[gssapi-openssh.git] / openssh / gss-genr.c

/*	$OpenBSD: gss-genr.c,v 1.3 2003/11/21 11:57:03 djm Exp $	*/

/*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#ifdef GSSAPI

#include "xmalloc.h"
#include "buffer.h"
#include "bufaux.h"
#include "compat.h"
#include <openssl/evp.h>
#include "kex.h"
#include "log.h"
#include "monitor_wrap.h"
#include "canohost.h"
#include "ssh2.h"

#include "ssh-gss.h"

extern u_char *session_id2;
extern u_int session_id2_len;

typedef struct {
	char *encoded;
	gss_OID oid;
} ssh_gss_kex_mapping;
	
static ssh_gss_kex_mapping *gss_enc2oid;

/* Return a list of the gss-group1-sha1-x mechanisms supported by this
 * program.
 *
 * On the client side, we don't need to worry about whether we 'know'
 * about the mechanism or not - we assume that any mechanism that we've been
 * linked against is suitable for inclusion.
 *
 * XXX - We might want to make this configurable in the future, so as to
 * XXX - allow the user control over which mechanisms to use.
 */
 
char * 
ssh_gssapi_client_mechanisms(char *host) {
	gss_OID_set 	supported;
	OM_uint32	min_status;
	Buffer		buf;
	int 		i = 0;
	char 		*mechs;
	char		*encoded;
	int		enclen;
	char		digest[EVP_MAX_MD_SIZE];
	char		deroid[2];
	const EVP_MD	*evp_md = EVP_md5();
	EVP_MD_CTX	md;
	int 		oidpos=0;
	
	if (datafellows & SSH_OLD_GSSAPI) return NULL;
	
	gss_indicate_mechs(&min_status,&supported);
	if (datafellows & SSH_BUG_GSSAPI_BER) {
		gss_enc2oid=xmalloc(sizeof(ssh_gss_kex_mapping)
					*((supported->count*2)+1));
	} else {
		gss_enc2oid=xmalloc(sizeof(ssh_gss_kex_mapping)
					*(supported->count+1));
	}
	
	buffer_init(&buf);


	for (i=0;i<supported->count;i++) {

		gss_enc2oid[oidpos].encoded=NULL;
		
		if (supported->elements[i].length<128 &&
		    ssh_gssapi_check_mechanism(&(supported->elements[i]),host)) {

			/* Earlier versions of this code interpreted the
			 * spec incorrectly with regard to OID encoding. They
			 * also mis-encoded the krb5 OID. The following
			 * _temporary_ code interfaces with these broken
			 * servers */

			if (datafellows & SSH_BUG_GSSAPI_BER) {
				char *bodge=NULL;
				gss_OID_desc krb5oid={9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"};
				gss_OID_desc gsioid={9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"};
				
				if (supported->elements[i].length==krb5oid.length &&
				    memcmp(supported->elements[i].elements,
				    	   krb5oid.elements, krb5oid.length)==0) {
					bodge="Se3H81ismmOC3OE+FwYCiQ==";
				}
				
				if (supported->elements[i].length==gsioid.length &&
				    memcmp(supported->elements[i].elements,
				    	   gsioid.elements, gsioid.length)==0) {
					bodge="N3+k7/4wGxHyuP8Yxi4RhA==";
				}

				if (bodge) {				
					if (oidpos!=0) {
						buffer_put_char(&buf,',');
					}
				
					buffer_append(&buf, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1);
					buffer_append(&buf, bodge, strlen(bodge));

					gss_enc2oid[oidpos].oid=&(supported->elements[i]);
					gss_enc2oid[oidpos].encoded=bodge;
			
					oidpos++;
				}
			}
			
			/* Add the required DER encoding octets and MD5 hash */
			deroid[0]=0x06; /* Object Identifier */
			deroid[1]=supported->elements[i].length;

			EVP_DigestInit(&md, evp_md);
			EVP_DigestUpdate(&md,deroid,2);
			EVP_DigestUpdate(&md,
					 supported->elements[i].elements,
					 supported->elements[i].length);
			EVP_DigestFinal(&md, digest, NULL);
			
			/* Base64 encode it */
			encoded=xmalloc(EVP_MD_size(evp_md)*2);
			enclen=__b64_ntop(digest, EVP_MD_size(evp_md),
				          encoded,EVP_MD_size(evp_md)*2);
			if (oidpos!=0) {
				buffer_put_char(&buf,',');
			}	
			buffer_append(&buf, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1);
			buffer_append(&buf, encoded, enclen);

			debug("Mechanism encoded as %s",encoded);

			gss_enc2oid[oidpos].oid=&(supported->elements[i]);
			gss_enc2oid[oidpos].encoded=encoded;			
			oidpos++;
		}
	}
	gss_enc2oid[oidpos].oid=NULL;
	gss_enc2oid[oidpos].encoded=NULL;
	
	buffer_put_char(&buf,'\0');
	
	mechs=xmalloc(buffer_len(&buf));
	buffer_get(&buf,mechs,buffer_len(&buf));
	buffer_free(&buf);
	if (strlen(mechs)==0)
		return(NULL);
	else
		return(mechs);
}

gss_OID
ssh_gssapi_client_id_kex(Gssctxt *ctx, char *name) {
	int i=0;
	
	if (strncmp(name, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1) !=0) {
		return(NULL);
	}
	
	name+=sizeof(KEX_GSS_SHA1)-1; /* Move to the start of the ID string */
	
	while (gss_enc2oid[i].encoded!=NULL &&
	       	strcmp(name,gss_enc2oid[i].encoded)!=0) {
	      	i++;
	}
	
	if (gss_enc2oid[i].oid!=NULL) {
		ssh_gssapi_set_oid(ctx,gss_enc2oid[i].oid);
	}

	return gss_enc2oid[i].oid;
}

/* Check that the OID in a data stream matches that in the context */
int
ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
{
	return (ctx != NULL && ctx->oid != GSS_C_NO_OID &&
	    ctx->oid->length == len &&
	    memcmp(ctx->oid->elements, data, len) == 0);
}

/* Set the contexts OID from a data stream */
void
ssh_gssapi_set_oid_data(Gssctxt *ctx, void *data, size_t len)
{
	if (ctx->oid != GSS_C_NO_OID) {
		xfree(ctx->oid->elements);
		xfree(ctx->oid);
	}
	ctx->oid = xmalloc(sizeof(gss_OID_desc));
	ctx->oid->length = len;
	ctx->oid->elements = xmalloc(len);
	memcpy(ctx->oid->elements, data, len);
}

/* Set the contexts OID */
void
ssh_gssapi_set_oid(Gssctxt *ctx, gss_OID oid)
{
	ssh_gssapi_set_oid_data(ctx, oid->elements, oid->length);
}

/* All this effort to report an error ... */
void
ssh_gssapi_error(Gssctxt *ctxt)
{
	debug("%s", ssh_gssapi_last_error(ctxt, NULL, NULL));
}

char *
ssh_gssapi_last_error(Gssctxt *ctxt,
		      OM_uint32 *major_status, OM_uint32 *minor_status)
{
	OM_uint32 lmin;
	gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
	OM_uint32 ctx;
	Buffer b;
	char *ret;

	buffer_init(&b);

	if (major_status != NULL)
		*major_status = ctxt->major;
	if (minor_status != NULL)
		*minor_status = ctxt->minor;

	ctx = 0;
	/* The GSSAPI error */
	do {
		gss_display_status(&lmin, ctxt->major,
		    GSS_C_GSS_CODE, ctxt->oid, &ctx, &msg);

		buffer_append(&b, msg.value, msg.length);
		buffer_put_char(&b, '\n');

		gss_release_buffer(&lmin, &msg);
	} while (ctx != 0);

	/* The mechanism specific error */
	do {
		gss_display_status(&lmin, ctxt->minor,
		    GSS_C_MECH_CODE, ctxt->oid, &ctx, &msg);

		buffer_append(&b, msg.value, msg.length);
		buffer_put_char(&b, '\n');

		gss_release_buffer(&lmin, &msg);
	} while (ctx != 0);

	buffer_put_char(&b, '\0');
	ret = xmalloc(buffer_len(&b));
	buffer_get(&b, ret, buffer_len(&b));
	buffer_free(&b);
	return (ret);
}

