openssh/gss-genr.c

   1 /*
   2  * Copyright (c) 2001,2002 Simon Wilkinson. All rights reserved. *
   3  * Redistribution and use in source and binary forms, with or without
   4  * modification, are permitted provided that the following conditions
   5  * are met:
   6  * 1. Redistributions of source code must retain the above copyright
   7  *    notice, this list of conditions and the following disclaimer.
   8  * 2. Redistributions in binary form must reproduce the above copyright
   9  *    notice, this list of conditions and the following disclaimer in the
  10  *    documentation and/or other materials provided with the distribution.
  11  *
  12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
  13  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  14  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  15  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  16  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  17  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  18  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  19  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  20  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  21  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  22  */
  23
  24 #include "includes.h"
  25
  26 #ifdef GSSAPI
  27
  28 #include "ssh.h"
  29 #include "ssh2.h"
  30 #include "xmalloc.h"
  31 #include "buffer.h"
  32 #include "bufaux.h"
  33 #include "packet.h"
  34 #include "compat.h"
  35 #include <openssl/evp.h>
  36 #include "cipher.h"
  37 #include "kex.h"
  38 #include "log.h"
  39 #include "compat.h"
  40 #include "monitor_wrap.h"
  41
  42 #include <netdb.h>
  43
  44 #include "ssh-gss.h"
  45
  46 /* Assorted globals for tracking the clients identity once they've
  47  * authenticated */
  48
  49 gss_buffer_desc gssapi_client_name = {0,NULL}; /* Name of our client */
  50 gss_cred_id_t   gssapi_client_creds = GSS_C_NO_CREDENTIAL; /* Their credentials */
  51 enum ssh_gss_id gssapi_client_type = GSS_LAST_ENTRY;
  52
  53 unsigned char ssh1_key_digest[16]; /* used for ssh1 gssapi */
  54
  55 /* The mechanism name used in the list below is defined in the internet
  56  * draft as the Base 64 encoding of the MD5 hash of the ASN.1 DER encoding
  57  * of the underlying GSSAPI mechanism's OID.
  58  *
  59  * Also from the draft, before considering adding SPNEGO, bear in mind that
  60  * "mechanisms ... MUST NOT use SPNEGO as the underlying GSSAPI mechanism"
  61  */
  62
  63 /* These must be in the same order as ssh_gss_id, in ssh-gss.h */
  64
  65 ssh_gssapi_mech supported_mechs[]= {
  66 #ifdef KRB5
  67  /* Official OID - 1.2.850.113554.1.2.2 */
  68  {"Se3H81ismmOC3OE+FwYCiQ==","Kerberos",
  69         {9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"}},
  70 #endif
  71 #ifdef GSI
  72  /* gssapi_ssleay 1.3.6.1.4.1.3536.1.1 */
  73  {"N3+k7/4wGxHyuP8Yxi4RhA==",
  74   "GSI",
  75   {9, "\x2B\x06\x01\x04\x01\x9B\x50\x01\x01"}
  76  },
  77 #endif /* GSI */
  78  {NULL,NULL,{0,0}}
  79 };
  80
  81 char gssprefix[]=KEX_GSS_SHA1;
  82
  83 /* Return a list of the gss-group1-sha1-x mechanisms supported by this
  84  * program.
  85  *
  86  * We only support the mechanisms that we've indicated in the list above,
  87  * but we check that they're supported by the GSSAPI mechanism on the
  88  * machine. We also check, before including them in the list, that
  89  * we have the necesary information in order to carry out the key exchange
  90  * (that is, that the user has credentials, the server's creds are accessible,
  91  * etc)
  92  *
  93  * The way that this is done is fairly nasty, as we do a lot of work that
  94  * is then thrown away. This should possibly be implemented with a cache
  95  * that stores the results (in an expanded Gssctxt structure), which are
  96  * then used by the first calls if that key exchange mechanism is chosen.
  97  */
  98
  99 char *
 100 ssh_gssapi_mechanisms(int server,char *host) {
 101         gss_OID_set     supported;
 102         OM_uint32       maj_status, min_status;
 103         Buffer          buf;
 104         int             i = 0;
 105         int             present;
 106         char *          mechs;
 107         Gssctxt *       ctx = NULL;
 108
 109         if (datafellows & SSH_OLD_GSSAPI) return NULL;
 110
 111         gss_indicate_mechs(&min_status, &supported);
 112
 113         buffer_init(&buf);
 114
 115         do {
 116                 if ((maj_status=gss_test_oid_set_member(&min_status,
 117                                                         &supported_mechs[i].oid,
 118                                                         supported,
 119                                                         &present))) {
 120                         present=0;
 121                 }
 122                 if (present) {
 123                         if ((server &&
 124                              !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx,
 125                                                             &supported_mechs[i].oid))))
 126                             || (!server &&
 127                                 !GSS_ERROR(ssh_gssapi_client_ctx(&ctx,
 128                                                        &supported_mechs[i].oid,
 129                                                        host)))) {
 130                                 /* Append gss_group1_sha1_x to our list */
 131                                 buffer_append(&buf, gssprefix,
 132                                               strlen(gssprefix));
 133                                 buffer_append(&buf,
 134                                               supported_mechs[i].enc_name,
 135                                               strlen(supported_mechs[i].enc_name));
 136                        }
 137                 }
 138         } while (supported_mechs[++i].name != NULL);
 139
 140         buffer_put_char(&buf,'\0');
 141
 142         mechs=xmalloc(buffer_len(&buf));
 143         buffer_get(&buf,mechs,buffer_len(&buf));
 144         buffer_free(&buf);
 145         if (strlen(mechs)==0)
 146            return(NULL);
 147         else
 148            return(mechs);
 149 }
 150
 151 void ssh_gssapi_supported_oids(gss_OID_set *oidset) {
 152         enum ssh_gss_id i =0;
 153         OM_uint32 maj_status,min_status;
 154         int present;
 155         gss_OID_set supported;
 156
 157         gss_create_empty_oid_set(&min_status,oidset);
 158         gss_indicate_mechs(&min_status, &supported);
 159
 160         while (supported_mechs[i].name!=NULL) {
 161                 if ((maj_status=gss_test_oid_set_member(&min_status,
 162                                                        &supported_mechs[i].oid,
 163                                                        supported,
 164                                                        &present))) {
 165                         present=0;
 166                 }
 167                 if (present) {
 168                         gss_add_oid_set_member(&min_status,
 169                                                &supported_mechs[i].oid,
 170                                                oidset);
 171                 }
 172                 i++;
 173         }
 174 }
 175
 176 /* Set the contexts OID from a data stream */
 177 void ssh_gssapi_set_oid_data(Gssctxt *ctx, void *data, size_t len) {
 178   if (ctx->oid != GSS_C_NO_OID) {
 179         xfree(ctx->oid->elements);
 180         xfree(ctx->oid);
 181   }
 182   ctx->oid=xmalloc(sizeof(gss_OID_desc));
 183   ctx->oid->length=len;
 184   ctx->oid->elements=xmalloc(len);
 185   memcpy(ctx->oid->elements,data,len);
 186 }
 187
 188 /* Set the contexts OID */
 189 void ssh_gssapi_set_oid(Gssctxt *ctx, gss_OID oid) {
 190   ssh_gssapi_set_oid_data(ctx,oid->elements,oid->length);
 191 }
 192
