)
1.1 markus 55: */
56: static int
1.25 markus 57: userauth_gssapi(struct ssh *ssh)
1.1 markus 58: {
1.25 markus 59: Authctxt *authctxt = ssh->authctxt;
1.8 avsm 60: gss_OID_desc goid = {0, NULL};
1.1 markus 61: Gssctxt *ctxt = NULL;
1.27 markus 62: int r, present;
63: u_int mechs;
1.1 markus 64: OM_uint32 ms;
1.27 markus 65: size_t len;
1.9 djm 66: u_char *doid = NULL;
1.1 markus 67:
1.27 markus 68: if ((r = sshpkt_get_u32(ssh, &mechs)) != 0)
69: fatal("%s: %s", __func__, ssh_err(r));
70:
1.1 markus 71: if (mechs == 0) {
72: debug("Mechanism negotiation is not supported");
73: return (0);
74: }
75:
76: do {
77: mechs--;
78:
1.20 djm 79: free(doid);
1.1 markus 80:
1.5 markus 81: present = 0;
1.27 markus 82: if ((r = sshpkt_get_string(ssh, &doid, &len)) != 0)
83: fatal("%s: %s", __func__, ssh_err(r));
1.1 markus 84:
1.10 djm 85: if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
86: doid[1] == len - 2) {
1.8 avsm 87: goid.elements = doid + 2;
88: goid.length = len - 2;
1.21 djm 89: ssh_gssapi_test_oid_supported(&ms, &goid, &present);
1.1 markus 90: } else {
1.5 markus 91: logit("Badly formed OID received");
1.1 markus 92: }
93: } while (mechs > 0 && !present);
94:
95: if (!present) {
1.20 djm 96: free(doid);
1.17 djm 97: authctxt->server_caused_failure = 1;
1.29 ! djm 98: return (0);
! 99: }
! 100:
! 101: if (!authctxt->valid || authctxt->user == NULL) {
! 102: debug2("%s: disabled because of invalid user", __func__);
! 103: free(doid);
1.1 markus 104: return (0);
105: }
106:
1.8 avsm 107: if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
1.13 djm 108: if (ctxt != NULL)
109: ssh_gssapi_delete_ctx(&ctxt);
1.20 djm 110: free(doid);
1.17 djm 111: authctxt->server_caused_failure = 1;
1.1 markus 112: return (0);
1.3 markus 113: }
1.1 markus 114:
1.12 stevesk 115: authctxt->methoddata = (void *)ctxt;
1.1 markus 116:
1.5 markus 117: /* Return the OID that we received */
1.27 markus 118: if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_GSSAPI_RESPONSE)) != 0 ||
119: (r = sshpkt_put_string(ssh, doid, len)) != 0 ||
120: (r = sshpkt_send(ssh)) != 0)
121: fatal("%s: %s", __func__, ssh_err(r));
1.1 markus 122:
1.20 djm 123: free(doid);
1.1 markus 124:
1.25 markus 125: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
126: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
1.1 markus 127: authctxt->postponed = 1;
128:
129: return (0);
130: }
131:
1.22 markus 132: static int
1.24 markus 133: input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 134: {
1.23 markus 135: Authctxt *authctxt = ssh->authctxt;
1.1 markus 136: Gssctxt *gssctxt;
137: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
138: gss_buffer_desc recv_tok;
1.6 markus 139: OM_uint32 maj_status, min_status, flags;
1.27 markus 140: u_char *p;
141: size_t len;
142: int r;
1.1 markus 143:
144: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
145: fatal("No authentication or GSSAPI context");
146:
147: gssctxt = authctxt->methoddata;
1.27 markus 148: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
149: (r = sshpkt_get_end(ssh)) != 0)
150: fatal("%s: %s", __func__, ssh_err(r));
1.1 markus 151:
1.27 markus 152: recv_tok.value = p;
153: recv_tok.length = len;
1.1 markus 154: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
1.6 markus 155: &send_tok, &flags));
1.1 markus 156:
1.27 markus 157: free(p);
1.1 markus 158:
159: if (GSS_ERROR(maj_status)) {
160: if (send_tok.length != 0) {
1.27 markus 161: if ((r = sshpkt_start(ssh,
162: SSH2_MSG_USERAUTH_GSSAPI_ERRTOK)) != 0 ||
163: (r = sshpkt_put_string(ssh, send_tok.value,
164: send_tok.length)) != 0 ||
165: (r = sshpkt_send(ssh)) != 0)
166: fatal("%s: %s", __func__, ssh_err(r));
1.1 markus 167: }
168: authctxt->postponed = 0;
1.25 markus 169: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
170: userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
1.1 markus 171: } else {
172: if (send_tok.length != 0) {
1.27 markus 173: if ((r = sshpkt_start(ssh,
174: SSH2_MSG_USERAUTH_GSSAPI_TOKEN)) != 0 ||
175: (r = sshpkt_put_string(ssh, send_tok.value,
176: send_tok.length)) != 0 ||
177: (r = sshpkt_send(ssh)) != 0)
178: fatal("%s: %s", __func__, ssh_err(r));
1.1 markus 179: }
180: if (maj_status == GSS_S_COMPLETE) {
1.25 markus 181: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.6 markus 182: if (flags & GSS_C_INTEG_FLAG)
1.25 markus 183: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
1.6 markus 184: &input_gssapi_mic);
185: else
1.25 markus 186: ssh_dispatch_set(ssh,
1.6 markus 187: SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
188: &input_gssapi_exchange_complete);
1.1 markus 189: }
190: }
191:
192: gss_release_buffer(&min_status, &send_tok);
1.22 markus 193: return 0;
1.1 markus 194: }
195:
1.22 markus 196: static int
1.24 markus 197: input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 198: {
1.23 markus 199: Authctxt *authctxt = ssh->authctxt;
1.1 markus 200: Gssctxt *gssctxt;
