on gssapi authentication errors, send error information back to the client

to assist with debugging

diff --git a/openssh/gss-genr.c b/openssh/gss-genr.c
index b3d2d590febc66e1585e278ba07d50e8703ec47e..afd02821856e2f7805a7931ef2061367413dc090 100644 (file)
--- a/openssh/gss-genr.c
+++ b/openssh/gss-genr.c
@@ -241,8 +241,9 @@ int ssh_gssapi_id_kex(Gssctxt *ctx, char *name) {
 
 
 /* All this effort to report an error ... */
-void
-ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status) {
+static void
+ssh_gssapi_error_ex(OM_uint32 major_status,OM_uint32 minor_status,
+                   int send_packet) {
        OM_uint32 lmaj, lmin;
         gss_buffer_desc msg;
         OM_uint32 ctx;
@@ -256,6 +257,7 @@ ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status) {
                                          &ctx, &msg);
                if (lmaj == GSS_S_COMPLETE) {
                        debug((char *)msg.value);
+                       if (send_packet) packet_send_debug((char *)msg.value);
                        (void) gss_release_buffer(&lmin, &msg);
                }
         } while (ctx!=0);         
@@ -268,11 +270,25 @@ ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status) {
                                          &ctx, &msg);
                if (lmaj == GSS_S_COMPLETE) {
                        debug((char *)msg.value);
+                       if (send_packet) packet_send_debug((char *)msg.value);
                        (void) gss_release_buffer(&lmin, &msg);
                }
         } while (ctx!=0);
 }
 
+void
+ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status) {
+    ssh_gssapi_error_ex(major_status, minor_status, 0);
+}
+
+void
+ssh_gssapi_send_error(OM_uint32 major_status,OM_uint32 minor_status) {
+    ssh_gssapi_error_ex(major_status, minor_status, 1);
+}
+
+
+
+
 /* Initialise our GSSAPI context. We use this opaque structure to contain all
  * of the data which both the client and server need to persist across
  * {accept,init}_sec_context calls, so that when we do it from the userauth
@@ -374,7 +390,7 @@ OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *ctx,gss_buffer_desc *recv_tok,
                                          NULL,
                                          &ctx->client_creds);
        if (GSS_ERROR(maj_status)) {
-               ssh_gssapi_error(maj_status,min_status);
+               ssh_gssapi_send_error(maj_status,min_status);
        }
        
        if (ctx->client_creds) {

diff --git a/openssh/gss-serv.c b/openssh/gss-serv.c
index edc5c3a329bab7b235adf1c211cdb112de81af0a..a433a719bff84f3cb4f194062af0cde767601c59 100644 (file)
--- a/openssh/gss-serv.c
+++ b/openssh/gss-serv.c
@@ -536,6 +536,7 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt)
        
        if (GSS_ERROR(maj_status)) {
                /* Failure <sniff> */
+               ssh_gssapi_send_error(maj_status,min_status);
                authctxt->postponed = 0;
                dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
                userauth_finish(authctxt, 0, "gssapi");

diff --git a/openssh/kexgss.c b/openssh/kexgss.c
index 7ad2088ee14006732de12a7c84a419b3ba022f2b..6b03f602b0e70d8af21998850bb5f00255d93e17 100644 (file)
--- a/openssh/kexgss.c
+++ b/openssh/kexgss.c
@@ -305,9 +305,9 @@ kexgss_server(Kex *kex)
 
        ssh_gssapi_build_ctx(&ctxt);
         if (ssh_gssapi_id_kex(&ctxt,kex->name))
-               fatal("Unknown gssapi mechanism");
+               packet_disconnect("Unknown gssapi mechanism");
         if (ssh_gssapi_acquire_cred(&ctxt))
-               fatal("Unable to acquire credentials for the server");
+               packet_disconnect("Unable to acquire credentials for the server");
                                                                                                                                 
        do {
                debug("Wait SSH2_MSG_GSSAPI_INIT");
@@ -315,7 +315,7 @@ kexgss_server(Kex *kex)
                switch(type) {
                case SSH2_MSG_KEXGSS_INIT:
                        if (dh_client_pub!=NULL) 
-                               fatal("Received KEXGSS_INIT after initialising");
+                               packet_disconnect("Received KEXGSS_INIT after initialising");
                        recv_tok.value=packet_get_string(&recv_tok.length);
 