/*
 * Initialise our GSSAPI context. We use this opaque structure to contain all
 * of the data which both the client and server need to persist across
 * {accept,init}_sec_context calls, so that when we do it from the userauth
 * stuff life is a little easier
 */
void
ssh_gssapi_build_ctx(Gssctxt **ctx)
{
	*ctx = xmalloc(sizeof (Gssctxt));
	(*ctx)->major = 0;
	(*ctx)->minor = 0;
	(*ctx)->context = GSS_C_NO_CONTEXT;
	(*ctx)->name = GSS_C_NO_NAME;
	(*ctx)->oid = GSS_C_NO_OID;
	(*ctx)->creds = GSS_C_NO_CREDENTIAL;
	(*ctx)->client = GSS_C_NO_NAME;
	(*ctx)->client_creds = GSS_C_NO_CREDENTIAL;
}

/* Delete our context, providing it has been built correctly */
void
ssh_gssapi_delete_ctx(Gssctxt **ctx)
{
#if !defined(MECHGLUE)
	OM_uint32 ms;
#endif

	if ((*ctx) == NULL)
		return;
#if !defined(MECHGLUE) /* mechglue has some memory management issues */
	if ((*ctx)->context != GSS_C_NO_CONTEXT)
		gss_delete_sec_context(&ms, &(*ctx)->context, GSS_C_NO_BUFFER);
	if ((*ctx)->name != GSS_C_NO_NAME)
		gss_release_name(&ms, &(*ctx)->name);
	if ((*ctx)->oid != GSS_C_NO_OID) {
		xfree((*ctx)->oid->elements);
		xfree((*ctx)->oid);
		(*ctx)->oid = GSS_C_NO_OID;
	}
	if ((*ctx)->creds != GSS_C_NO_CREDENTIAL)
		gss_release_cred(&ms, &(*ctx)->creds);
	if ((*ctx)->client != GSS_C_NO_NAME)
		gss_release_name(&ms, &(*ctx)->client);
	if ((*ctx)->client_creds != GSS_C_NO_CREDENTIAL)
		gss_release_cred(&ms, &(*ctx)->client_creds);
#endif

	xfree(*ctx);
	*ctx = NULL;
}

/*
 * Wrapper to init_sec_context
 * Requires that the context contains:
 *	oid
 *	server name (from ssh_gssapi_import_name)
 */
OM_uint32
ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
    gss_buffer_desc* send_tok, OM_uint32 *flags)
{
	int deleg_flag = 0;

	if (deleg_creds) {
		deleg_flag = GSS_C_DELEG_FLAG;
		debug("Delegating credentials");
	}

	ctx->major = gss_init_sec_context(&ctx->minor,
	    GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid,
	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);

	if (GSS_ERROR(ctx->major))
		ssh_gssapi_error(ctx);

	return (ctx->major);
}

/* Create a service name for the given host */
OM_uint32
ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
{
	gss_buffer_desc gssbuf;
	char *xhost;

	/* Make a copy of the host name, in case it was returned by a
	 * previous call to gethostbyname(). */	
	xhost = xstrdup(host);

	/* Make sure we have the FQDN. Some GSSAPI implementations don't do
	 * this for us themselves */
	resolve_localhost(&xhost);
	
	gssbuf.length = sizeof("host@") + strlen(xhost);
	gssbuf.value = xmalloc(gssbuf.length);
	snprintf(gssbuf.value, gssbuf.length, "host@%s", xhost);

	if ((ctx->major = gss_import_name(&ctx->minor,
	    &gssbuf, GSS_C_NT_HOSTBASED_SERVICE, &ctx->name)))
		ssh_gssapi_error(ctx);

	xfree(xhost);
	xfree(gssbuf.value);
	return (ctx->major);
}

/* Acquire credentials for a server running on the current host.
 * Requires that the context structure contains a valid OID
 */

/* Returns a GSSAPI error code */
OM_uint32
ssh_gssapi_acquire_cred(Gssctxt *ctx)
{
	OM_uint32 status;
	char lname[MAXHOSTNAMELEN];
	gss_OID_set oidset;

	gss_create_empty_oid_set(&status, &oidset);
	gss_add_oid_set_member(&status, ctx->oid, &oidset);

	if (gethostname(lname, MAXHOSTNAMELEN))
		return (-1);