 193 /* Find out which GSS type (out of the list we define in ssh-gss.h) a
 194  * particular connection is using
 195  */
 196 enum ssh_gss_id ssh_gssapi_get_ctype(Gssctxt *ctxt) {
 197         enum ssh_gss_id i=0;
 198
 199         while(supported_mechs[i].name!=NULL) {
 200            if (supported_mechs[i].oid.length == ctxt->oid->length &&
 201                (memcmp(supported_mechs[i].oid.elements,
 202                        ctxt->oid->elements,ctxt->oid->length) == 0))
 203                return i;
 204            i++;
 205         }
 206         return(GSS_LAST_ENTRY);
 207 }
 208
 209 /* Set the GSS context's OID to the oid indicated by the given key exchange
 210  * name. */
 211 gss_OID ssh_gssapi_id_kex(Gssctxt *ctx, char *name) {
 212   enum ssh_gss_id i=0;
 213
 214   if (strncmp(name, gssprefix, strlen(gssprefix)-1) !=0) {
 215      return(NULL);
 216   }
 217
 218   name+=strlen(gssprefix); /* Move to the start of the MIME string */
 219
 220   while (supported_mechs[i].name!=NULL &&
 221          strcmp(name,supported_mechs[i].enc_name)!=0) {
 222         i++;
 223   }
 224
 225   if (supported_mechs[i].name==NULL)
 226      return (NULL);
 227
 228   if (ctx) ssh_gssapi_set_oid(ctx,&supported_mechs[i].oid);
 229
 230   return &supported_mechs[i].oid;
 231 }
 232
 233
 234 /* All this effort to report an error ... */
 235 static void
 236 ssh_gssapi_error_ex(OM_uint32 major_status,OM_uint32 minor_status,
 237                     int send_packet) {
 238         OM_uint32 lmaj, lmin;
 239         gss_buffer_desc msg;
 240         OM_uint32 ctx;
 241
 242         ctx = 0;
 243         /* The GSSAPI error */
 244         do {
 245                 lmaj = gss_display_status(&lmin, major_status,
 246                                           GSS_C_GSS_CODE,
 247                                           GSS_C_NULL_OID,
 248                                           &ctx, &msg);
 249                 if (lmaj == GSS_S_COMPLETE) {
 250                         debug((char *)msg.value);
 251                         if (send_packet) packet_send_debug((char *)msg.value);
 252                         (void) gss_release_buffer(&lmin, &msg);
 253                 }
 254         } while (ctx!=0);
 255
 256         /* The mechanism specific error */
 257         do {
 258                 lmaj = gss_display_status(&lmin, minor_status,
 259                                           GSS_C_MECH_CODE,
 260                                           GSS_C_NULL_OID,
 261                                           &ctx, &msg);
 262                 if (lmaj == GSS_S_COMPLETE) {
 263                         debug((char *)msg.value);
 264                         if (send_packet) packet_send_debug((char *)msg.value);
 265                         (void) gss_release_buffer(&lmin, &msg);
 266                 }
 267         } while (ctx!=0);
 268 }
 269
 270 void
 271 ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status) {
 272     ssh_gssapi_error_ex(major_status, minor_status, 0);
 273 }
 274
 275 void
 276 ssh_gssapi_send_error(OM_uint32 major_status,OM_uint32 minor_status) {
 277     ssh_gssapi_error_ex(major_status, minor_status, 1);
 278 }
 279
 280
 281
 282
 283 /* Initialise our GSSAPI context. We use this opaque structure to contain all
 284  * of the data which both the client and server need to persist across
 285  * {accept,init}_sec_context calls, so that when we do it from the userauth
 286  * stuff life is a little easier
 287  */
 288 void
 289 ssh_gssapi_build_ctx(Gssctxt **ctx)
 290 {
 291         *ctx=xmalloc(sizeof (Gssctxt));
 292         (*ctx)->context=GSS_C_NO_CONTEXT;
 293         (*ctx)->name=GSS_C_NO_NAME;
 294         (*ctx)->oid=GSS_C_NO_OID;
 295         (*ctx)->creds=GSS_C_NO_CREDENTIAL;
 296         (*ctx)->client=GSS_C_NO_NAME;
 297         (*ctx)->client_creds=GSS_C_NO_CREDENTIAL;
 298 }
 299
 300 /* Delete our context, providing it has been built correctly */
 301 void
