1/* $OpenBSD: auth2-gss.c,v 1.7 2003/11/21 11:57:03 djm Exp $ */
2
3/*
4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28
29#ifdef GSSAPI
30
31#include "auth.h"
32#include "ssh2.h"
33#include "xmalloc.h"
34#include "log.h"
35#include "dispatch.h"
36#include "servconf.h"
37#include "compat.h"
38#include "packet.h"
39#include "monitor_wrap.h"
40
41#include "ssh-gss.h"
42
43extern ServerOptions options;
44
45static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
46static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
47static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
48static void input_gssapi_errtok(int, u_int32_t, void *);
49
50/*
51 * We only support those mechanisms that we know about (ie ones that we know
52 * how to check local user kuserok and the like
53 */
54static int
55userauth_gssapi(Authctxt *authctxt)
56{
57 gss_OID_desc oid = {0, NULL};
58 Gssctxt *ctxt = NULL;
59 int mechs;
60 gss_OID_set supported;
61 int present;
62 OM_uint32 ms;
63 u_int len;
64 char *doid = NULL;
65
66 if (!authctxt->valid || authctxt->user == NULL)
67 return (0);
68
69 mechs = packet_get_int();
70 if (mechs == 0) {
71 debug("Mechanism negotiation is not supported");
72 return (0);
73 }
74
75 ssh_gssapi_supported_oids(&supported);
76 do {
77 mechs--;
78
79 if (doid)
80 xfree(doid);
81
82 present = 0;
83 doid = packet_get_string(&len);
84
85 if (len > 2 &&
86 doid[0] == SSH_GSS_OIDTYPE &&
87 doid[1] == len - 2) {
88 oid.elements = doid + 2;
89 oid.length = len - 2;
90 gss_test_oid_set_member(&ms, &oid, supported,
91 &present);
92 } else {
93 logit("Badly formed OID received");
94 }
95 } while (mechs > 0 && !present);
96
97 gss_release_oid_set(&ms, &supported);
98
99 if (!present) {
100 xfree(doid);
101 return (0);
102 }
103
104 if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &oid)))) {
105 xfree(doid);
106 return (0);
107 }
108
109 authctxt->methoddata=(void *)ctxt;
110
111 packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
112
113 /* Return the OID that we received */
114 packet_put_string(doid, len);
115
116 packet_send();
117 xfree(doid);
118
119 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
120 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
121 authctxt->postponed = 1;
122
123 return (0);
124}
125
126static void
127input_gssapi_token(int type, u_int32_t plen, void *ctxt)
128{
129 Authctxt *authctxt = ctxt;
130 Gssctxt *gssctxt;
131 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
132 gss_buffer_desc recv_tok;
133 OM_uint32 maj_status, min_status, flags;
134 u_int len;
135
136 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
137 fatal("No authentication or GSSAPI context");
138
139 gssctxt = authctxt->methoddata;
140 recv_tok.value = packet_get_string(&len);
141 recv_tok.length = len; /* u_int vs. size_t */
142
143 packet_check_eom();
144
145 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
146 &send_tok, &flags));
147
148 xfree(recv_tok.value);
149
150 if (GSS_ERROR(maj_status)) {
151 if (send_tok.length != 0) {
152 packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
153 packet_put_string(send_tok.value, send_tok.length);
154 packet_send();
155 }
156 authctxt->postponed = 0;
157 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
158 userauth_finish(authctxt, 0, "gssapi-with-mic");
159 } else {
160 if (send_tok.length != 0) {
161 packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
162 packet_put_string(send_tok.value, send_tok.length);
163 packet_send();
164 }
165 if (maj_status == GSS_S_COMPLETE) {
166 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
167 if (flags & GSS_C_INTEG_FLAG)
168 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
169 &input_gssapi_mic);
170 else
171 dispatch_set(
172 SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
173 &input_gssapi_exchange_complete);
174 }
175 }
176
177 gss_release_buffer(&min_status, &send_tok);
178}
179
180static void
181input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
182{
183 Authctxt *authctxt = ctxt;
184 Gssctxt *gssctxt;
185 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
186 gss_buffer_desc recv_tok;
187 OM_uint32 maj_status;
188 u_int len;
189
190 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
191 fatal("No authentication or GSSAPI context");
192
193 gssctxt = authctxt->methoddata;
194 recv_tok.value = packet_get_string(&len);
195 recv_tok.length = len;
196
197 packet_check_eom();
198
199 /* Push the error token into GSSAPI to see what it says */
200 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
201 &send_tok, NULL));
202
203 xfree(recv_tok.value);
204
205 /* We can't return anything to the client, even if we wanted to */
206 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
207 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
208
209 /* The client will have already moved on to the next auth */
210
211 gss_release_buffer(&maj_status, &send_tok);
212}
213
214/*
215 * This is called when the client thinks we've completed authentication.