	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname)))
		return (ctx->major);

	if ((ctx->major = gss_acquire_cred(&ctx->minor,
	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
		ssh_gssapi_error(ctx);

	gss_release_oid_set(&status, &oidset);
	return (ctx->major);
}

OM_uint32
ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
{
	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
	    GSS_C_QOP_DEFAULT, buffer, hash)))
		ssh_gssapi_error(ctx);

	return (ctx->major);
}

void
ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
    const char *context)
{
	buffer_init(b);
	buffer_put_string(b, session_id2, session_id2_len);
	buffer_put_char(b, SSH2_MSG_USERAUTH_REQUEST);
	buffer_put_cstring(b, user);
	buffer_put_cstring(b, service);
	buffer_put_cstring(b, context);
}

OM_uint32
ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) {
	if (*ctx)
		ssh_gssapi_delete_ctx(ctx);
	ssh_gssapi_build_ctx(ctx);
	ssh_gssapi_set_oid(*ctx, oid);
	return (ssh_gssapi_acquire_cred(*ctx));
}

int
ssh_gssapi_check_mechanism(gss_OID oid, char *host) {
	Gssctxt * ctx = NULL;
	gss_buffer_desc token;
	OM_uint32 major,minor;
	
	ssh_gssapi_build_ctx(&ctx);
	ssh_gssapi_set_oid(ctx,oid);
	ssh_gssapi_import_name(ctx,host);
	major=ssh_gssapi_init_ctx(ctx,0, GSS_C_NO_BUFFER, &token, NULL);
	gss_release_buffer(&minor,&token);
	ssh_gssapi_delete_ctx(&ctx);
	return(!GSS_ERROR(major));
}