 302 ssh_gssapi_delete_ctx(Gssctxt **ctx)
 303 {
 304         OM_uint32 ms;
 305
 306         /* Return if there's no context */
 307         if ((*ctx)==NULL)
 308                 return;
 309
 310         if ((*ctx)->context != GSS_C_NO_CONTEXT)
 311                 gss_delete_sec_context(&ms,&(*ctx)->context,GSS_C_NO_BUFFER);
 312         if ((*ctx)->name != GSS_C_NO_NAME)
 313                 gss_release_name(&ms,&(*ctx)->name);
 314         if ((*ctx)->oid != GSS_C_NO_OID) {
 315                 xfree((*ctx)->oid->elements);
 316                 xfree((*ctx)->oid);
 317                 (*ctx)->oid = GSS_C_NO_OID;
 318         }
 319         if ((*ctx)->creds != GSS_C_NO_CREDENTIAL)
 320                 gss_release_cred(&ms,&(*ctx)->creds);
 321         if ((*ctx)->client != GSS_C_NO_NAME)
 322                 gss_release_name(&ms,&(*ctx)->client);
 323         if ((*ctx)->client_creds != GSS_C_NO_CREDENTIAL)
 324                 gss_release_cred(&ms,&(*ctx)->client_creds);
 325
 326         xfree(*ctx);
 327         *ctx=NULL;
 328 }
 329
 330 /* Wrapper to init_sec_context
 331  * Requires that the context contains:
 332  *      oid
 333  *      server name (from ssh_gssapi_import_name)
 334  */
 335 OM_uint32
 336 ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
 337                     gss_buffer_desc* send_tok, OM_uint32 *flags)
 338 {
 339         OM_uint32 maj_status, min_status;
 340         int deleg_flag = 0;
 341
 342         if (deleg_creds) {
 343                 deleg_flag=GSS_C_DELEG_FLAG;
 344                 debug("Delegating credentials");
 345         }
 346
 347         maj_status=gss_init_sec_context(&min_status,
 348                                         GSS_C_NO_CREDENTIAL, /* def. cred */
 349                                         &ctx->context,
 350                                         ctx->name,
 351                                         ctx->oid,
 352                                         GSS_C_MUTUAL_FLAG |
 353                                         GSS_C_INTEG_FLAG |
 354                                         deleg_flag,
 355                                         0, /* default lifetime */
 356                                         NULL, /* no channel bindings */
 357                                         recv_tok,
 358                                         NULL,
 359                                         send_tok,
 360                                         flags,
 361                                         NULL);
 362         ctx->status=maj_status;
 363         if (GSS_ERROR(maj_status)) {
 364                 ssh_gssapi_error(maj_status,min_status);
 365         }
 366         return(maj_status);
 367 }
 368
 369 /* Wrapper arround accept_sec_context
 370  * Requires that the context contains:
 371  *    oid
 372  *    credentials       (from ssh_gssapi_acquire_cred)
 373  */
 374 OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *ctx,gss_buffer_desc *recv_tok,
 375                                 gss_buffer_desc *send_tok, OM_uint32 *flags)
 376 {
 377         OM_uint32 maj_status, min_status;
 378         gss_OID mech;
 379
 380         maj_status=gss_accept_sec_context(&min_status,
 381                                           &ctx->context,
 382                                           ctx->creds,
 383                                           recv_tok,
 384                                           GSS_C_NO_CHANNEL_BINDINGS,
 385                                           &ctx->client,
 386                                           &mech,
 387                                           send_tok,
 388                                           flags,
 389                                           NULL,
 390                                           &ctx->client_creds);
 391         if (GSS_ERROR(maj_status)) {
 392                 ssh_gssapi_send_error(maj_status,min_status);
 393         }
 394
 395         if (ctx->client_creds) {
