openssh/gss-serv.c

   1 /*
   2  * Copyright (c) 2001 Simon Wilkinson. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  * 1. Redistributions of source code must retain the above copyright
   8  *    notice, this list of conditions and the following disclaimer.
   9  * 2. Redistributions in binary form must reproduce the above copyright
  10  *    notice, this list of conditions and the following disclaimer in the
  11  *    documentation and/or other materials provided with the distribution.
  12  *
  13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
  14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23  */
  24
  25 #include "includes.h"
  26
  27 #ifdef GSSAPI
  28
  29 #include "ssh.h"
  30 #include "ssh2.h"
  31 #include "xmalloc.h"
  32 #include "buffer.h"
  33 #include "bufaux.h"
  34 #include "packet.h"
  35 #include "compat.h"
  36 #include <openssl/evp.h>
  37 #include "cipher.h"
  38 #include "kex.h"
  39 #include "auth.h"
  40 #include "log.h"
  41 #include "channels.h"
  42 #include "session.h"
  43 #include "dispatch.h"
  44 #include "servconf.h"
  45 #include "compat.h"
  46
  47 #include "ssh-gss.h"
  48
  49 extern ServerOptions options;
  50 extern u_char *session_id2;
  51 extern int session_id2_len;
  52
  53
  54 typedef struct ssh_gssapi_cred_cache {
  55         char *filename;
  56         char *envvar;
  57         char *envval;
  58         void *data;
  59 } ssh_gssapi_cred_cache;
  60
  61 static struct ssh_gssapi_cred_cache gssapi_cred_store = {NULL,NULL,NULL};
  62
  63 #ifdef KRB5
  64
  65 #ifdef HEIMDAL
  66 #include <krb5.h>
  67 #else
  68 #include <gssapi_krb5.h>
  69 #define krb5_get_err_text(context,code) error_message(code)
  70 #endif
  71
  72 static krb5_context krb_context = NULL;
  73
  74 /* Initialise the krb5 library, so we can use it for those bits that
  75  * GSSAPI won't do */
  76
  77 int ssh_gssapi_krb5_init() {
  78         krb5_error_code problem;
  79
  80         if (krb_context !=NULL)
  81                 return 1;
  82
  83         problem = krb5_init_context(&krb_context);
  84         if (problem) {
  85                 log("Cannot initialize krb5 context");
  86                 return 0;
  87         }
  88         krb5_init_ets(krb_context);
  89
  90         return 1;
  91 }
  92
  93 /* Check if this user is OK to login. This only works with krb5 - other
  94  * GSSAPI mechanisms will need their own.
  95  * Returns true if the user is OK to log in, otherwise returns 0
  96  */
  97
  98 int
  99 ssh_gssapi_krb5_userok(char *name) {
 100         krb5_principal princ;
 101         int retval;
 102
 103         if (ssh_gssapi_krb5_init() == 0)
 104                 return 0;
 105
 106         if ((retval=krb5_parse_name(krb_context, gssapi_client_name.value,
 107                                     &princ))) {
 108                 log("krb5_parse_name(): %.100s",
 109                         krb5_get_err_text(krb_context,retval));
 110                 return 0;
 111         }
 112         if (krb5_kuserok(krb_context, princ, name)) {
 113                 retval = 1;
 114                 log("Authorized to %s, krb5 principal %s (krb5_kuserok)",name,
 115                     (char *)gssapi_client_name.value);
 116         }
 117         else
 118                 retval = 0;
 119
 120         krb5_free_principal(krb_context, princ);
 121         return retval;
 122 }
 123
 124 /* Make sure that this is called _after_ we've setuid to the user */
 125
 126 /* This writes out any forwarded credentials. Its specific to the Kerberos
 127  * GSSAPI mechanism
 128  *
 129  * We assume that our caller has made sure that the user has selected
 130  * delegated credentials, and that the client_creds structure is correctly
 131  * populated.
 132  */
 133
 134 void
 135 ssh_gssapi_krb5_storecreds() {
 136         krb5_ccache ccache;
 137         krb5_error_code problem;
 138         krb5_principal princ;
 139         char ccname[35];
 140         static char name[40];
 141         int tmpfd;
 142         OM_uint32 maj_status,min_status;
 143
 144
 145         if (gssapi_client_creds==NULL) {
 146                 debug("No credentials stored");
 147                 return;
 148         }
 149
 150         if (ssh_gssapi_krb5_init() == 0)
 151                 return;
 152
 153         if (options.gss_use_session_ccache) {
 154                 snprintf(ccname,sizeof(ccname),"/tmp/krb5cc_%d_XXXXXX",geteuid());
 155
 156                 if ((tmpfd = mkstemp(ccname))==-1) {
 157                         log("mkstemp(): %.100s", strerror(errno));
 158                         return;
 159                 }
 160                 if (fchmod(tmpfd, S_IRUSR | S_IWUSR) == -1) {
 161                         log("fchmod(): %.100s", strerror(errno));
 162                         close(tmpfd);
 163                         return;
 164                 }
 165         } else {
 166                 snprintf(ccname,sizeof(ccname),"/tmp/krb5cc_%d",geteuid());
 167                 tmpfd = open(ccname, O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
 168                 if (tmpfd == -1) {
 169                         log("open(): %.100s", strerror(errno));
 170                         return;
 171                 }
 172         }
 173
 174         close(tmpfd);
 175         snprintf(name, sizeof(name), "FILE:%s",ccname);
 176
 177         if ((problem = krb5_cc_resolve(krb_context, name, &ccache))) {
 178                 log("krb5_cc_default(): %.100s",
 179                         krb5_get_err_text(krb_context,problem));
 180                 return;
 181         }
 182
 183         if ((problem = krb5_parse_name(krb_context, gssapi_client_name.value,
 184                                        &princ))) {
 185                 log("krb5_parse_name(): %.100s",
 186                         krb5_get_err_text(krb_context,problem));
 187                 krb5_cc_destroy(krb_context,ccache);
 188                 return;
 189         }
 190
 191         if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
 192                 log("krb5_cc_initialize(): %.100s",
 193                         krb5_get_err_text(krb_context,problem));
 194                 krb5_free_principal(krb_context,princ);
 195                 krb5_cc_destroy(krb_context,ccache);
 196                 return;
 197         }
 198
 199         krb5_free_principal(krb_context,princ);
 200
 201         #ifdef HEIMDAL
 202         if ((problem = krb5_cc_copy_cache(krb_context,
 203                                            gssapi_client_creds->ccache,
 204                                            ccache))) {
 205                 log("krb5_cc_copy_cache(): %.100s",
 206                         krb5_get_err_text(krb_context,problem));
 207                 krb5_cc_destroy(krb_context,ccache);
 208                 return;
 209         }
 210         #else
 211         if ((maj_status = gss_krb5_copy_ccache(&min_status,
 212                                                gssapi_client_creds,
 213                                                ccache))) {
 214                 log("gss_krb5_copy_ccache() failed");
 215                 ssh_gssapi_error(maj_status,min_status);
 216                 krb5_cc_destroy(krb_context,ccache);
 217                 return;
 218         }
 219         #endif
 220
 221         krb5_cc_close(krb_context,ccache);
 222
 223
 224 #ifdef USE_PAM
 225         do_pam_putenv("KRB5CCNAME",name);
 226 #endif
 227
 228         gssapi_cred_store.filename=strdup(ccname);
 229         gssapi_cred_store.envvar="KRB5CCNAME";
 230         gssapi_cred_store.envval=strdup(name);
 231
 232         return;
 233 }
 234
 235 #endif /* KRB5 */
 236
 237 #ifdef GSI
 238 #include <globus_gss_assist.h>
 239
 240 /*
 241  * Check if this user is OK to login under GSI. User has been authenticated
 242  * as identity in global 'client_name.value' and is trying to log in as passed
 243  * username in 'name'.