#endif /* GSSAPI */
Commit	Line	Data
540d72c3	1	/* $OpenBSD: gss-genr.c,v 1.3 2003/11/21 11:57:03 djm Exp $ */
7cac2b65	2
5598e598	3	/*
7cac2b65	4	* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
7cac2b65	5	*
5598e598	6	* Redistribution and use in source and binary forms, with or without
	7	* modification, are permitted provided that the following conditions
	8	* are met:
	9	* 1. Redistributions of source code must retain the above copyright
	10	* notice, this list of conditions and the following disclaimer.
	11	* 2. Redistributions in binary form must reproduce the above copyright
	12	* notice, this list of conditions and the following disclaimer in the
	13	* documentation and/or other materials provided with the distribution.
	14	*
	15	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
	16	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	17	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	18	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	19	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	20	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	21	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	22	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	23	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	24	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	25	*/
	26
	27	#include "includes.h"
	28
	29	#ifdef GSSAPI
	30
5598e598	31	#include "xmalloc.h"
	32	#include "buffer.h"
	33	#include "bufaux.h"
5598e598	34	#include "compat.h"
5598e598	35	#include <openssl/evp.h>
5598e598	36	#include "kex.h"
5598e598	37	#include "log.h"
b59afbfe	38	#include "monitor_wrap.h"
4dd35ca9	39	#include "canohost.h"
540d72c3	40	#include "ssh2.h"
5598e598	41
	42	#include "ssh-gss.h"
	43
540d72c3	44	extern u_char *session_id2;
	45	extern u_int session_id2_len;
	46
23987cb8	47	typedef struct {
	48	char *encoded;
	49	gss_OID oid;
	50	} ssh_gss_kex_mapping;
	51
	52	static ssh_gss_kex_mapping *gss_enc2oid;
5598e598	53
	54	/* Return a list of the gss-group1-sha1-x mechanisms supported by this
	55	* program.
	56	*
23987cb8	57	* On the client side, we don't need to worry about whether we 'know'
	58	* about the mechanism or not - we assume that any mechanism that we've been
	59	* linked against is suitable for inclusion.
5598e598	60	*
23987cb8	61	* XXX - We might want to make this configurable in the future, so as to
23987cb8	62	* XXX - allow the user control over which mechanisms to use.
5598e598	63	*/
	64
	65	char *
23987cb8	66	ssh_gssapi_client_mechanisms(char *host) {
5598e598	67	gss_OID_set supported;
23987cb8	68	OM_uint32 min_status;
5598e598	69	Buffer buf;
5598e598	70	int i = 0;
23987cb8	71	char *mechs;
	72	char *encoded;
	73	int enclen;
	74	char digest[EVP_MAX_MD_SIZE];
	75	char deroid[2];
	76	const EVP_MD *evp_md = EVP_md5();
	77	EVP_MD_CTX md;
	78	int oidpos=0;
	79
905081a4	80	if (datafellows & SSH_OLD_GSSAPI) return NULL;
905081a4	81
23987cb8	82	gss_indicate_mechs(&min_status,&supported);
	83	if (datafellows & SSH_BUG_GSSAPI_BER) {
	84	gss_enc2oid=xmalloc(sizeof(ssh_gss_kex_mapping)
	85	((supported->count2)+1));
	86	} else {
	87	gss_enc2oid=xmalloc(sizeof(ssh_gss_kex_mapping)
	88	*(supported->count+1));
	89	}
5598e598	90
23987cb8	91	buffer_init(&buf);
	92
	93
	94	for (i=0;i<supported->count;i++) {
	95
	96	gss_enc2oid[oidpos].encoded=NULL;
	97
	98	if (supported->elements[i].length<128 &&
	99	ssh_gssapi_check_mechanism(&(supported->elements[i]),host)) {
	100
	101	/* Earlier versions of this code interpreted the
e23e524c	102	* spec incorrectly with regard to OID encoding. They
	103	* also mis-encoded the krb5 OID. The following
	104	* _temporary_ code interfaces with these broken
	105	* servers */
23987cb8	106
	107	if (datafellows & SSH_BUG_GSSAPI_BER) {
	108	char *bodge=NULL;
	109	gss_OID_desc krb5oid={9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"};
