Annotation of src/usr.bin/ssh/auth2-gss.c, Revision 1.32
1.32 ! djm 1: /* $OpenBSD: auth2-gss.c,v 1.31 2021/01/27 10:05:28 djm Exp $ */
1.1 markus 2:
3: /*
4: * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
1.16 dtucker 27: #ifdef GSSAPI
28:
1.15 deraadt 29: #include <sys/types.h>
1.1 markus 30:
1.15 deraadt 31: #include "xmalloc.h"
1.27 markus 32: #include "sshkey.h"
1.15 deraadt 33: #include "hostfile.h"
1.1 markus 34: #include "auth.h"
35: #include "ssh2.h"
36: #include "log.h"
37: #include "dispatch.h"
1.27 markus 38: #include "sshbuf.h"
39: #include "ssherr.h"
1.1 markus 40: #include "servconf.h"
41: #include "packet.h"
1.32 ! djm 42: #include "kex.h"
1.15 deraadt 43: #include "ssh-gss.h"
1.1 markus 44: #include "monitor_wrap.h"
45:
46: extern ServerOptions options;
47:
1.24 markus 48: static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh);
49: static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
50: static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
51: static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
1.1 markus 52:
53: /*
54: * We only support those mechanisms that we know about (ie ones that we know
1.12 stevesk 55: * how to check local user kuserok and the like)
1.1 markus 56: */
57: static int
1.25 markus 58: userauth_gssapi(struct ssh *ssh)
1.1 markus 59: {
1.25 markus 60: Authctxt *authctxt = ssh->authctxt;
1.8 avsm 61: gss_OID_desc goid = {0, NULL};
1.1 markus 62: Gssctxt *ctxt = NULL;
1.27 markus 63: int r, present;
64: u_int mechs;
1.1 markus 65: OM_uint32 ms;
1.27 markus 66: size_t len;
1.9 djm 67: u_char *doid = NULL;
1.1 markus 68:
1.27 markus 69: if ((r = sshpkt_get_u32(ssh, &mechs)) != 0)
1.30 djm 70: fatal_fr(r, "parse packet");
1.27 markus 71:
1.1 markus 72: if (mechs == 0) {
73: debug("Mechanism negotiation is not supported");
74: return (0);
75: }
76:
77: do {
78: mechs--;
79:
1.20 djm 80: free(doid);
1.1 markus 81:
1.5 markus 82: present = 0;
1.27 markus 83: if ((r = sshpkt_get_string(ssh, &doid, &len)) != 0)
1.30 djm 84: fatal_fr(r, "parse oid");
1.1 markus 85:
1.10 djm 86: if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
87: doid[1] == len - 2) {
1.8 avsm 88: goid.elements = doid + 2;
89: goid.length = len - 2;
1.21 djm 90: ssh_gssapi_test_oid_supported(&ms, &goid, &present);
1.1 markus 91: } else {
1.5 markus 92: logit("Badly formed OID received");
1.1 markus 93: }
94: } while (mechs > 0 && !present);
95:
96: if (!present) {
1.20 djm 97: free(doid);
1.17 djm 98: authctxt->server_caused_failure = 1;
1.29 djm 99: return (0);
100: }
101:
102: if (!authctxt->valid || authctxt->user == NULL) {
1.30 djm 103: debug2_f("disabled because of invalid user");
1.29 djm 104: free(doid);
1.1 markus 105: return (0);
106: }
107:
1.8 avsm 108: if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
1.13 djm 109: if (ctxt != NULL)
110: ssh_gssapi_delete_ctx(&ctxt);
1.20 djm 111: free(doid);
1.17 djm 112: authctxt->server_caused_failure = 1;
1.1 markus 113: return (0);
1.3 markus 114: }
1.1 markus 115:
1.12 stevesk 116: authctxt->methoddata = (void *)ctxt;
1.1 markus 117:
1.5 markus 118: /* Return the OID that we received */
1.27 markus 119: if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_GSSAPI_RESPONSE)) != 0 ||
120: (r = sshpkt_put_string(ssh, doid, len)) != 0 ||
121: (r = sshpkt_send(ssh)) != 0)
1.30 djm 122: fatal_fr(r, "send packet");
1.1 markus 123:
1.20 djm 124: free(doid);
1.1 markus 125:
1.25 markus 126: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
127: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
1.1 markus 128: authctxt->postponed = 1;
129:
130: return (0);
131: }
132:
1.22 markus 133: static int
1.24 markus 134: input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 135: {
