]> andersk Git - gssapi-openssh.git/blame - openssh/auth2-gss.c
unused
[gssapi-openssh.git] / openssh / auth2-gss.c
CommitLineData
7e82606e 1/* $OpenBSD: auth2-gss.c,v 1.8 2004/06/21 17:36:31 avsm Exp $ */
7cac2b65 2
b59afbfe 3/*
23987cb8 4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
b59afbfe 5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28
29#ifdef GSSAPI
7cac2b65 30
b59afbfe 31#include "auth.h"
32#include "ssh2.h"
b59afbfe 33#include "xmalloc.h"
34#include "log.h"
35#include "dispatch.h"
36#include "servconf.h"
37#include "compat.h"
38#include "packet.h"
39#include "monitor_wrap.h"
40
41#include "ssh-gss.h"
42
43extern ServerOptions options;
b59afbfe 44
23987cb8 45static void ssh_gssapi_userauth_error(Gssctxt *ctxt);
b59afbfe 46static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
540d72c3 47static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
b59afbfe 48static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
e23e524c 49static void input_gssapi_errtok(int, u_int32_t, void *);
b59afbfe 50
540d72c3 51static int gssapi_with_mic = 1; /* flag to toggle "gssapi-with-mic" vs.
52 "gssapi" */
53
5217e987 54static int
55userauth_external(Authctxt *authctxt)
56{
57 packet_check_eom();
58
294206af 59 if (authctxt->valid && authctxt->user &&
60 strcmp(authctxt->user, "") != 0) {
61 return(PRIVSEP(ssh_gssapi_userok(authctxt->user)));
5217e987 62 }
63 return 0;
64}
65
7cac2b65 66/*
67 * We only support those mechanisms that we know about (ie ones that we know
b59afbfe 68 * how to check local user kuserok and the like
69 */
70static int
71userauth_gssapi(Authctxt *authctxt)
72{
7e82606e 73 gss_OID_desc goid = {0, NULL};
7cac2b65 74 Gssctxt *ctxt = NULL;
75 int mechs;
76 gss_OID_set supported;
77 int present;
78 OM_uint32 ms;
79 u_int len;
80 char *doid = NULL;
81
5217e987 82 if (authctxt->user == NULL)
7cac2b65 83 return (0);
84
85 mechs = packet_get_int();
86 if (mechs == 0) {
87 debug("Mechanism negotiation is not supported");
88 return (0);
89 }
90
91 ssh_gssapi_supported_oids(&supported);
92 do {
93 mechs--;
94
95 if (doid)
96 xfree(doid);
97
540d72c3 98 present = 0;
7cac2b65 99 doid = packet_get_string(&len);
100
101 if (doid[0] != SSH_GSS_OIDTYPE || doid[1] != len-2) {
102 logit("Mechanism OID received using the old encoding form");
7e82606e 103 goid.elements = doid;
104 goid.length = len;
7cac2b65 105 } else {
7e82606e 106 goid.elements = doid + 2;
107 goid.length = len - 2;
7cac2b65 108 }
7e82606e 109 gss_test_oid_set_member(&ms, &goid, supported, &present);
7cac2b65 110 } while (mechs > 0 && !present);
111
112 gss_release_oid_set(&ms, &supported);
113
114 if (!present) {
115 xfree(doid);
116 return (0);
117 }
118
7e82606e 119 if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
7cac2b65 120 xfree(doid);
121 return (0);
23987cb8 122 }
b59afbfe 123
7cac2b65 124 authctxt->methoddata=(void *)ctxt;
b59afbfe 125
7cac2b65 126 packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
23987cb8 127
540d72c3 128 /* Return the OID that we received */
7cac2b65 129 packet_put_string(doid, len);
23987cb8 130
7cac2b65 131 packet_send();
132 xfree(doid);
b59afbfe 133
7cac2b65 134 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
135 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
136 authctxt->postponed = 1;
137
138 return (0);
b59afbfe 139}
140
141static void
142input_gssapi_token(int type, u_int32_t plen, void *ctxt)
143{
7cac2b65 144 Authctxt *authctxt = ctxt;
145 Gssctxt *gssctxt;
146 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
147 gss_buffer_desc recv_tok;
147c00cc 148 OM_uint32 maj_status, min_status, flags=0;
7cac2b65 149 u_int len;
150
151 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
152 fatal("No authentication or GSSAPI context");
153
154 gssctxt = authctxt->methoddata;
155 recv_tok.value = packet_get_string(&len);
156 recv_tok.length = len; /* u_int vs. size_t */
157
158 packet_check_eom();
159
160 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
540d72c3 161 &send_tok, &flags));
7cac2b65 162
163 xfree(recv_tok.value);
164
165 if (GSS_ERROR(maj_status)) {
e23e524c 166 ssh_gssapi_userauth_error(gssctxt);
167 if (send_tok.length != 0) {
e23e524c 168 packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
7cac2b65 169 packet_put_string(send_tok.value, send_tok.length);
170 packet_send();
171 }
172 authctxt->postponed = 0;
7cac2b65 173 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
540d72c3 174 userauth_finish(authctxt, 0,
175 gssapi_with_mic ? "gssapi-with-mic" :
176 "gssapi");
7cac2b65 177 } else {
178 if (send_tok.length != 0) {
7cac2b65 179 packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
180 packet_put_string(send_tok.value, send_tok.length);
181 packet_send();
182 }
183 if (maj_status == GSS_S_COMPLETE) {
7cac2b65 184 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
540d72c3 185 if (flags & GSS_C_INTEG_FLAG && gssapi_with_mic)
186 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
187 &input_gssapi_mic);
188 else
189 dispatch_set(
190 SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
191 &input_gssapi_exchange_complete);
7cac2b65 192 }
193 }
194
195 gss_release_buffer(&min_status, &send_tok);
e23e524c 196}
23987cb8 197
e23e524c 198static void
199input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
200{
7cac2b65 201 Authctxt *authctxt = ctxt;
202 Gssctxt *gssctxt;
203 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
204 gss_buffer_desc recv_tok;
205 OM_uint32 maj_status;
206 u_int len;
207
208 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
209 fatal("No authentication or GSSAPI context");
210
211 gssctxt = authctxt->methoddata;
212 recv_tok.value = packet_get_string(&len);
213 recv_tok.length = len;
214
215 packet_check_eom();
216
217 /* Push the error token into GSSAPI to see what it says */
218 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
219 &send_tok, NULL));
220
221 xfree(recv_tok.value);
e23e524c 222
223 /* We can't return anything to the client, even if we wanted to */
e23e524c 224 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
7cac2b65 225 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
e23e524c 226
227 /* The client will have already moved on to the next auth */
7cac2b65 228
229 gss_release_buffer(&maj_status, &send_tok);
b59afbfe 230}
231
540d72c3 232static void
233gssapi_set_implicit_username(Authctxt *authctxt)
234{
294206af 235 if ((authctxt->user == NULL) || (strcmp(authctxt->user, "") == 0)) {
540d72c3 236 char *lname = NULL;
237 PRIVSEP(ssh_gssapi_localname(&lname));
238 if (lname && lname[0] != '\0') {
239 xfree(authctxt->user);
240 authctxt->user = lname;
241 debug("set username to %s from gssapi context", lname);
242 authctxt->pw = PRIVSEP(getpwnamallow(authctxt->user));
5217e987 243 if (authctxt->pw) {
244 authctxt->valid = 1;
245 }
540d72c3 246 } else {
247 debug("failed to set username from gssapi context");
248 }
249 }
250 if (authctxt->pw) {
251#ifdef USE_PAM
147c00cc 252 if (options.use_pam)
5217e987 253 PRIVSEP(start_pam(authctxt));
540d72c3 254#endif
255 }
256}
257
7cac2b65 258/*
259 * This is called when the client thinks we've completed authentication.
b59afbfe 260 * It should only be enabled in the dispatch handler by the function above,
261 * which only enables it once the GSSAPI exchange is complete.
262 */
7cac2b65 263
b59afbfe 264static void
265input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
266{
7cac2b65 267 Authctxt *authctxt = ctxt;
268 Gssctxt *gssctxt;
269 int authenticated;
270
b59afbfe 271 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
7cac2b65 272 fatal("No authentication or GSSAPI context");
273
540d72c3 274 gssapi_set_implicit_username(authctxt);
d13dfff4 275
7cac2b65 276 gssctxt = authctxt->methoddata;
277
7cac2b65 278 /*
540d72c3 279 * We don't need to check the status, because we're only enabled in
280 * the dispatcher once the exchange is complete
b59afbfe 281 */
282
7cac2b65 283 packet_check_eom();
284
5217e987 285 if (authctxt->valid && strcmp(authctxt->user, "") != 0) {
540d72c3 286 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
287 } else {
288 authenticated = 0;
289 }
b59afbfe 290
7cac2b65 291 authctxt->postponed = 0;
292 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
293 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
540d72c3 294 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
7cac2b65 295 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
540d72c3 296 userauth_finish(authctxt, authenticated,
297 gssapi_with_mic ? "gssapi-with-mic" : "gssapi");
298}
299
300static int
301userauth_gssapi_with_mic(Authctxt *authctxt)
302{
303 gssapi_with_mic = 1;
304 return userauth_gssapi(authctxt);
305}
306
307static int
308userauth_gssapi_without_mic(Authctxt *authctxt)
309{
310 gssapi_with_mic = 0;
311 return userauth_gssapi(authctxt);
312}
313
314static void
315input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
316{
317 Authctxt *authctxt = ctxt;
318 Gssctxt *gssctxt;
319 int authenticated = 0;
320 Buffer b;
321 gss_buffer_desc mic, gssbuf;
322 u_int len;
323
324 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
325 fatal("No authentication or GSSAPI context");
326
327 gssapi_set_implicit_username(authctxt);
328
329 gssctxt = authctxt->methoddata;
330
331 mic.value = packet_get_string(&len);
332 mic.length = len;
333
334 ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
335 "gssapi-with-mic");
336
337 gssbuf.value = buffer_ptr(&b);
338 gssbuf.length = buffer_len(&b);
339
340 if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
5217e987 341 if (authctxt->valid && strcmp(authctxt->user, "") != 0) {
540d72c3 342 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
343 } else {
344 authenticated = 0;
345 }
346 else
347 logit("GSSAPI MIC check failed");
348
349 buffer_free(&b);
350 xfree(mic.value);
351
352 authctxt->postponed = 0;
353 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
354 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
355 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
356 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
357 userauth_finish(authctxt, authenticated, "gssapi-with-mic");
b59afbfe 358}
359
23987cb8 360static void ssh_gssapi_userauth_error(Gssctxt *ctxt) {
361 char *errstr;
362 OM_uint32 maj,min;
363
364 errstr=PRIVSEP(ssh_gssapi_last_error(ctxt,&maj,&min));
365 if (errstr) {
366 packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERROR);
367 packet_put_int(maj);
368 packet_put_int(min);
369 packet_put_cstring(errstr);
370 packet_put_cstring("");
371 packet_send();
372 packet_write_wait();
373 xfree(errstr);
374 }
375}
376
b59afbfe 377Authmethod method_external = {
378 "external-keyx",
379 userauth_external,
380 &options.gss_authentication
381};
382
383Authmethod method_gssapi = {
540d72c3 384 "gssapi-with-mic",
385 userauth_gssapi_with_mic,
386 &options.gss_authentication
387};
388
389Authmethod method_gssapi_compat = {
7cac2b65 390 "gssapi",
540d72c3 391 userauth_gssapi_without_mic,
7cac2b65 392 &options.gss_authentication
b59afbfe 393};
394
395#endif /* GSSAPI */
This page took 0.125129 seconds and 5 git commands to generate.