201: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
202: gss_buffer_desc recv_tok;
203: OM_uint32 maj_status;
1.27 markus 204: int r;
1.28 djm 205: u_char *p;
206: size_t len;
1.1 markus 207:
208: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
209: fatal("No authentication or GSSAPI context");
210:
211: gssctxt = authctxt->methoddata;
1.28 djm 212: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
1.27 markus 213: (r = sshpkt_get_end(ssh)) != 0)
214: fatal("%s: %s", __func__, ssh_err(r));
1.28 djm 215: recv_tok.value = p;
216: recv_tok.length = len;
1.1 markus 217:
218: /* Push the error token into GSSAPI to see what it says */
219: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
220: &send_tok, NULL));
221:
1.20 djm 222: free(recv_tok.value);
1.1 markus 223:
224: /* We can't return anything to the client, even if we wanted to */
1.25 markus 225: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
226: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
1.1 markus 227:
228: /* The client will have already moved on to the next auth */
229:
230: gss_release_buffer(&maj_status, &send_tok);
1.22 markus 231: return 0;
1.1 markus 232: }
233:
234: /*
235: * This is called when the client thinks we've completed authentication.
236: * It should only be enabled in the dispatch handler by the function above,
237: * which only enables it once the GSSAPI exchange is complete.
238: */
239:
1.22 markus 240: static int
1.24 markus 241: input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 242: {
1.23 markus 243: Authctxt *authctxt = ssh->authctxt;
1.28 djm 244: int r, authenticated;
1.26 djm 245: const char *displayname;
1.1 markus 246:
247: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
248: fatal("No authentication or GSSAPI context");
249:
250: /*
1.6 markus 251: * We don't need to check the status, because we're only enabled in
252: * the dispatcher once the exchange is complete
1.1 markus 253: */
254:
1.27 markus 255: if ((r = sshpkt_get_end(ssh)) != 0)
256: fatal("%s: %s", __func__, ssh_err(r));
1.1 markus 257:
258: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
259:
1.26 djm 260: if ((!use_privsep || mm_is_monitor()) &&
261: (displayname = ssh_gssapi_displayname()) != NULL)
262: auth2_record_info(authctxt, "%s", displayname);
263:
1.1 markus 264: authctxt->postponed = 0;
1.25 markus 265: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
266: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
267: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
268: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
269: userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
1.22 markus 270: return 0;
1.6 markus 271: }
272:
1.22 markus 273: static int
1.24 markus 274: input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
1.6 markus 275: {
1.23 markus 276: Authctxt *authctxt = ssh->authctxt;
1.6 markus 277: Gssctxt *gssctxt;
1.27 markus 278: int r, authenticated = 0;
279: struct sshbuf *b;
1.6 markus 280: gss_buffer_desc mic, gssbuf;
1.26 djm 281: const char *displayname;
1.28 djm 282: u_char *p;
283: size_t len;
1.7 djm 284:
1.6 markus 285: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
286: fatal("No authentication or GSSAPI context");
1.7 djm 287:
1.6 markus 288: gssctxt = authctxt->methoddata;
1.7 djm 289:
1.28 djm 290: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0)
1.27 markus 291: fatal("%s: %s", __func__, ssh_err(r));
292: if ((b = sshbuf_new()) == NULL)
293: fatal("%s: sshbuf_new failed", __func__);
1.28 djm 294: mic.value = p;
295: mic.length = len;
1.27 markus 296: ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
1.6 markus 297: "gssapi-with-mic");
1.7 djm 298:
1.27 markus 299: if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
300: fatal("%s: sshbuf_mutable_ptr failed", __func__);
301: gssbuf.length = sshbuf_len(b);
1.7 djm 302:
1.6 markus 303: if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
304: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
305: else
306: logit("GSSAPI MIC check failed");
307:
1.27 markus 308: sshbuf_free(b);
1.20 djm 309: free(mic.value);
1.26 djm 310:
311: if ((!use_privsep || mm_is_monitor()) &&
312: (displayname = ssh_gssapi_displayname()) != NULL)
313: auth2_record_info(authctxt, "%s", displayname);
1.7 djm 314:
1.6 markus 315: authctxt->postponed = 0;
1.25 markus 316: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
317: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
318: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
319: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
320: userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
1.22 markus 321: return 0;
1.1 markus 322: }
323:
324: Authmethod method_gssapi = {
1.6 markus 325: "gssapi-with-mic",
1.1 markus 326: userauth_gssapi,
327: &options.gss_authentication
328: };
1.16 dtucker 329: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to auth2-gss.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh