Annotation of src/usr.bin/ssh/auth2-gss.c, Revision 1.35
1.35 ! djm 1: /* $OpenBSD: auth2-gss.c,v 1.34 2023/03/31 04:22:27 djm Exp $ */
1.1 markus 2:
3: /*
4: * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
1.16 dtucker 27: #ifdef GSSAPI
28:
1.15 deraadt 29: #include <sys/types.h>
1.1 markus 30:
1.15 deraadt 31: #include "xmalloc.h"
1.27 markus 32: #include "sshkey.h"
1.15 deraadt 33: #include "hostfile.h"
1.1 markus 34: #include "auth.h"
35: #include "ssh2.h"
36: #include "log.h"
37: #include "dispatch.h"
1.27 markus 38: #include "sshbuf.h"
39: #include "ssherr.h"
1.1 markus 40: #include "servconf.h"
41: #include "packet.h"
1.32 djm 42: #include "kex.h"
1.15 deraadt 43: #include "ssh-gss.h"
1.1 markus 44: #include "monitor_wrap.h"
45:
1.34 djm 46: #define SSH_GSSAPI_MAX_MECHS 2048
47:
1.1 markus 48: extern ServerOptions options;
1.35 ! djm 49: extern struct authmethod_cfg methodcfg_gssapi;
1.1 markus 50:
1.24 markus 51: static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh);
52: static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
53: static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
54: static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
1.1 markus 55:
56: /*
57: * We only support those mechanisms that we know about (ie ones that we know
1.12 stevesk 58: * how to check local user kuserok and the like)
1.1 markus 59: */
60: static int
1.33 djm 61: userauth_gssapi(struct ssh *ssh, const char *method)
1.1 markus 62: {
1.25 markus 63: Authctxt *authctxt = ssh->authctxt;
1.8 avsm 64: gss_OID_desc goid = {0, NULL};
1.1 markus 65: Gssctxt *ctxt = NULL;
1.27 markus 66: int r, present;
67: u_int mechs;
1.1 markus 68: OM_uint32 ms;
1.27 markus 69: size_t len;
1.9 djm 70: u_char *doid = NULL;
1.1 markus 71:
1.27 markus 72: if ((r = sshpkt_get_u32(ssh, &mechs)) != 0)
1.30 djm 73: fatal_fr(r, "parse packet");
1.27 markus 74:
1.1 markus 75: if (mechs == 0) {
1.34 djm 76: logit_f("mechanism negotiation is not supported");
77: return (0);
78: } else if (mechs > SSH_GSSAPI_MAX_MECHS) {
79: logit_f("too many mechanisms requested %u > %u", mechs,
80: SSH_GSSAPI_MAX_MECHS);
1.1 markus 81: return (0);
82: }
83:
84: do {
85: mechs--;
86:
1.20 djm 87: free(doid);
1.1 markus 88:
1.5 markus 89: present = 0;
1.27 markus 90: if ((r = sshpkt_get_string(ssh, &doid, &len)) != 0)
1.30 djm 91: fatal_fr(r, "parse oid");
1.1 markus 92:
1.10 djm 93: if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
94: doid[1] == len - 2) {
1.8 avsm 95: goid.elements = doid + 2;
96: goid.length = len - 2;
1.21 djm 97: ssh_gssapi_test_oid_supported(&ms, &goid, &present);
1.1 markus 98: } else {
1.34 djm 99: logit_f("badly formed OID received");
1.1 markus 100: }
101: } while (mechs > 0 && !present);
102:
103: if (!present) {
1.20 djm 104: free(doid);
1.17 djm 105: authctxt->server_caused_failure = 1;
1.29 djm 106: return (0);
107: }
108:
109: if (!authctxt->valid || authctxt->user == NULL) {
1.30 djm 110: debug2_f("disabled because of invalid user");
1.29 djm 111: free(doid);
1.1 markus 112: return (0);
113: }
114:
1.35 ! djm 115: if (GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctxt, &goid))) {
1.13 djm 116: if (ctxt != NULL)
117: ssh_gssapi_delete_ctx(&ctxt);
1.20 djm 118: free(doid);
1.17 djm 119: authctxt->server_caused_failure = 1;
1.1 markus 120: return (0);
1.3 markus 121: }
1.1 markus 122:
1.12 stevesk 123: authctxt->methoddata = (void *)ctxt;
1.1 markus 124:
1.5 markus 125: /* Return the OID that we received */
1.27 markus 126: if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_GSSAPI_RESPONSE)) != 0 ||
127: (r = sshpkt_put_string(ssh, doid, len)) != 0 ||
128: (r = sshpkt_send(ssh)) != 0)
1.30 djm 129: fatal_fr(r, "send packet");
1.1 markus 130:
1.20 djm 131: free(doid);
1.1 markus 132:
1.25 markus 133: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
134: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