	110	gss_OID_desc gsioid={9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"};
	111
	112	if (supported->elements[i].length==krb5oid.length &&
	113	memcmp(supported->elements[i].elements,
	114	krb5oid.elements, krb5oid.length)==0) {
	115	bodge="Se3H81ismmOC3OE+FwYCiQ==";
	116	}
	117
	118	if (supported->elements[i].length==gsioid.length &&
	119	memcmp(supported->elements[i].elements,
	120	gsioid.elements, gsioid.length)==0) {
	121	bodge="N3+k7/4wGxHyuP8Yxi4RhA==";
	122	}
	123
	124	if (bodge) {
	125	if (oidpos!=0) {
	126	buffer_put_char(&buf,',');
	127	}
	128
	129	buffer_append(&buf, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1);
	130	buffer_append(&buf, bodge, strlen(bodge));
	131
	132	gss_enc2oid[oidpos].oid=&(supported->elements[i]);
	133	gss_enc2oid[oidpos].encoded=bodge;
	134
	135	oidpos++;
d4ab470d	136	}
d4ab470d	137	}
23987cb8	138
	139	/* Add the required DER encoding octets and MD5 hash */
	140	deroid[0]=0x06; /* Object Identifier */
	141	deroid[1]=supported->elements[i].length;
	142
	143	EVP_DigestInit(&md, evp_md);
	144	EVP_DigestUpdate(&md,deroid,2);
	145	EVP_DigestUpdate(&md,
e23e524c	146	supported->elements[i].elements,
e23e524c	147	supported->elements[i].length);
23987cb8	148	EVP_DigestFinal(&md, digest, NULL);
	149
	150	/* Base64 encode it */
	151	encoded=xmalloc(EVP_MD_size(evp_md)*2);
	152	enclen=__b64_ntop(digest, EVP_MD_size(evp_md),
	153	encoded,EVP_MD_size(evp_md)*2);
	154	if (oidpos!=0) {
	155	buffer_put_char(&buf,',');
	156	}
	157	buffer_append(&buf, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1);
	158	buffer_append(&buf, encoded, enclen);
	159
	160	debug("Mechanism encoded as %s",encoded);
	161
	162	gss_enc2oid[oidpos].oid=&(supported->elements[i]);
	163	gss_enc2oid[oidpos].encoded=encoded;
	164	oidpos++;
d4ab470d	165	}
23987cb8	166	}
	167	gss_enc2oid[oidpos].oid=NULL;
	168	gss_enc2oid[oidpos].encoded=NULL;
5598e598	169
	170	buffer_put_char(&buf,'\0');
	171
	172	mechs=xmalloc(buffer_len(&buf));
	173	buffer_get(&buf,mechs,buffer_len(&buf));
	174	buffer_free(&buf);
	175	if (strlen(mechs)==0)
23987cb8	176	return(NULL);
5598e598	177	else
23987cb8	178	return(mechs);
	179	}
	180
	181	gss_OID
	182	ssh_gssapi_client_id_kex(Gssctxt ctx, char name) {
	183	int i=0;
	184
	185	if (strncmp(name, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1) !=0) {
	186	return(NULL);
	187	}
	188
	189	name+=sizeof(KEX_GSS_SHA1)-1; /* Move to the start of the ID string */
	190
	191	while (gss_enc2oid[i].encoded!=NULL &&
	192	strcmp(name,gss_enc2oid[i].encoded)!=0) {
	193	i++;
	194	}
	195
	196	if (gss_enc2oid[i].oid!=NULL) {
	197	ssh_gssapi_set_oid(ctx,gss_enc2oid[i].oid);
	198	}
	199
	200	return gss_enc2oid[i].oid;
5598e598	201	}
5598e598	202
23987cb8	203	/* Check that the OID in a data stream matches that in the context */
7cac2b65	204	int
	205	ssh_gssapi_check_oid(Gssctxt ctx, void data, size_t len)
	206	{
	207	return (ctx != NULL && ctx->oid != GSS_C_NO_OID &&
	208	ctx->oid->length == len &&
	209	memcmp(ctx->oid->elements, data, len) == 0);
23987cb8	210	}
7cac2b65	211
5598e598	212	/* Set the contexts OID from a data stream */
7cac2b65	213	void
	214	ssh_gssapi_set_oid_data(Gssctxt ctx, void data, size_t len)
	215	{
	216	if (ctx->oid != GSS_C_NO_OID) {
	217	xfree(ctx->oid->elements);
	218	xfree(ctx->oid);
	219	}
	220	ctx->oid = xmalloc(sizeof(gss_OID_desc));
	221	ctx->oid->length = len;
	222	ctx->oid->elements = xmalloc(len);
	223	memcpy(ctx->oid->elements, data, len);
5598e598	224	}
	225
	226	/* Set the contexts OID */
7cac2b65	227	void
	228	ssh_gssapi_set_oid(Gssctxt *ctx, gss_OID oid)
	229	{
	230	ssh_gssapi_set_oid_data(ctx, oid->elements, oid->length);
5598e598	231	}
5598e598	232
23987cb8	233	/* All this effort to report an error ... */
23987cb8	234	void
7cac2b65	235	ssh_gssapi_error(Gssctxt *ctxt)
	236	{
	237	debug("%s", ssh_gssapi_last_error(ctxt, NULL, NULL));
5598e598	238	}
5598e598	239
23987cb8	240	char *
7cac2b65	241	ssh_gssapi_last_error(Gssctxt *ctxt,
	242	OM_uint32 major_status, OM_uint32 minor_status)
	243	{
23987cb8	244	OM_uint32 lmin;
7cac2b65	245	gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
	246	OM_uint32 ctx;
	247	Buffer b;
	248	char *ret;
	249
	250	buffer_init(&b);
	251
	252	if (major_status != NULL)
	253	*major_status = ctxt->major;
	254	if (minor_status != NULL)
	255	*minor_status = ctxt->minor;
	256
	257	ctx = 0;
5598e598	258	/* The GSSAPI error */
7cac2b65	259	do {
	260	gss_display_status(&lmin, ctxt->major,
	261	GSS_C_GSS_CODE, ctxt->oid, &ctx, &msg);
	262
	263	buffer_append(&b, msg.value, msg.length);
	264	buffer_put_char(&b, '\n');
	265
	266	gss_release_buffer(&lmin, &msg);
	267	} while (ctx != 0);
	268
	269	/* The mechanism specific error */
	270	do {
	271	gss_display_status(&lmin, ctxt->minor,
	272	GSS_C_MECH_CODE, ctxt->oid, &ctx, &msg);
	273
	274	buffer_append(&b, msg.value, msg.length);
	275	buffer_put_char(&b, '\n');
	276
	277	gss_release_buffer(&lmin, &msg);
	278	} while (ctx != 0);
	279
	280	buffer_put_char(&b, '\0');
	281	ret = xmalloc(buffer_len(&b));
	282	buffer_get(&b, ret, buffer_len(&b));
	283	buffer_free(&b);
	284	return (ret);
5598e598	285	}
5598e598	286
7cac2b65	287	/*
7cac2b65	288	* Initialise our GSSAPI context. We use this opaque structure to contain all
5598e598	289	* of the data which both the client and server need to persist across
	290	* {accept,init}_sec_context calls, so that when we do it from the userauth
	291	* stuff life is a little easier
	292	*/
	293	void
b59afbfe	294	ssh_gssapi_build_ctx(Gssctxt **ctx)
5598e598	295	{
7cac2b65	296	*ctx = xmalloc(sizeof (Gssctxt));
	297	(*ctx)->major = 0;
	298	(*ctx)->minor = 0;
	299	(*ctx)->context = GSS_C_NO_CONTEXT;
	300	(*ctx)->name = GSS_C_NO_NAME;
	301	(*ctx)->oid = GSS_C_NO_OID;
	302	(*ctx)->creds = GSS_C_NO_CREDENTIAL;
	303	(*ctx)->client = GSS_C_NO_NAME;
	304	(*ctx)->client_creds = GSS_C_NO_CREDENTIAL;
5598e598	305	}
	306
	307	/* Delete our context, providing it has been built correctly */
	308	void
b59afbfe	309	ssh_gssapi_delete_ctx(Gssctxt **ctx)
5598e598	310	{
9eeaa28e	311	#if !defined(MECHGLUE)
5598e598	312	OM_uint32 ms;
9eeaa28e	313	#endif
7cac2b65	314
7cac2b65	315	if ((*ctx) == NULL)
b59afbfe	316	return;
d4ab470d	317	#if !defined(MECHGLUE) /* mechglue has some memory management issues */
7cac2b65	318	if ((*ctx)->context != GSS_C_NO_CONTEXT)
7cac2b65	319	gss_delete_sec_context(&ms, &(*ctx)->context, GSS_C_NO_BUFFER);
b59afbfe	320	if ((*ctx)->name != GSS_C_NO_NAME)
7cac2b65	321	gss_release_name(&ms, &(*ctx)->name);
b59afbfe	322	if ((*ctx)->oid != GSS_C_NO_OID) {
	323	xfree((*ctx)->oid->elements);
	324	xfree((*ctx)->oid);
	325	(*ctx)->oid = GSS_C_NO_OID;
5598e598	326	}
b59afbfe	327	if ((*ctx)->creds != GSS_C_NO_CREDENTIAL)
7cac2b65	328	gss_release_cred(&ms, &(*ctx)->creds);
b59afbfe	329	if ((*ctx)->client != GSS_C_NO_NAME)
7cac2b65	330	gss_release_name(&ms, &(*ctx)->client);
b59afbfe	331	if ((*ctx)->client_creds != GSS_C_NO_CREDENTIAL)
7cac2b65	332	gss_release_cred(&ms, &(*ctx)->client_creds);
d4ab470d	333	#endif
7cac2b65	334
b59afbfe	335	xfree(*ctx);
7cac2b65	336	*ctx = NULL;
5598e598	337	}
5598e598	338
7cac2b65	339	/*
7cac2b65	340	* Wrapper to init_sec_context
5598e598	341	* Requires that the context contains:
5598e598	342	* oid
7cac2b65	343	* server name (from ssh_gssapi_import_name)
5598e598	344	*/
7cac2b65	345	OM_uint32
5598e598	346	ssh_gssapi_init_ctx(Gssctxt ctx, int deleg_creds, gss_buffer_desc recv_tok,
7cac2b65	347	gss_buffer_desc* send_tok, OM_uint32 *flags)
5598e598	348	{
5598e598	349	int deleg_flag = 0;
7cac2b65	350
5598e598	351	if (deleg_creds) {
7cac2b65	352	deleg_flag = GSS_C_DELEG_FLAG;
5598e598	353	debug("Delegating credentials");
5598e598	354	}
7cac2b65	355
	356	ctx->major = gss_init_sec_context(&ctx->minor,
	357	GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid,
	358	GSS_C_MUTUAL_FLAG \| GSS_C_INTEG_FLAG \| deleg_flag,
	359	0, NULL, recv_tok, NULL, send_tok, flags, NULL);
	360
	361	if (GSS_ERROR(ctx->major))
	362	ssh_gssapi_error(ctx);
	363
	364	return (ctx->major);
5598e598	365	}
5598e598	366
5598e598	367	/* Create a service name for the given host */
5598e598	368	OM_uint32
7cac2b65	369	ssh_gssapi_import_name(Gssctxt ctx, const char host)
7cac2b65	370	{
23987cb8	371	gss_buffer_desc gssbuf;
4dd35ca9	372	char *xhost;
7cac2b65	373
5598e598	374	/* Make a copy of the host name, in case it was returned by a
e23e524c	375	* previous call to gethostbyname(). */
5598e598	376	xhost = xstrdup(host);
5598e598	377
23987cb8	378	/* Make sure we have the FQDN. Some GSSAPI implementations don't do
e23e524c	379	* this for us themselves */
1df48666	380	resolve_localhost(&xhost);
23987cb8	381
7cac2b65	382	gssbuf.length = sizeof("host@") + strlen(xhost);
7cac2b65	383	gssbuf.value = xmalloc(gssbuf.length);
5682ddfd	384	snprintf(gssbuf.value, gssbuf.length, "host@%s", xhost);
7cac2b65	385
	386	if ((ctx->major = gss_import_name(&ctx->minor,
	387	&gssbuf, GSS_C_NT_HOSTBASED_SERVICE, &ctx->name)))
23987cb8	388	ssh_gssapi_error(ctx);
7cac2b65	389
1c828c5c	390	xfree(xhost);
5598e598	391	xfree(gssbuf.value);
7cac2b65	392	return (ctx->major);
5598e598	393	}
	394
	395	/* Acquire credentials for a server running on the current host.
	396	* Requires that the context structure contains a valid OID
b59afbfe	397	*/
7cac2b65	398
b59afbfe	399	/* Returns a GSSAPI error code */
5598e598	400	OM_uint32
7cac2b65	401	ssh_gssapi_acquire_cred(Gssctxt *ctx)
7cac2b65	402	{
23987cb8	403	OM_uint32 status;
5598e598	404	char lname[MAXHOSTNAMELEN];
5598e598	405	gss_OID_set oidset;
5598e598	406
7cac2b65	407	gss_create_empty_oid_set(&status, &oidset);
	408	gss_add_oid_set_member(&status, ctx->oid, &oidset);
	409
	410	if (gethostname(lname, MAXHOSTNAMELEN))
	411	return (-1);
	412
	413	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname)))
	414	return (ctx->major);
	415
	416	if ((ctx->major = gss_acquire_cred(&ctx->minor,
	417	ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
23987cb8	418	ssh_gssapi_error(ctx);
7cac2b65	419
23987cb8	420	gss_release_oid_set(&status, &oidset);
7cac2b65	421	return (ctx->major);
	422	}
	423
540d72c3	424	OM_uint32
	425	ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
	426	{
	427	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
	428	GSS_C_QOP_DEFAULT, buffer, hash)))
	429	ssh_gssapi_error(ctx);
	430
	431	return (ctx->major);
	432	}
	433
	434	void
	435	ssh_gssapi_buildmic(Buffer b, const char user, const char *service,
	436	const char *context)
	437	{
	438	buffer_init(b);
	439	buffer_put_string(b, session_id2, session_id2_len);
	440	buffer_put_char(b, SSH2_MSG_USERAUTH_REQUEST);
	441	buffer_put_cstring(b, user);
	442	buffer_put_cstring(b, service);
	443	buffer_put_cstring(b, context);
	444	}
	445
7cac2b65	446	OM_uint32
	447	ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) {
	448	if (*ctx)
	449	ssh_gssapi_delete_ctx(ctx);
	450	ssh_gssapi_build_ctx(ctx);
	451	ssh_gssapi_set_oid(*ctx, oid);
	452	return (ssh_gssapi_acquire_cred(*ctx));
5598e598	453	}
b59afbfe	454
23987cb8	455	int
	456	ssh_gssapi_check_mechanism(gss_OID oid, char *host) {
	457	Gssctxt * ctx = NULL;
	458	gss_buffer_desc token;
	459	OM_uint32 major,minor;
	460
	461	ssh_gssapi_build_ctx(&ctx);
	462	ssh_gssapi_set_oid(ctx,oid);
	463	ssh_gssapi_import_name(ctx,host);
	464	major=ssh_gssapi_init_ctx(ctx,0, GSS_C_NO_BUFFER, &token, NULL);
b59afbfe	465	gss_release_buffer(&minor,&token);
23987cb8	466	ssh_gssapi_delete_ctx(&ctx);
23987cb8	467	return(!GSS_ERROR(major));
b59afbfe	468	}
f001f132	469
5598e598	470	#endif /* GSSAPI */