 244  *
 245  * Returns non-zero if user is authorized, 0 otherwise.
 246  */
 247 int
 248 ssh_gssapi_gsi_userok(char *name)
 249 {
 250     int authorized = 0;
 251
 252     /* This returns 0 on success */
 253     authorized = (globus_gss_assist_userok(gssapi_client_name.value,
 254                                            name) == 0);
 255
 256     debug("GSI user %s is%s authorized as target user %s",
 257           (char *) gssapi_client_name.value,
 258           (authorized ? "" : " not"),
 259           name);
 260
 261     return authorized;
 262 }
 263
 264 /*
 265  * Handle setting up child environment for GSI.
 266  *
 267  * Make sure that this is called _after_ we've setuid to the user.
 268  */
 269 void
 270 ssh_gssapi_gsi_storecreds()
 271 {
 272         OM_uint32       major_status;
 273         OM_uint32       minor_status;
 274
 275
 276         if (gssapi_client_creds != NULL)
 277         {
 278                 char *creds_env = NULL;
 279
 280                 /*
 281                  * This is the current hack with the GSI gssapi library to
 282                  * export credentials to disk.
 283                  */
 284
 285                 debug("Exporting delegated credentials");
 286
 287                 minor_status = 0xdee0;  /* Magic value */
 288                 major_status =
 289                         gss_inquire_cred(&minor_status,
 290                                          gssapi_client_creds,
 291                                          (gss_name_t *) &creds_env,
 292                                          NULL,
 293                                          NULL,
 294                                          NULL);
 295
 296                 if ((major_status == GSS_S_COMPLETE) &&
 297                     (minor_status == 0xdee1) &&
 298                     (creds_env != NULL))
 299                 {
 300                         char            *value;
 301
 302                         /*
 303                          * String is of the form:
 304                          * X509_USER_DELEG_PROXY=filename
 305                          * so we parse out the filename
 306                          * and then set X509_USER_PROXY
 307                          * to point at it.
 308                          */
 309                         value = strchr(creds_env, '=');
 310
 311                         if (value != NULL)
 312                         {
 313                                 *value = '\0';
 314                                 value++;
 315 #ifdef USE_PAM
 316                                 do_pam_putenv("X509_USER_PROXY",value);
 317 #endif
 318                                 gssapi_cred_store.filename=NULL;
 319                                 gssapi_cred_store.envvar="X509_USER_PROXY";
 320                                 gssapi_cred_store.envval=strdup(value);
 321
 322                                 return;
 323                         }
 324                         else
 325                         {
 326                                 log("Failed to parse delegated credentials string '%s'",
 327                                     creds_env);
 328                         }
 329                 }
 330                 else
 331                 {
 332                         log("Failed to export delegated credentials (error %ld)",
 333                             major_status);
 334                 }
 335         }
 336 }
 337
 338 #endif /* GSI */
 339
 340 void
 341 ssh_gssapi_cleanup_creds(void *ignored)
 342 {
 343         if (gssapi_cred_store.filename!=NULL) {
 344                 /* Unlink probably isn't sufficient */
 345                 debug("removing gssapi cred file\"%s\"",gssapi_cred_store.filename);
 346                 unlink(gssapi_cred_store.filename);
 347         }
 348 }
 349
 350 void
 351 ssh_gssapi_storecreds()
 352 {
 353         switch (gssapi_client_type) {
 354 #ifdef KRB5
 355         case GSS_KERBEROS:
 356                 ssh_gssapi_krb5_storecreds();
 357                 break;
 358 #endif
 359 #ifdef GSI
 360         case GSS_GSI:
 361                 ssh_gssapi_gsi_storecreds();
 362                 break;
 363 #endif /* GSI */
 364         case GSS_LAST_ENTRY:
 365                 /* GSSAPI not used in this authentication */
 366                 debug("No GSSAPI credentials stored");
 367                 break;
 368         default:
 369                 log("ssh_gssapi_do_child: Unknown mechanism");
 370
 371         }
 372
 373         if (options.gss_cleanup_creds) {
 374                 fatal_add_cleanup(ssh_gssapi_cleanup_creds, NULL);
 375         }
 376
 377 }
 378
 379 /* This allows GSSAPI methods to do things to the childs environment based
 380  * on the passed authentication process and credentials.
 381  *
 382  * Question: If we didn't use userauth_external for some reason, should we
 383  * still delegate credentials?
 384  */
 385 void
 386 ssh_gssapi_do_child(char ***envp, u_int *envsizep)
 387 {
 388
 389         if (gssapi_cred_store.envvar!=NULL &&
 390             gssapi_cred_store.envval!=NULL) {
 391
 392                 debug("Setting %s to %s", gssapi_cred_store.envvar,
 393                                           gssapi_cred_store.envval);
 394                 child_set_env(envp, envsizep, gssapi_cred_store.envvar,
 395                                               gssapi_cred_store.envval);
 396         }
 397
 398         switch(gssapi_client_type) {
 399 #ifdef KRB5
 400         case GSS_KERBEROS: break;
 401 #endif
 402 #ifdef GSI
 403         case GSS_GSI: break;
 404 #endif
 405         case GSS_LAST_ENTRY:
 406                 debug("No GSSAPI credentials stored");
 407                 break;
 408         default:
 409                 log("ssh_gssapi_do_child: Unknown mechanism");
 410         }
 411 }
 412
 413 int
 414 ssh_gssapi_userok(char *user)
 415 {
 416         if (gssapi_client_name.length==0 ||
 417             gssapi_client_name.value==NULL) {
 418                 debug("No suitable client data");
 419                 return 0;
 420         }
 421         switch (gssapi_client_type) {
 422 #ifdef KRB5
 423         case GSS_KERBEROS:
 424                 return(ssh_gssapi_krb5_userok(user));
 425                 break; /* Not reached */
 426 #endif
 427 #ifdef GSI
 428         case GSS_GSI:
 429                 return(ssh_gssapi_gsi_userok(user));
 430                 break; /* Not reached */
 431 #endif /* GSI */
 432         case GSS_LAST_ENTRY:
 433                 debug("Client not GSSAPI");
 434                 break;
 435         default:
 436                 debug("Unknown client authentication type");
 437         }
 438         return(0);
 439 }
 440
 441 int
 442 userauth_external(Authctxt *authctxt)
 443 {
 444         packet_check_eom();
 445
 446         return(ssh_gssapi_userok(authctxt->user));
 447 }
 448
 449 void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
 450 void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
 451
 452 /* We only support those mechanisms that we know about (ie ones that we know
 453  * how to check local user kuserok and the like
 454  */
 455 int
 456 userauth_gssapi(Authctxt *authctxt)
 457 {
 458         gss_OID_desc    oid= {0,NULL};
 459         Gssctxt         *ctxt;
 460         int             mechs;
 461         gss_OID_set     supported;
 462         int             present;
 463         OM_uint32       ms;
 464         u_int           len;
 465
 466         if (!authctxt->valid || authctxt->user == NULL)
 467                 return 0;
 468
 469         if (datafellows & SSH_OLD_GSSAPI) {
 470                 debug("Early drafts of GSSAPI userauth not supported");
 471                 return 0;
 472         }
 473
 474         mechs=packet_get_int();
 475         if (mechs==0) {
 476                 debug("Mechanism negotiation is not supported");
 477                 return 0;
 478         }
 479
 480         ssh_gssapi_supported_oids(&supported);
 481         do {
 482                 if (oid.elements)
 483                         xfree(oid.elements);
 484                 oid.elements = packet_get_string(&len);
 485                 oid.length = len;
 486                 gss_test_oid_set_member(&ms, &oid, supported, &present);
 487                 mechs--;
 488         } while (mechs>0 && !present);
 489
 490         if (!present) {
 491                 xfree(oid.elements);
 492                 return(0);
 493         }
 494
 495         ctxt=xmalloc(sizeof(Gssctxt));
 496         authctxt->methoddata=(void *)ctxt;
 497
 498         ssh_gssapi_build_ctx(ctxt);
 499         ssh_gssapi_set_oid(ctxt,&oid);
 500
 501         if (ssh_gssapi_acquire_cred(ctxt))
 502                 return 0;
 503
 504         /* Send SSH_MSG_USERAUTH_GSSAPI_RESPONSE */
 505
 506         packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
 507         packet_put_string(oid.elements,oid.length);
 508         packet_send();
 509         packet_write_wait();
 510         xfree(oid.elements);
 511
 512         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN,
 513                      &input_gssapi_token);
 514         authctxt->postponed = 1;
 515
 516         return 0;
 517 }
 518
 519 void
 520 input_gssapi_token(int type, u_int32_t plen, void *ctxt)
 521 {
 522         Authctxt *authctxt = ctxt;
 523         Gssctxt *gssctxt;
 524         gss_buffer_desc send_tok,recv_tok;
 525         OM_uint32 maj_status, min_status;
 526
 527         if (authctxt == NULL || authctxt->methoddata == NULL)
 528                 fatal("No authentication or GSSAPI context");
 529
 530         gssctxt=authctxt->methoddata;
 531
 532         recv_tok.value=packet_get_string(&recv_tok.length);
 533
 534         maj_status=ssh_gssapi_accept_ctx(gssctxt, &recv_tok, &send_tok, NULL);
 535         packet_check_eom();
 536
 537         if (GSS_ERROR(maj_status)) {
 538                 /* Failure <sniff> */
 539                 authctxt->postponed = 0;
 540                 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
 541                 userauth_finish(authctxt, 0, "gssapi");
 542         }
 543
 544         if (send_tok.length != 0) {
 545                 /* Send a packet back to the client */
 546                 packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
 547                 packet_put_string(send_tok.value,send_tok.length);
 548                 packet_send();
 549                 packet_write_wait();
 550                 gss_release_buffer(&min_status, &send_tok);
 551         }
 552
 553         if (maj_status == GSS_S_COMPLETE) {
 554                 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN,NULL);
 555                 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
 556                              &input_gssapi_exchange_complete);
 557         }
 558 }
 559
 560 /* This is called when the client thinks we've completed authentication.
 561  * It should only be enabled in the dispatch handler by the function above,
 562  * which only enables it once the GSSAPI exchange is complete.
 563  */
 564
 565 void
 566 input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
 567 {
 568         Authctxt *authctxt = ctxt;
 569         Gssctxt *gssctxt;
 570         int authenticated;
 571
 572         if (authctxt == NULL || authctxt->methoddata == NULL)
 573                 fatal("No authentication or GSSAPI context");
 574
 575         gssctxt=authctxt->methoddata;
 576
 577         /* This should never happen, but better safe than sorry. */
 578         if (gssctxt->status != GSS_S_COMPLETE) {
 579                 packet_disconnect("Context negotiation is not complete");
 580         }
 581
 582         if (ssh_gssapi_getclient(gssctxt,&gssapi_client_type,
 583                                  &gssapi_client_name,
 584                                  &gssapi_client_creds)) {
 585                 fatal("Couldn't convert client name");
 586         }
 587
 588         authenticated = ssh_gssapi_userok(authctxt->user);
 589
 590         authctxt->postponed = 0;
 591         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
 592         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
 593         userauth_finish(authctxt, authenticated, "gssapi");
 594 }
 595
 596 #endif /* GSSAPI */