 396                 debug("Received some client credentials");
 397         } else {
 398                 debug("Got no client credentials");
 399         }
 400
 401         /* FIXME: We should check that the me
 402          * the one that we asked for (in ctx->oid) */
 403
 404         ctx->status=maj_status;
 405
 406         /* Now, if we're complete and we have the right flags, then
 407          * we flag the user as also having been authenticated
 408          */
 409
 410         if (((flags==NULL) || ((*flags & GSS_C_MUTUAL_FLAG) &&
 411                                (*flags & GSS_C_INTEG_FLAG))) &&
 412             (maj_status == GSS_S_COMPLETE)) {
 413                 if (ssh_gssapi_getclient(ctx,&gssapi_client_type,
 414                                          &gssapi_client_name,
 415                                          &gssapi_client_creds))
 416                         fatal("Couldn't convert client name");
 417         }
 418
 419         return(maj_status);
 420 }
 421
 422 /* Create a service name for the given host */
 423 OM_uint32
 424 ssh_gssapi_import_name(Gssctxt *ctx, const char *host) {
 425         gss_buffer_desc gssbuf;
 426         OM_uint32 maj_status, min_status;
 427         struct hostent *hostinfo = NULL;
 428         char *xhost, *addr;
 429
 430         /* Make a copy of the host name, in case it was returned by a
 431          * previous call to gethostbyname(). */
 432         xhost = xstrdup(host);
 433
 434         /* Make sure we have the FQDN. Some GSSAPI implementations don't do
 435          * this for us themselves */
 436         hostinfo = gethostbyname(xhost);
 437
 438         /* Use local hostname when coming in on loopback interface because
 439            we won't have 'localhost' credentials. */
 440         if (hostinfo &&
 441             hostinfo->h_addrtype == AF_INET) {
 442             struct in_addr addr;
 443             addr = *(struct in_addr *)(hostinfo->h_addr);
 444             if (ntohl(addr.s_addr) == INADDR_LOOPBACK) {
 445                 char buf[4096];
 446                 if (gethostname(buf, 4096) == 0) {
 447                     hostinfo = gethostbyname(buf);
 448                 }
 449             }
 450         }
 451
 452         /* Go to the resolver to get the official hostname for our target.
 453            WARNING: This makes us vulnerable to DNS spoofing. */
 454         if ((hostinfo == NULL) || (hostinfo->h_name == NULL)) {
 455                 debug("Unable to get FQDN for \"%s\"", xhost);
 456         } else {
 457                 addr = xmalloc(hostinfo->h_length);
 458                 memcpy(addr, hostinfo->h_addr, hostinfo->h_length);
 459                 hostinfo = gethostbyaddr(addr, hostinfo->h_length,
 460                                          hostinfo->h_addrtype);
 461                 xfree(addr);
 462                 if ((hostinfo == NULL) || (hostinfo->h_name == NULL)) {
 463                     debug("Unable to get FQDN for \"%s\"", xhost);
 464                 } else {
 465                     xfree(xhost);
 466                     xhost = xstrdup(hostinfo->h_name);
 467                 }
 468         }
 469
 470         gssbuf.length = sizeof("host@")+strlen(xhost);
 471
 472         gssbuf.value = xmalloc(gssbuf.length);
 473         if (gssbuf.value == NULL) {
 474                 xfree(xhost);
 475                 return(-1);
 476         }
 477         snprintf(gssbuf.value,gssbuf.length,"host@%s",xhost);
 478         if ((maj_status=gss_import_name(&min_status,
 479                                         &gssbuf,
 480                                         GSS_C_NT_HOSTBASED_SERVICE,
 481                                         &ctx->name))) {
 482                 ssh_gssapi_error(maj_status,min_status);
 483         }
 484
 485         xfree(xhost);
 486         xfree(gssbuf.value);
 487         return(maj_status);
 488 }
 489
 490 /* Acquire credentials for a server running on the current host.
 491  * Requires that the context structure contains a valid OID
 492  */
 493
 494 /* Returns a GSSAPI error code */
 495 OM_uint32
 496 ssh_gssapi_acquire_cred(Gssctxt *ctx) {
 497         OM_uint32 maj_status, min_status;
 498         char lname[MAXHOSTNAMELEN];
 499         gss_OID_set oidset;
 500
 501         gss_create_empty_oid_set(&min_status,&oidset);
 502         gss_add_oid_set_member(&min_status,ctx->oid,&oidset);
 503
 504         if (gethostname(lname, MAXHOSTNAMELEN)) {
 505                 return(-1);
 506         }
 507
 508         if ((maj_status=ssh_gssapi_import_name(ctx,lname))) {
 509                 return(maj_status);
 510         }
 511         if ((maj_status=gss_acquire_cred(&min_status,
 512                                     ctx->name,
 513                                     0,
 514                                     oidset,
 515                                     GSS_C_ACCEPT,
 516                                     &ctx->creds,
 517                                     NULL,
 518                                     NULL))) {
 519                 ssh_gssapi_error(maj_status,min_status);
 520         }
 521
 522         gss_release_oid_set(&min_status, &oidset);
 523         return(maj_status);
 524 }
 525
 526 /* Extract the client details from a given context. This can only reliably
 527  * be called once for a context */
 528
 529 OM_uint32
 530 ssh_gssapi_getclient(Gssctxt *ctx, enum ssh_gss_id *type,
 531                      gss_buffer_desc *name, gss_cred_id_t *creds) {
 532
 533         OM_uint32 maj_status,min_status;
 534
 535         *type=ssh_gssapi_get_ctype(ctx);
 536         if ((maj_status=gss_display_name(&min_status,ctx->client,name,NULL))) {
 537                 ssh_gssapi_error(maj_status,min_status);
 538         }
 539
 540         /* This is icky. There appears to be no way to copy this structure,
 541          * rather than the pointer to it, so we simply copy the pointer and
 542          * mark the originator as empty so we don't destroy it.
 543          */
 544         *creds=ctx->client_creds;
 545         ctx->client_creds=GSS_C_NO_CREDENTIAL;
 546         return(maj_status);
 547 }
 548
 549 OM_uint32
 550 ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *buffer, gss_buffer_desc *hash) {
 551         OM_uint32 maj_status,min_status;
 552
 553         /* ssh1 needs to exchange the hash of the keys */
 554         /* will us this hash to return it */
 555         if (!compat20) {
 556                 if ((maj_status=gss_wrap(&min_status,ctx->context,
 557                                         0,
 558                                         GSS_C_QOP_DEFAULT,
 559                                         buffer,
 560                                         NULL,
 561                                         hash)))
 562                         ssh_gssapi_error(maj_status,min_status);
 563         }
 564         else
 565
 566         if ((maj_status=gss_get_mic(&min_status,ctx->context,
 567                                     GSS_C_QOP_DEFAULT, buffer, hash))) {
 568                 ssh_gssapi_error(maj_status,min_status);
 569         }
 570
 571         return(maj_status);
 572 }
 573
 574 OM_uint32
 575 ssh_gssapi_server_ctx(Gssctxt **ctx,gss_OID oid) {
 576         if (*ctx) ssh_gssapi_delete_ctx(ctx);
 577         ssh_gssapi_build_ctx(ctx);
 578         ssh_gssapi_set_oid(*ctx,oid);
 579         return(ssh_gssapi_acquire_cred(*ctx));
 580 }
 581
 582 OM_uint32
 583 ssh_gssapi_client_ctx(Gssctxt **ctx,gss_OID oid, char *host) {
 584         gss_buffer_desc token;
 585         OM_uint32 major,minor;
 586
 587         if (*ctx) ssh_gssapi_delete_ctx(ctx);
 588         ssh_gssapi_build_ctx(ctx);
 589         ssh_gssapi_set_oid(*ctx,oid);
 590         ssh_gssapi_import_name(*ctx,host);
 591         major=ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, NULL);
 592         gss_release_buffer(&minor,&token);
 593         return(major);
 594 }
 595
 596 #endif /* GSSAPI */