216 * It should only be enabled in the dispatch handler by the function above,
217 * which only enables it once the GSSAPI exchange is complete.
218 */
219
220static void
221input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
222{
223 Authctxt *authctxt = ctxt;
224 Gssctxt *gssctxt;
225 int authenticated;
226
227 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
228 fatal("No authentication or GSSAPI context");
229
230 gssctxt = authctxt->methoddata;
231
232 /*
233 * We don't need to check the status, because we're only enabled in
234 * the dispatcher once the exchange is complete
235 */
236
237 packet_check_eom();
238
239 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
240
241 authctxt->postponed = 0;
242 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
243 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
244 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
245 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
246 userauth_finish(authctxt, authenticated, "gssapi-with-mic");
247}
248
249static void
250input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
251{
252 Authctxt *authctxt = ctxt;
253 Gssctxt *gssctxt;
254 int authenticated = 0;
255 Buffer b;
256 gss_buffer_desc mic, gssbuf;
257 u_int len;
258
259 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
260 fatal("No authentication or GSSAPI context");
261
262 gssctxt = authctxt->methoddata;
263
264 mic.value = packet_get_string(&len);
265 mic.length = len;
266
267 ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
268 "gssapi-with-mic");
269
270 gssbuf.value = buffer_ptr(&b);
271 gssbuf.length = buffer_len(&b);
272
273 if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
274 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
275 else
276 logit("GSSAPI MIC check failed");
277
278 buffer_free(&b);
279 xfree(mic.value);
280
281 authctxt->postponed = 0;
282 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
283 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
284 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
285 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
286 userauth_finish(authctxt, authenticated, "gssapi-with-mic");
287}
288
289Authmethod method_gssapi = {
290 "gssapi-with-mic",
291 userauth_gssapi,
292 &options.gss_authentication
293};
294
295#endif /* GSSAPI */
2
3/*
4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28
29#ifdef GSSAPI
30
31#include "auth.h"
32#include "ssh2.h"
33#include "xmalloc.h"
34#include "log.h"
35#include "dispatch.h"
36#include "servconf.h"
37#include "compat.h"
38#include "packet.h"
39#include "monitor_wrap.h"
40
41#include "ssh-gss.h"
42
43extern ServerOptions options;
44
45static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
46static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
47static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
48static void input_gssapi_errtok(int, u_int32_t, void *);
49
50/*
51 * We only support those mechanisms that we know about (ie ones that we know
52 * how to check local user kuserok and the like
53 */
54static int
55userauth_gssapi(Authctxt *authctxt)
56{
57 gss_OID_desc oid = {0, NULL};
58 Gssctxt *ctxt = NULL;
59 int mechs;
60 gss_OID_set supported;
61 int present;
62 OM_uint32 ms;
63 u_int len;
64 char *doid = NULL;
65
66 if (!authctxt->valid || authctxt->user == NULL)
67 return (0);
68
69 mechs = packet_get_int();
70 if (mechs == 0) {
71 debug("Mechanism negotiation is not supported");
72 return (0);
73 }
74
75 ssh_gssapi_supported_oids(&supported);
76 do {
77 mechs--;
78
79 if (doid)
80 xfree(doid);
81
82 present = 0;
83 doid = packet_get_string(&len);
84
85 if (len > 2 &&
86 doid[0] == SSH_GSS_OIDTYPE &&
87 doid[1] == len - 2) {
88 oid.elements = doid + 2;
89 oid.length = len - 2;
90 gss_test_oid_set_member(&ms, &oid, supported,
91 &present);
92 } else {
93 logit("Badly formed OID received");
94 }
95 } while (mechs > 0 && !present);
96
97 gss_release_oid_set(&ms, &supported);
98
99 if (!present) {
100 xfree(doid);
101 return (0);
102 }
103
104 if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &oid)))) {
105 xfree(doid);
106 return (0);
107 }
108
109 authctxt->methoddata=(void *)ctxt;
110
111 packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
112
113 /* Return the OID that we received */
114 packet_put_string(doid, len);
115
116 packet_send();
117 xfree(doid);
118
119 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
120 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
121 authctxt->postponed = 1;
122
123 return (0);
124}
125
126static void
127input_gssapi_token(int type, u_int32_t plen, void *ctxt)
128{
129 Authctxt *authctxt = ctxt;
130 Gssctxt *gssctxt;
131 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
132 gss_buffer_desc recv_tok;
133 OM_uint32 maj_status, min_status, flags;
134 u_int len;
135
136 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
137 fatal("No authentication or GSSAPI context");
138
139 gssctxt = authctxt->methoddata;
140 recv_tok.value = packet_get_string(&len);
141 recv_tok.length = len; /* u_int vs. size_t */
142
143 packet_check_eom();
144
145 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
146 &send_tok, &flags));
147
148 xfree(recv_tok.value);
149
150 if (GSS_ERROR(maj_status)) {
151 if (send_tok.length != 0) {
152 packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
153 packet_put_string(send_tok.value, send_tok.length);
154 packet_send();
155 }
156 authctxt->postponed = 0;
157 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
158 userauth_finish(authctxt, 0, "gssapi-with-mic");
159 } else {
160 if (send_tok.length != 0) {
161 packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
162 packet_put_string(send_tok.value, send_tok.length);
163 packet_send();
164 }
165 if (maj_status == GSS_S_COMPLETE) {
166 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
167 if (flags & GSS_C_INTEG_FLAG)
168 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
169 &input_gssapi_mic);
170 else
171 dispatch_set(
172 SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
173 &input_gssapi_exchange_complete);
174 }
175 }
176
177 gss_release_buffer(&min_status, &send_tok);
178}
179
180static void
181input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
182{
183 Authctxt *authctxt = ctxt;
184 Gssctxt *gssctxt;
185 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
186 gss_buffer_desc recv_tok;
187 OM_uint32 maj_status;
188 u_int len;
189
190 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
191 fatal("No authentication or GSSAPI context");
192
193 gssctxt = authctxt->methoddata;
194 recv_tok.value = packet_get_string(&len);
195 recv_tok.length = len;
196
197 packet_check_eom();
198
199 /* Push the error token into GSSAPI to see what it says */
200 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
201 &send_tok, NULL));
202
203 xfree(recv_tok.value);
204
205 /* We can't return anything to the client, even if we wanted to */
206 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
207 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
208
209 /* The client will have already moved on to the next auth */
210
211 gss_release_buffer(&maj_status, &send_tok);
212}
213
214/*
215 * This is called when the client thinks we've completed authentication.
216 * It should only be enabled in the dispatch handler by the function above,
217 * which only enables it once the GSSAPI exchange is complete.
218 */
219
220static void
221input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
222{
223 Authctxt *authctxt = ctxt;
224 Gssctxt *gssctxt;
225 int authenticated;
226
227 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
228 fatal("No authentication or GSSAPI context");
229
230 gssctxt = authctxt->methoddata;
231
232 /*
233 * We don't need to check the status, because we're only enabled in
234 * the dispatcher once the exchange is complete
235 */
236
237 packet_check_eom();
238
239 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
240
241 authctxt->postponed = 0;
242 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
243 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
244 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
245 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
246 userauth_finish(authctxt, authenticated, "gssapi-with-mic");
247}
248
249static void
250input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
251{
252 Authctxt *authctxt = ctxt;
253 Gssctxt *gssctxt;
254 int authenticated = 0;
255 Buffer b;
256 gss_buffer_desc mic, gssbuf;
257 u_int len;
258
259 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
260 fatal("No authentication or GSSAPI context");
261
262 gssctxt = authctxt->methoddata;
263
264 mic.value = packet_get_string(&len);
265 mic.length = len;
266
267 ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
268 "gssapi-with-mic");
269
270 gssbuf.value = buffer_ptr(&b);
271 gssbuf.length = buffer_len(&b);
272
273 if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
274 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
275 else
276 logit("GSSAPI MIC check failed");
277
278 buffer_free(&b);
279 xfree(mic.value);
280
281 authctxt->postponed = 0;
282 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
283 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
284 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
285 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
286 userauth_finish(authctxt, authenticated, "gssapi-with-mic");
287}
288
289Authmethod method_gssapi = {
290 "gssapi-with-mic",
291 userauth_gssapi,
292 &options.gss_authentication
293};
294
295#endif /* GSSAPI */