1.23 markus 136: Authctxt *authctxt = ssh->authctxt;
1.1 markus 137: Gssctxt *gssctxt;
138: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
139: gss_buffer_desc recv_tok;
1.6 markus 140: OM_uint32 maj_status, min_status, flags;
1.27 markus 141: u_char *p;
142: size_t len;
143: int r;
1.1 markus 144:
145: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
146: fatal("No authentication or GSSAPI context");
147:
148: gssctxt = authctxt->methoddata;
1.27 markus 149: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
150: (r = sshpkt_get_end(ssh)) != 0)
1.30 djm 151: fatal_fr(r, "parse packet");
1.1 markus 152:
1.27 markus 153: recv_tok.value = p;
154: recv_tok.length = len;
1.1 markus 155: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
1.6 markus 156: &send_tok, &flags));
1.1 markus 157:
1.27 markus 158: free(p);
1.1 markus 159:
160: if (GSS_ERROR(maj_status)) {
161: if (send_tok.length != 0) {
1.27 markus 162: if ((r = sshpkt_start(ssh,
163: SSH2_MSG_USERAUTH_GSSAPI_ERRTOK)) != 0 ||
164: (r = sshpkt_put_string(ssh, send_tok.value,
165: send_tok.length)) != 0 ||
166: (r = sshpkt_send(ssh)) != 0)
1.30 djm 167: fatal_fr(r, "send ERRTOK packet");
1.1 markus 168: }
169: authctxt->postponed = 0;
1.25 markus 170: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
171: userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
1.1 markus 172: } else {
173: if (send_tok.length != 0) {
1.27 markus 174: if ((r = sshpkt_start(ssh,
175: SSH2_MSG_USERAUTH_GSSAPI_TOKEN)) != 0 ||
176: (r = sshpkt_put_string(ssh, send_tok.value,
177: send_tok.length)) != 0 ||
178: (r = sshpkt_send(ssh)) != 0)
1.30 djm 179: fatal_fr(r, "send TOKEN packet");
1.1 markus 180: }
181: if (maj_status == GSS_S_COMPLETE) {
1.25 markus 182: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.6 markus 183: if (flags & GSS_C_INTEG_FLAG)
1.25 markus 184: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
1.6 markus 185: &input_gssapi_mic);
186: else
1.25 markus 187: ssh_dispatch_set(ssh,
1.6 markus 188: SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
189: &input_gssapi_exchange_complete);
1.1 markus 190: }
191: }
192:
193: gss_release_buffer(&min_status, &send_tok);
1.22 markus 194: return 0;
1.1 markus 195: }
196:
1.22 markus 197: static int
1.24 markus 198: input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 199: {
1.23 markus 200: Authctxt *authctxt = ssh->authctxt;
1.1 markus 201: Gssctxt *gssctxt;
202: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
203: gss_buffer_desc recv_tok;
204: OM_uint32 maj_status;
1.27 markus 205: int r;
1.28 djm 206: u_char *p;
207: size_t len;
1.1 markus 208:
209: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
210: fatal("No authentication or GSSAPI context");
211:
212: gssctxt = authctxt->methoddata;
1.28 djm 213: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
1.27 markus 214: (r = sshpkt_get_end(ssh)) != 0)
1.30 djm 215: fatal_fr(r, "parse packet");
1.28 djm 216: recv_tok.value = p;
217: recv_tok.length = len;
1.1 markus 218:
219: /* Push the error token into GSSAPI to see what it says */
220: maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
221: &send_tok, NULL));
222:
1.20 djm 223: free(recv_tok.value);
1.1 markus 224:
225: /* We can't return anything to the client, even if we wanted to */
1.25 markus 226: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
227: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
1.1 markus 228:
229: /* The client will have already moved on to the next auth */
230:
231: gss_release_buffer(&maj_status, &send_tok);
1.22 markus 232: return 0;
1.1 markus 233: }
234:
235: /*
236: * This is called when the client thinks we've completed authentication.