                        dh_client_pub = BN_new();
@@ -328,7 +328,7 @@ kexgss_server(Kex *kex)
                        break;
                case SSH2_MSG_KEXGSS_CONTINUE:
                        if (dh_client_pub == NULL)
-                               fatal("Received KEXGSS_CONTINUE without initialising");
+                               packet_disconnect("Received KEXGSS_CONTINUE without initialising");
                        recv_tok.value=packet_get_string(&recv_tok.length);
                        break;
                default:
@@ -342,7 +342,7 @@ kexgss_server(Kex *kex)
 
 #ifdef GSS_C_GLOBUS_LIMITED_PROXY_FLAG
                 if (ret_flags & GSS_C_GLOBUS_LIMITED_PROXY_FLAG) {
-                        fatal("Limited proxy is not allowed.");
+                        packet_disconnect("Limited proxy is not allowed in gssapi key exchange.");
                 }
 #endif
                
@@ -356,16 +356,21 @@ kexgss_server(Kex *kex)
                }
        } while (maj_status & GSS_S_CONTINUE_NEEDED);
 
-       if (GSS_ERROR(maj_status))
-               fatal("gss_accept_context died");
-       
+       if (GSS_ERROR(maj_status)) {
+               ssh_gssapi_send_error(maj_status,min_status);
+               packet_disconnect("gssapi key exchange handshake failed");
+       }
+
        debug("gss_complete");
-       if (!(ret_flags & GSS_C_MUTUAL_FLAG))
-               fatal("mutual authentication flag wasn't set");
-               
-       if (!(ret_flags & GSS_C_INTEG_FLAG))
-               fatal("Integrity flag wasn't set");
+       if (!(ret_flags & GSS_C_MUTUAL_FLAG)) {
+               ssh_gssapi_send_error(maj_status,min_status);
+               packet_disconnect("gssapi mutual authentication failed");
+       }
                
+       if (!(ret_flags & GSS_C_INTEG_FLAG)) {
+               ssh_gssapi_send_error(maj_status,min_status);
+               packet_disconnect("gssapi channel integrity not established");
+       }               
        
        dh = dh_new_group1();
        dh_gen_key(dh, kex->we_need * 8);
@@ -408,8 +413,8 @@ kexgss_server(Kex *kex)
                               GSS_C_QOP_DEFAULT,
                               &gssbuf,
                               &msg_tok))) {
-               ssh_gssapi_error(maj_status,min_status);
-               fatal("Couldn't get MIC");
+               ssh_gssapi_send_error(maj_status,min_status);
+               packet_disconnect("Couldn't get MIC");
        }       
                              
        packet_start(SSH2_MSG_KEXGSS_COMPLETE);
@@ -430,7 +435,7 @@ kexgss_server(Kex *kex)
        if (ssh_gssapi_getclient(&ctxt,&gssapi_client_type, 
                                       &gssapi_client_name, 
                                       &gssapi_client_creds)) {
-               fatal("Couldn't convert client name");
+               packet_disconnect("Couldn't convert client name");
        }
        
        gss_release_buffer(&min_status, &send_tok);     

diff --git a/openssh/ssh-gss.h b/openssh/ssh-gss.h
index 4c8904453462f4530131bcabc52ddeb28fd597c4..76d435fffec8c6e720e2320ce012cf5f2c09313d 100644 (file)
--- a/openssh/ssh-gss.h
+++ b/openssh/ssh-gss.h
@@ -106,6 +106,7 @@ OM_uint32 ssh_gssapi_getclient(Gssctxt *ctx,
                                gss_buffer_desc *name,
                                gss_cred_id_t *creds);
 void ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status);
+void ssh_gssapi_send_error(OM_uint32 major_status,OM_uint32 minor_status);
 void ssh_gssapi_build_ctx(Gssctxt *ctx);
 void ssh_gssapi_delete_ctx(Gssctxt *ctx);