1.1 markus 135: authctxt->postponed = 1;
136:
137: return (0);
138: }
139:
1.22 markus 140: static int
1.24 markus 141: input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 142: {
1.23 markus 143: Authctxt *authctxt = ssh->authctxt;
1.1 markus 144: Gssctxt *gssctxt;
145: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
146: gss_buffer_desc recv_tok;
1.6 markus 147: OM_uint32 maj_status, min_status, flags;
1.27 markus 148: u_char *p;
149: size_t len;
150: int r;
1.1 markus 151:
1.35 ! djm 152: if (authctxt == NULL)
1.1 markus 153: fatal("No authentication or GSSAPI context");
154:
155: gssctxt = authctxt->methoddata;
1.27 markus 156: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
157: (r = sshpkt_get_end(ssh)) != 0)
1.30 djm 158: fatal_fr(r, "parse packet");
1.1 markus 159:
1.27 markus 160: recv_tok.value = p;
161: recv_tok.length = len;
1.35 ! djm 162: maj_status = mm_ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
! 163: &send_tok, &flags);
1.1 markus 164:
1.27 markus 165: free(p);
1.1 markus 166:
167: if (GSS_ERROR(maj_status)) {
168: if (send_tok.length != 0) {
1.27 markus 169: if ((r = sshpkt_start(ssh,
170: SSH2_MSG_USERAUTH_GSSAPI_ERRTOK)) != 0 ||
171: (r = sshpkt_put_string(ssh, send_tok.value,
172: send_tok.length)) != 0 ||
173: (r = sshpkt_send(ssh)) != 0)
1.30 djm 174: fatal_fr(r, "send ERRTOK packet");
1.1 markus 175: }
176: authctxt->postponed = 0;
1.25 markus 177: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
178: userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
1.1 markus 179: } else {
180: if (send_tok.length != 0) {
1.27 markus 181: if ((r = sshpkt_start(ssh,
182: SSH2_MSG_USERAUTH_GSSAPI_TOKEN)) != 0 ||
183: (r = sshpkt_put_string(ssh, send_tok.value,
184: send_tok.length)) != 0 ||
185: (r = sshpkt_send(ssh)) != 0)
1.30 djm 186: fatal_fr(r, "send TOKEN packet");
1.1 markus 187: }
188: if (maj_status == GSS_S_COMPLETE) {
1.25 markus 189: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
1.6 markus 190: if (flags & GSS_C_INTEG_FLAG)
1.25 markus 191: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
1.6 markus 192: &input_gssapi_mic);
193: else
1.25 markus 194: ssh_dispatch_set(ssh,
1.6 markus 195: SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
196: &input_gssapi_exchange_complete);
1.1 markus 197: }
198: }
199:
200: gss_release_buffer(&min_status, &send_tok);
1.22 markus 201: return 0;
1.1 markus 202: }
203:
1.22 markus 204: static int
1.24 markus 205: input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 206: {
1.23 markus 207: Authctxt *authctxt = ssh->authctxt;
1.1 markus 208: Gssctxt *gssctxt;
209: gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
210: gss_buffer_desc recv_tok;
211: OM_uint32 maj_status;
1.27 markus 212: int r;
1.28 djm 213: u_char *p;
214: size_t len;
1.1 markus 215:
1.35 ! djm 216: if (authctxt == NULL)
1.1 markus 217: fatal("No authentication or GSSAPI context");
218:
219: gssctxt = authctxt->methoddata;
1.28 djm 220: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
1.27 markus 221: (r = sshpkt_get_end(ssh)) != 0)
1.30 djm 222: fatal_fr(r, "parse packet");
1.28 djm 223: recv_tok.value = p;
224: recv_tok.length = len;
1.1 markus 225:
226: /* Push the error token into GSSAPI to see what it says */
1.35 ! djm 227: maj_status = mm_ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
! 228: &send_tok, NULL);
1.1 markus 229:
1.20 djm 230: free(recv_tok.value);
1.1 markus 231:
232: /* We can't return anything to the client, even if we wanted to */
1.25 markus 233: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
234: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
1.1 markus 235:
236: /* The client will have already moved on to the next auth */
237:
238: gss_release_buffer(&maj_status, &send_tok);
1.22 markus 239: return 0;
1.1 markus 240: }
241:
242: /*
243: * This is called when the client thinks we've completed authentication.
244: * It should only be enabled in the dispatch handler by the function above,
245: * which only enables it once the GSSAPI exchange is complete.
246: */
247:
1.22 markus 248: static int
1.24 markus 249: input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
1.1 markus 250: {
1.23 markus 251: Authctxt *authctxt = ssh->authctxt;
1.28 djm 252: int r, authenticated;
1.26 djm 253: const char *displayname;
1.1 markus 254:
1.35 ! djm 255: if (authctxt == NULL)
1.1 markus 256: fatal("No authentication or GSSAPI context");
257:
258: /*
1.6 markus 259: * We don't need to check the status, because we're only enabled in
260: * the dispatcher once the exchange is complete
1.1 markus 261: */
262:
1.27 markus 263: if ((r = sshpkt_get_end(ssh)) != 0)
1.30 djm 264: fatal_fr(r, "parse packet");
1.1 markus 265:
1.35 ! djm 266: authenticated = mm_ssh_gssapi_userok(authctxt->user);
1.26 djm 267:
1.1 markus 268: authctxt->postponed = 0;
1.25 markus 269: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
270: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
271: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
272: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
273: userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
1.22 markus 274: return 0;
1.6 markus 275: }
276:
1.22 markus 277: static int
1.24 markus 278: input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
1.6 markus 279: {
1.23 markus 280: Authctxt *authctxt = ssh->authctxt;
1.6 markus 281: Gssctxt *gssctxt;
1.27 markus 282: int r, authenticated = 0;
283: struct sshbuf *b;
1.6 markus 284: gss_buffer_desc mic, gssbuf;
1.26 djm 285: const char *displayname;
1.28 djm 286: u_char *p;
287: size_t len;
1.7 djm 288:
1.35 ! djm 289: if (authctxt == NULL)
1.6 markus 290: fatal("No authentication or GSSAPI context");
1.7 djm 291:
1.6 markus 292: gssctxt = authctxt->methoddata;
1.7 djm 293:
1.28 djm 294: if ((r = sshpkt_get_string(ssh, &p, &len)) != 0)
1.30 djm 295: fatal_fr(r, "parse packet");
1.27 markus 296: if ((b = sshbuf_new()) == NULL)
1.30 djm 297: fatal_f("sshbuf_new failed");
1.28 djm 298: mic.value = p;
299: mic.length = len;
1.27 markus 300: ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
1.31 djm 301: "gssapi-with-mic", ssh->kex->session_id);
1.7 djm 302:
1.27 markus 303: if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
1.30 djm 304: fatal_f("sshbuf_mutable_ptr failed");
1.27 markus 305: gssbuf.length = sshbuf_len(b);
1.7 djm 306:
1.35 ! djm 307: if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))
! 308: authenticated = mm_ssh_gssapi_userok(authctxt->user);
1.6 markus 309: else
310: logit("GSSAPI MIC check failed");
311:
1.27 markus 312: sshbuf_free(b);
1.20 djm 313: free(mic.value);
1.26 djm 314:
1.6 markus 315: authctxt->postponed = 0;
1.25 markus 316: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
317: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
318: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
319: ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
320: userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
1.22 markus 321: return 0;
1.1 markus 322: }
323:
324: Authmethod method_gssapi = {
1.35 ! djm 325: &methodcfg_gssapi,
1.1 markus 326: userauth_gssapi,
327: };
1.16 dtucker 328: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to auth2-gss.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh