[gssapi-openssh.git] / openssh / gss-serv-gsi.c

/*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#ifdef GSSAPI
#ifdef GSI

#include <sys/types.h>

#include <stdarg.h>
#include <string.h>

#include "xmalloc.h"
#include "key.h"
#include "hostfile.h"
#include "auth.h"
#include "log.h"
#include "servconf.h"

#include "buffer.h"
#include "ssh-gss.h"

extern ServerOptions options;

#include <globus_gss_assist.h>

static int ssh_gssapi_gsi_userok(ssh_gssapi_client *client, char *name);
static int ssh_gssapi_gsi_localname(ssh_gssapi_client *client, char **user);
static void ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client);

ssh_gssapi_mech gssapi_gsi_mech = {
	"dZuIebMjgUqaxvbF7hDbAw==",
	"GSI",
	{9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"},
	NULL,
	&ssh_gssapi_gsi_userok,
	&ssh_gssapi_gsi_localname,
	&ssh_gssapi_gsi_storecreds
};

/*
 * Check if this user is OK to login under GSI. User has been authenticated
 * as identity in global 'client_name.value' and is trying to log in as passed
 * username in 'name'.
 *
 * Returns non-zero if user is authorized, 0 otherwise.
 */
static int
ssh_gssapi_gsi_userok(ssh_gssapi_client *client, char *name)
{
    int authorized = 0;
    globus_result_t res;
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    char lname[256] = "";
#endif
    
#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
    if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	return 0;
    }
#endif

/* use new globus_gss_assist_map_and_authorize() interface if available */
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    debug("calling globus_gss_assist_map_and_authorize()");
    if (GLOBUS_SUCCESS !=
        (res = globus_gss_assist_map_and_authorize(client->context, "ssh",
                                                   name, lname, 256))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
    } else if (lname && lname[0] && strcmp(name, lname) != 0) {
        debug("GSI user maps to %s, not %s", lname, name);
    } else {
        authorized = 1;
    }
#else
    debug("calling globus_gss_assist_userok()");
    if (GLOBUS_SUCCESS !=
        (res = (globus_gss_assist_userok(client->displayname.value,
                                         name)))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
    } else {
        authorized = 1;
    }
#endif
    
    logit("GSI user %s is%s authorized as target user %s",
	(char *) client->displayname.value, (authorized ? "" : " not"), name);
    
    return authorized;
}

/*
 * Return the local username associated with the GSI credentials.
 */
int
ssh_gssapi_gsi_localname(ssh_gssapi_client *client, char **user)
{
    globus_result_t res;
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    char lname[256] = "";
#endif

#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
    if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	return 0;
    }
#endif

/* use new globus_gss_assist_map_and_authorize() interface if available */
#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
    debug("calling globus_gss_assist_map_and_authorize()");
    if (GLOBUS_SUCCESS !=
        (res = globus_gss_assist_map_and_authorize(client->context, "ssh",
                                                   NULL, lname, 256))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
        logit("failed to map GSI user %s", (char *)client->displayname.value);
        return 0;
    }
    *user = strdup(lname);
#else
    debug("calling globus_gss_assist_gridmap()");
    if (GLOBUS_SUCCESS !=
        (res = globus_gss_assist_gridmap(client->displayname.value, user))) {
        debug("%s", globus_error_print_chain(globus_error_get(res)));
        logit("failed to map GSI user %s", (char *)client->displayname.value);
        return 0;
    }
#endif

    logit("GSI user %s mapped to target user %s",
          (char *) client->displayname.value, *user);

    return 1;
}

/*
 * Export GSI credentials to disk.
 */
static void
ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client)
{
	OM_uint32	major_status;
	OM_uint32	minor_status;
	gss_buffer_desc	export_cred = GSS_C_EMPTY_BUFFER;
	char *		p;
	
	if (!client || !client->creds) {
	    return;
	}

	major_status = gss_export_cred(&minor_status,
				       client->creds,
				       GSS_C_NO_OID,
				       1,
				       &export_cred);
	if (GSS_ERROR(major_status) && major_status != GSS_S_UNAVAILABLE) {
	    Gssctxt *ctx;
	    ssh_gssapi_build_ctx(&ctx);
	    ctx->major = major_status;
	    ctx->minor = minor_status;
	    ssh_gssapi_set_oid(ctx, &gssapi_gsi_mech.oid);
	    ssh_gssapi_error(ctx);
	    ssh_gssapi_delete_ctx(&ctx);
	    return;
	}
	