237: * It should only be enabled in the dispatch handler by the function above,
238: * which only enables it once the GSSAPI exchange is complete.
239: */
240:
1.22 markus 241: static int
1.24 markus 242: input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 243: {
1.23 markus 244: Authctxt *authctxt = ssh->authctxt;
1.28 djm 245: int r, authenticated;
1.26 djm 246: const char *displayname;
1.1 markus 247:
248: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
249: fatal("No authentication or GSSAPI context");
250:
251: /*
1.6 markus 252: * We don't need to check the status, because we're only enabled in
253: * the dispatcher once the exchange is complete
1.1 markus 254: */
255:
1.27 markus 256: if ((r = sshpkt_get_end(ssh)) != 0)
1.30 djm 257: fatal_fr(r, "parse packet");
1.1 markus 258:
259: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
260:
1.26 djm 261: if ((!use_privsep || mm_is_monitor()) &&
262: (displayname = ssh_gssapi_displayname()) != NULL)
263: auth2_record_info(authctxt, "%s", displayname);
264:
1.1 markus 265: authctxt->postponed = 0;
1.25 markus 266: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
267: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
268: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
269: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
270: userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
1.22 markus 271: return 0;
1.6 markus 272: }
273:
1.22 markus 274: static int
1.24 markus 275: input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
1.6 markus 276: {
1.23 markus 277: Authctxt *authctxt = ssh->authctxt;
1.6 markus 278: Gssctxt *gssctxt;
1.27 markus 279: int r, authenticated = 0;
280: struct sshbuf *b;
1.6 markus 281: gss_buffer_desc mic, gssbuf;
1.26 djm 282: const char *displayname;
1.28 djm 283: u_char *p;
284: size_t len;
1.7 djm 285:
1.6 markus 286: if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
287: fatal("No authentication or GSSAPI context");
1.7 djm 288:
1.6 markus 289: gssctxt = authctxt->methoddata;
1.7 djm 290:
1.28 djm 291: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0)
1.30 djm 292: fatal_fr(r, "parse packet");
1.27 markus 293: if ((b = sshbuf_new()) == NULL)
1.30 djm 294: fatal_f("sshbuf_new failed");
1.28 djm 295: mic.value = p;
296: mic.length = len;
1.27 markus 297: ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
1.31 djm 298: "gssapi-with-mic", ssh->kex->session_id);
1.7 djm 299:
1.27 markus 300: if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
1.30 djm 301: fatal_f("sshbuf_mutable_ptr failed");
1.27 markus 302: gssbuf.length = sshbuf_len(b);
1.7 djm 303:
1.6 markus 304: if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
305: authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
306: else
307: logit("GSSAPI MIC check failed");
308:
1.27 markus 309: sshbuf_free(b);
1.20 djm 310: free(mic.value);
1.26 djm 311:
312: if ((!use_privsep || mm_is_monitor()) &&
313: (displayname = ssh_gssapi_displayname()) != NULL)
314: auth2_record_info(authctxt, "%s", displayname);
1.7 djm 315:
1.6 markus 316: authctxt->postponed = 0;
1.25 markus 317: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
318: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
319: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
320: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
321: userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
1.22 markus 322: return 0;
1.1 markus 323: }
324:
325: Authmethod method_gssapi = {
1.6 markus 326: "gssapi-with-mic",
1.1 markus 327: userauth_gssapi,
328: &options.gss_authentication
329: };
1.16 dtucker 330: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to auth2-gss.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh