openssh/kexgss.c

   1 /*
   2  * Copyright (c) 2001,2002 Simon Wilkinson. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  * 1. Redistributions of source code must retain the above copyright
   8  *    notice, this list of conditions and the following disclaimer.
   9  * 2. Redistributions in binary form must reproduce the above copyright
  10  *    notice, this list of conditions and the following disclaimer in the
  11  *    documentation and/or other materials provided with the distribution.
  12  *
  13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
  14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23  */
  24
  25 #include "includes.h"
  26
  27 #ifdef GSSAPI
  28
  29 #include <openssl/crypto.h>
  30 #include <openssl/bn.h>
  31
  32 #include "xmalloc.h"
  33 #include "buffer.h"
  34 #include "bufaux.h"
  35 #include "kex.h"
  36 #include "log.h"
  37 #include "packet.h"
  38 #include "dh.h"
  39 #include "ssh2.h"
  40 #include "ssh-gss.h"
  41 #include "monitor_wrap.h"
  42
  43 /* This is now the same as the DH hash ... */
  44
  45 u_char *
  46 kex_gssapi_hash(
  47     char *client_version_string,
  48     char *server_version_string,
  49     char *ckexinit, int ckexinitlen,
  50     char *skexinit, int skexinitlen,
  51     u_char *serverhostkeyblob, int sbloblen,
  52     BIGNUM *client_dh_pub,
  53     BIGNUM *server_dh_pub,
  54     BIGNUM *shared_secret)
  55 {
  56         Buffer b;
  57         static u_char digest[EVP_MAX_MD_SIZE];
  58         EVP_MD *evp_md = EVP_sha1();
  59         EVP_MD_CTX md;
  60
  61         buffer_init(&b);
  62         buffer_put_string(&b, client_version_string, strlen(client_version_string));
  63         buffer_put_string(&b, server_version_string, strlen(server_version_string));
  64
  65         /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
  66         buffer_put_int(&b, ckexinitlen+1);
  67         buffer_put_char(&b, SSH2_MSG_KEXINIT);
  68         buffer_append(&b, ckexinit, ckexinitlen);
  69         buffer_put_int(&b, skexinitlen+1);
  70         buffer_put_char(&b, SSH2_MSG_KEXINIT);
  71         buffer_append(&b, skexinit, skexinitlen);
  72
  73         buffer_put_string(&b, serverhostkeyblob, sbloblen);
  74         buffer_put_bignum2(&b, client_dh_pub);
  75         buffer_put_bignum2(&b, server_dh_pub);
  76         buffer_put_bignum2(&b, shared_secret);
  77
  78 #ifdef DEBUG_KEX
  79         buffer_dump(&b);
  80 #endif
  81         EVP_DigestInit(&md, evp_md);
  82         EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
  83         EVP_DigestFinal(&md, digest, NULL);
  84
  85         buffer_free(&b);
  86
  87 #ifdef DEBUG_KEX
  88         dump_digest("hash", digest, evp_md->md_size);
  89 #endif
  90         return digest;
  91 }
  92
  93 void
  94 kexgss_client(Kex *kex)
  95 {
  96         gss_buffer_desc gssbuf,send_tok,recv_tok, msg_tok, *token_ptr;
  97         Gssctxt *ctxt;
  98         OM_uint32 maj_status, min_status, ret_flags;
  99         unsigned int klen, kout;
 100         DH *dh;
 101         BIGNUM *dh_server_pub = 0;
 102         BIGNUM *shared_secret = 0;
 103         unsigned char *kbuf;
 104         unsigned char *hash;
 105         unsigned char *serverhostkey;
 106         int type = 0;
 107         int first = 1;
 108         int slen = 0;
 109
 110         /* Initialise our GSSAPI world */
 111         ssh_gssapi_build_ctx(&ctxt);
 112         if (ssh_gssapi_id_kex(ctxt,kex->name)==NULL) {
 113                 fatal("Couldn't identify host exchange");
 114         }
 115         if (ssh_gssapi_import_name(ctxt,kex->host)) {
 116                 fatal("Couldn't import hostname ");
 117         }
 118
 119         /* This code should match that in ssh_dh1_client */
 120
 121         /* Step 1 - e is dh->pub_key */
 122         dh = dh_new_group1();
 123         dh_gen_key(dh, kex->we_need * 8);
 124
 125         /* This is f, we initialise it now to make life easier */
 126         dh_server_pub = BN_new();
 127         if (dh_server_pub == NULL) {
 128                 fatal("dh_server_pub == NULL");
 129         }
 130
 131         token_ptr = GSS_C_NO_BUFFER;
 132
 133         do {
 134                 debug("Calling gss_init_sec_context");
 135
 136                 maj_status=ssh_gssapi_init_ctx(ctxt,
 137                                                kex->options.gss_deleg_creds,
 138                                                token_ptr,&send_tok,
 139                                                &ret_flags);
 140
 141                 if (GSS_ERROR(maj_status)) {
 142                         fatal("gss_init_context failed");
 143                 }
 144
 145                 /* If we've got an old receive buffer get rid of it */
 146                 if (token_ptr != GSS_C_NO_BUFFER)
 147                         (void) gss_release_buffer(&min_status, &recv_tok);
 148
 149
 150                 if (maj_status == GSS_S_COMPLETE) {
 151                         /* If mutual state flag is not true, kex fails */
 152                         if (!(ret_flags & GSS_C_MUTUAL_FLAG)) {
 153                                 fatal("Mutual authentication failed");
 154                         }
 155                         /* If integ avail flag is not true kex fails */
 156                         if (!(ret_flags & GSS_C_INTEG_FLAG)) {
 157                                 fatal("Integrity check failed");
 158                         }
 159                 }
 160
 161                 /* If we have data to send, then the last message that we
 162                  * received cannot have been a 'complete'. */
 163                 if (send_tok.length !=0) {
 164                         if (first) {
 165                                 packet_start(SSH2_MSG_KEXGSS_INIT);
 166                                 packet_put_string(send_tok.value,
 167                                                   send_tok.length);
 168                                 packet_put_bignum2(dh->pub_key);
 169                                 first=0;
 170                         } else {
 171                                 packet_start(SSH2_MSG_KEXGSS_CONTINUE);
 172                                 packet_put_string(send_tok.value,
 173                                                   send_tok.length);
 174                         }
 175                         packet_send();
 176                         packet_write_wait();
 177
 178
 179                         /* If we've sent them data, they'd better be polite
 180                          * and reply. */
 181
 182                         type = packet_read();
 183                         switch (type) {
 184                         case SSH2_MSG_KEXGSS_HOSTKEY:
 185                                 debug("Received KEXGSS_HOSTKEY");
 186                                 serverhostkey=packet_get_string(&slen);
 187                                 break;
 188                         case SSH2_MSG_KEXGSS_CONTINUE:
 189                                 debug("Received GSSAPI_CONTINUE");
 190                                 if (maj_status == GSS_S_COMPLETE)
 191                                         fatal("GSSAPI Continue received from server when complete");
 192                                 recv_tok.value=packet_get_string(&slen);
 193                                 recv_tok.length=slen; /* int vs. size_t */
 194                                 break;
 195                         case SSH2_MSG_KEXGSS_COMPLETE:
 196                                 debug("Received GSSAPI_COMPLETE");
 197                                 packet_get_bignum2(dh_server_pub);
 198                                 msg_tok.value=packet_get_string(&slen);
 199                                 msg_tok.length=slen; /* int vs. size_t */
 200
 201                                 /* Is there a token included? */
 202                                 if (packet_get_char()) {
 203                                         recv_tok.value=
 204                                             packet_get_string(&slen);
 205                                         recv_tok.length=slen; /* int/size_t */
 206                                         /* If we're already complete - protocol error */
 207                                         if (maj_status == GSS_S_COMPLETE)
 208                                                 packet_disconnect("Protocol error: received token when complete");
 209                                 } else {
 210                                         /* No token included */
 211                                         if (maj_status != GSS_S_COMPLETE)
 212                                                 packet_disconnect("Protocol error: did not receive final token");
 213                                 }
 214                                 break;
 215                         default:
 216                                 packet_disconnect("Protocol error: didn't expect packet type %d",
 217                                 type);
 218                         }
 219                         token_ptr=&recv_tok;
 220                 }
 221
 222         } while (maj_status & GSS_S_CONTINUE_NEEDED);
 223
 224         /* We _must_ have received a COMPLETE message in reply from the
 225          * server, which will have set dh_server_pub and msg_tok */
 226
 227         if (type!=SSH2_MSG_KEXGSS_COMPLETE)
 228            fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
 229
 230         /* Check f in range [1, p-1] */
 231         if (!dh_pub_is_valid(dh, dh_server_pub))
 232                         packet_disconnect("bad server public DH value");
 233
 234         /* compute K=f^x mod p */
 235         klen = DH_size(dh);
 236         kbuf = xmalloc(klen);
 237         kout = DH_compute_key(kbuf, dh_server_pub, dh);
 238
 239         shared_secret = BN_new();
 240         BN_bin2bn(kbuf,kout, shared_secret);
 241         memset(kbuf, 0, klen);
 242         xfree(kbuf);
 243
 244         slen=0;
 245         hash = kex_gssapi_hash(
 246             kex->client_version_string,
 247             kex->server_version_string,
 248             buffer_ptr(&kex->my), buffer_len(&kex->my),
 249             buffer_ptr(&kex->peer), buffer_len(&kex->peer),
 250             serverhostkey, slen, /* server host key */
 251             dh->pub_key,        /* e */
 252             dh_server_pub,      /* f */
 253             shared_secret       /* K */
 254         );
 255
 256         gssbuf.value=hash;
 257         gssbuf.length=20;
 258
 259         /* Verify that H matches the token we just got. */
 260                 if ((maj_status = gss_verify_mic(&min_status,
 261                                          ctxt->context,
 262                                          &gssbuf,
 263                                          &msg_tok,
 264                                          NULL))) {
 265
 266                 packet_disconnect("Hash's MIC didn't verify");
 267         }
 268
 269         DH_free(dh);
 270         ssh_gssapi_delete_ctx(&ctxt);
 271         /* save session id */
 272         if (kex->session_id == NULL) {
 273                 kex->session_id_len = 20;
 274                 kex->session_id = xmalloc(kex->session_id_len);
 275                 memcpy(kex->session_id, hash, kex->session_id_len);
 276         }
 277
 278         kex_derive_keys(kex, hash, shared_secret);
 279         BN_clear_free(shared_secret);
 280         kex_finish(kex);
 281 }
 282
 283
 284
 285
 286 void
 287 kexgss_server(Kex *kex)
 288 {
 289
 290         OM_uint32 maj_status, min_status;
 291
 292         /* Some GSSAPI implementations use the input value of ret_flags (an
 293          * output variable) as a means of triggering mechanism specific
 294          * features. Initializing it to zero avoids inadvertently
 295          * activating this non-standard behaviour.*/
 296
 297         OM_uint32 ret_flags = 0;
 298         gss_buffer_desc gssbuf,send_tok,recv_tok,msg_tok;
 299         Gssctxt *ctxt = NULL;
 300         unsigned int klen, kout;
 301         unsigned char *kbuf;
 302         unsigned char *hash;
 303         DH *dh;
 304         BIGNUM *shared_secret = NULL;
 305         BIGNUM *dh_client_pub = NULL;
 306         int type =0;
 307         gss_OID oid;
 308         u_int slen;
 309
 310         /* Initialise GSSAPI */
 311
 312         debug2("%s: Identifying %s",__func__,kex->name);
 313         oid=ssh_gssapi_id_kex(ctxt,kex->name);
 314         if (oid==NULL) {
 315            packet_disconnect("Unknown gssapi mechanism");
 316         }
 317
 318         debug2("%s: Acquiring credentials",__func__);
 319
 320         if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt,oid))))
 321            packet_disconnect("Unable to acquire credentials for the server");
 322
 323         do {
 324                 debug("Wait SSH2_MSG_GSSAPI_INIT");
 325                 type = packet_read();
 326                 switch(type) {
 327                 case SSH2_MSG_KEXGSS_INIT:
 328                         if (dh_client_pub!=NULL)
 329                                 packet_disconnect("Received KEXGSS_INIT after initialising");
 330                         recv_tok.value=packet_get_string(&slen);
 331                         recv_tok.length=slen; /* int vs. size_t */
 332
 333                         dh_client_pub = BN_new();
 334
 335                         if (dh_client_pub == NULL)
 336                                 fatal("dh_client_pub == NULL");
 337                         packet_get_bignum2(dh_client_pub);
 338
 339                         /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
 340                         break;
 341                 case SSH2_MSG_KEXGSS_CONTINUE:
 342                         if (dh_client_pub == NULL)
 343                                 packet_disconnect("Received KEXGSS_CONTINUE without initialising");
 344                         recv_tok.value=packet_get_string(&slen);
 345                         recv_tok.length=slen; /* int vs. size_t */
 346                         break;
 347                 default:
 348                         packet_disconnect("Protocol error: didn't expect packet type %d",
 349                                            type);
 350                 }
 351
 352                 maj_status=PRIVSEP(ssh_gssapi_accept_ctx(ctxt,&recv_tok,
 353                                                          &send_tok, &ret_flags));
 354
 355                 gss_release_buffer(&min_status,&recv_tok);
 356
 357 #ifdef GSS_C_GLOBUS_LIMITED_PROXY_FLAG
 358                 if (ret_flags & GSS_C_GLOBUS_LIMITED_PROXY_FLAG) {
 359                         packet_disconnect("Limited proxy is not allowed in gssapi key exchange.");
 360                 }
 361 #endif
 362
 363                 if (maj_status & GSS_S_CONTINUE_NEEDED) {
 364                         debug("Sending GSSAPI_CONTINUE");
 365                         packet_start(SSH2_MSG_KEXGSS_CONTINUE);
 366                         packet_put_string(send_tok.value,send_tok.length);
 367                         packet_send();
 368                         packet_write_wait();
 369                         gss_release_buffer(&min_status, &send_tok);
 370                 }
 371         } while (maj_status & GSS_S_CONTINUE_NEEDED);
 372
 373         if (GSS_ERROR(maj_status)) {
 374                 ssh_gssapi_send_error(maj_status,min_status);
 375                 packet_disconnect("gssapi key exchange handshake failed");
 376         }
 377
 378         debug("gss_complete");
 379         if (!(ret_flags & GSS_C_MUTUAL_FLAG)) {
 380                 ssh_gssapi_send_error(maj_status,min_status);
 381                 packet_disconnect("gssapi mutual authentication failed");
 382         }
 383
 384         if (!(ret_flags & GSS_C_INTEG_FLAG)) {
 385                 ssh_gssapi_send_error(maj_status,min_status);
 386                 packet_disconnect("gssapi channel integrity not established");
 387         }
 388
 389         dh = dh_new_group1();
 390         dh_gen_key(dh, kex->we_need * 8);
 391
 392         if (!dh_pub_is_valid(dh, dh_client_pub))
 393                 packet_disconnect("bad client public DH value");
 394
 395         klen = DH_size(dh);
 396         kbuf = xmalloc(klen);
 397         kout = DH_compute_key(kbuf, dh_client_pub, dh);
 398
 399         shared_secret = BN_new();
 400         BN_bin2bn(kbuf, kout, shared_secret);
 401         memset(kbuf, 0, klen);
 402         xfree(kbuf);
 403
 404         hash = kex_gssapi_hash(
 405             kex->client_version_string,
 406             kex->server_version_string,
 407             buffer_ptr(&kex->peer), buffer_len(&kex->peer),
 408             buffer_ptr(&kex->my), buffer_len(&kex->my),
 409             NULL, 0, /* Change this if we start sending host keys */
 410             dh_client_pub,
 411             dh->pub_key,
 412             shared_secret
 413         );
 414         BN_free(dh_client_pub);
 415
 416         if (kex->session_id == NULL) {
 417                 kex->session_id_len = 20;
 418                 kex->session_id = xmalloc(kex->session_id_len);
 419                 memcpy(kex->session_id, hash, kex->session_id_len);
 420         }
 421
 422         gssbuf.value = hash;
 423         gssbuf.length = 20; /* Hashlen appears to always be 20 */
 424
 425         if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok)))) {
 426                 ssh_gssapi_send_error(maj_status,min_status);
 427                 packet_disconnect("Couldn't get MIC");
 428         }
 429
 430         packet_start(SSH2_MSG_KEXGSS_COMPLETE);
 431         packet_put_bignum2(dh->pub_key);
 432         packet_put_string((char *)msg_tok.value,msg_tok.length);
 433
 434         if (send_tok.length!=0) {
 435                 packet_put_char(1); /* true */
 436                 packet_put_string((char *)send_tok.value,send_tok.length);
 437         } else {
 438                 packet_put_char(0); /* false */
 439         }
 440         packet_send();
 441         packet_write_wait();
 442
 443         /* We used to store the client name and credentials here for later
 444          * use. With privsep, its easier to do this as a by product of the
 445          * call to accept_context, which stores delegated information when
 446          * the context is complete */
 447
 448         gss_release_buffer(&min_status, &send_tok);
 449
 450         /* If we've got a context, delete it. It may be NULL if we've been
 451          * using privsep */
 452         ssh_gssapi_delete_ctx(&ctxt);
 453
 454         DH_free(dh);
 455
 456         kex_derive_keys(kex, hash, shared_secret);
 457         BN_clear_free(shared_secret);
 458         kex_finish(kex);
 459 }
 460
 461 void
 462 kexgss(Kex *kex)
 463 {
 464         if (kex->server)
 465                 kexgss_server(kex);
 466         else
 467                 kexgss_client(kex);
 468 }
 469
 470 #endif /* GSSAPI */