	p = strchr((char *) export_cred.value, '=');
	if (p == NULL) {
	    logit("Failed to parse exported credentials string '%.100s'",
		(char *)export_cred.value);
	    gss_release_buffer(&minor_status, &export_cred);
	    return;
	}
	*p++ = '\0';
	if (strcmp((char *)export_cred.value,"X509_USER_DELEG_PROXY") == 0) {
	    client->store.envvar = strdup("X509_USER_PROXY");
	} else {
	    client->store.envvar = strdup((char *)export_cred.value);
	}
	if (access(p, R_OK) == 0) {
        if (client->store.filename) {
            if (rename(p, client->store.filename) < 0) {
                logit("Failed to rename %s to %s: %s", p,
                      client->store.filename, strerror(errno));
                xfree(client->store.filename);
                client->store.filename = strdup(p);
            } else {
                p = client->store.filename;
            }
        } else {
            client->store.filename = strdup(p);
        }
	}
	client->store.envval = strdup(p);
#ifdef USE_PAM
	if (options.use_pam)
	    do_pam_putenv(client->store.envvar, client->store.envval);
#endif
	gss_release_buffer(&minor_status, &export_cred);
}

#endif /* GSI */
#endif /* GSSAPI */
Commit	Line	Data
88928908	1	/*
	2	* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
	14	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	15	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	16	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	17	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	18	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	19	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	20	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	21	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	22	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	23	*/
	24
	25	#include "includes.h"
	26
	27	#ifdef GSSAPI
	28	#ifdef GSI
	29
2e437378	30	#include <sys/types.h>
	31
	32	#include <stdarg.h>
	33	#include <string.h>
	34
88928908	35	#include "xmalloc.h"
2e437378	36	#include "key.h"
	37	#include "hostfile.h"
	38	#include "auth.h"
88928908	39	#include "log.h"
	40	#include "servconf.h"
	41
2e437378	42	#include "buffer.h"
88928908	43	#include "ssh-gss.h"
88928908	44
416fd2a8	45	extern ServerOptions options;
416fd2a8	46
88928908	47	#include <globus_gss_assist.h>
	48
	49	static int ssh_gssapi_gsi_userok(ssh_gssapi_client client, char name);
	50	static int ssh_gssapi_gsi_localname(ssh_gssapi_client client, char *user);
	51	static void ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client);
	52
88928908	53	ssh_gssapi_mech gssapi_gsi_mech = {
	54	"dZuIebMjgUqaxvbF7hDbAw==",
	55	"GSI",
	56	{9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"},
	57	NULL,
	58	&ssh_gssapi_gsi_userok,
	59	&ssh_gssapi_gsi_localname,
	60	&ssh_gssapi_gsi_storecreds
	61	};
	62
	63	/*
	64	* Check if this user is OK to login under GSI. User has been authenticated
	65	* as identity in global 'client_name.value' and is trying to log in as passed
	66	* username in 'name'.
	67	*
	68	* Returns non-zero if user is authorized, 0 otherwise.
	69	*/
	70	static int
	71	ssh_gssapi_gsi_userok(ssh_gssapi_client client, char name)
	72	{
	73	int authorized = 0;
e00da40d	74	globus_result_t res;
	75	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	76	char lname[256] = "";
	77	#endif
88928908	78
	79	#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
	80	if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	81	return 0;
	82	}
	83	#endif
	84
e00da40d	85	/* use new globus_gss_assist_map_and_authorize() interface if available */
	86	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	87	debug("calling globus_gss_assist_map_and_authorize()");
	88	if (GLOBUS_SUCCESS !=
	89	(res = globus_gss_assist_map_and_authorize(client->context, "ssh",
	90	name, lname, 256))) {
	91	debug("%s", globus_error_print_chain(globus_error_get(res)));
2d0c45d0	92	} else if (lname && lname[0] && strcmp(name, lname) != 0) {
e00da40d	93	debug("GSI user maps to %s, not %s", lname, name);
	94	} else {
	95	authorized = 1;
	96	}
	97	#else
	98	debug("calling globus_gss_assist_userok()");
	99	if (GLOBUS_SUCCESS !=
	100	(res = (globus_gss_assist_userok(client->displayname.value,
	101	name)))) {
	102	debug("%s", globus_error_print_chain(globus_error_get(res)));
	103	} else {
	104	authorized = 1;
	105	}
	106	#endif
88928908	107
70791e56	108	logit("GSI user %s is%s authorized as target user %s",
70791e56	109	(char *) client->displayname.value, (authorized ? "" : " not"), name);
88928908	110
	111	return authorized;
	112	}
	113
	114	/*
	115	* Return the local username associated with the GSI credentials.
	116	*/
	117	int
	118	ssh_gssapi_gsi_localname(ssh_gssapi_client client, char *user)
	119	{
e00da40d	120	globus_result_t res;
	121	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	122	char lname[256] = "";
	123	#endif
	124
88928908	125	#ifdef GLOBUS_GSI_GSS_ASSIST_MODULE
	126	if (globus_module_activate(GLOBUS_GSI_GSS_ASSIST_MODULE) != 0) {
	127	return 0;
	128	}
	129	#endif
e00da40d	130
	131	/* use new globus_gss_assist_map_and_authorize() interface if available */
	132	#ifdef HAVE_GLOBUS_GSS_ASSIST_MAP_AND_AUTHORIZE
	133	debug("calling globus_gss_assist_map_and_authorize()");
	134	if (GLOBUS_SUCCESS !=
	135	(res = globus_gss_assist_map_and_authorize(client->context, "ssh",
	136	NULL, lname, 256))) {
	137	debug("%s", globus_error_print_chain(globus_error_get(res)));
	138	logit("failed to map GSI user %s", (char *)client->displayname.value);
	139	return 0;
	140	}
	141	*user = strdup(lname);
	142	#else
	143	debug("calling globus_gss_assist_gridmap()");
	144	if (GLOBUS_SUCCESS !=
	145	(res = globus_gss_assist_gridmap(client->displayname.value, user))) {
	146	debug("%s", globus_error_print_chain(globus_error_get(res)));
	147	logit("failed to map GSI user %s", (char *)client->displayname.value);
	148	return 0;
	149	}
	150	#endif
	151
	152	logit("GSI user %s mapped to target user %s",
	153	(char ) client->displayname.value, user);
	154
	155	return 1;
88928908	156	}
	157
	158	/*
	159	* Export GSI credentials to disk.
	160	*/
	161	static void
	162	ssh_gssapi_gsi_storecreds(ssh_gssapi_client *client)
	163	{
	164	OM_uint32 major_status;
	165	OM_uint32 minor_status;
	166	gss_buffer_desc export_cred = GSS_C_EMPTY_BUFFER;
	167	char * p;
	168
	169	if (!client \|\| !client->creds) {
	170	return;
	171	}
	172
	173	major_status = gss_export_cred(&minor_status,
	174	client->creds,
	175	GSS_C_NO_OID,
	176	1,
	177	&export_cred);
	178	if (GSS_ERROR(major_status) && major_status != GSS_S_UNAVAILABLE) {
	179	Gssctxt *ctx;
	180	ssh_gssapi_build_ctx(&ctx);
	181	ctx->major = major_status;
	182	ctx->minor = minor_status;
	183	ssh_gssapi_set_oid(ctx, &gssapi_gsi_mech.oid);
	184	ssh_gssapi_error(ctx);
	185	ssh_gssapi_delete_ctx(&ctx);
	186	return;
	187	}
	188
	189	p = strchr((char *) export_cred.value, '=');
	190	if (p == NULL) {
70791e56	191	logit("Failed to parse exported credentials string '%.100s'",
88928908	192	(char *)export_cred.value);
	193	gss_release_buffer(&minor_status, &export_cred);
	194	return;
	195	}
	196	*p++ = '\0';
	197	if (strcmp((char *)export_cred.value,"X509_USER_DELEG_PROXY") == 0) {
	198	client->store.envvar = strdup("X509_USER_PROXY");
	199	} else {
	200	client->store.envvar = strdup((char *)export_cred.value);
	201	}
2e437378	202	if (access(p, R_OK) == 0) {
	203	if (client->store.filename) {
	204	if (rename(p, client->store.filename) < 0) {
	205	logit("Failed to rename %s to %s: %s", p,
	206	client->store.filename, strerror(errno));
	207	xfree(client->store.filename);
	208	client->store.filename = strdup(p);
	209	} else {
	210	p = client->store.filename;
	211	}
	212	} else {
	213	client->store.filename = strdup(p);
	214	}
	215	}
88928908	216	client->store.envval = strdup(p);
88928908	217	#ifdef USE_PAM
416fd2a8	218	if (options.use_pam)
416fd2a8	219	do_pam_putenv(client->store.envvar, client->store.envval);
88928908	220	#endif
88928908	221	gss_release_buffer(&minor_status, &export_cred);
	222	}
	223
	224	#endif /* GSI */
	225	#endif /* GSSAPI */