blob: 855b61b4e195399a3b442489950729b7ad47d64e [file] [log] [blame]
Damien Millereccb9de2005-06-17 12:59:34 +10001/* $OpenBSD: auth2-gss.c,v 1.9 2005/06/17 02:44:32 djm Exp $ */
Darren Tucker0efd1552003-08-26 11:49:55 +10002
3/*
4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28
29#ifdef GSSAPI
30
31#include "auth.h"
32#include "ssh2.h"
33#include "xmalloc.h"
34#include "log.h"
35#include "dispatch.h"
36#include "servconf.h"
37#include "compat.h"
38#include "packet.h"
39#include "monitor_wrap.h"
40
41#include "ssh-gss.h"
42
43extern ServerOptions options;
44
45static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
Damien Miller0425d402003-11-17 22:18:21 +110046static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
Darren Tucker0efd1552003-08-26 11:49:55 +100047static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
48static void input_gssapi_errtok(int, u_int32_t, void *);
49
50/*
51 * We only support those mechanisms that we know about (ie ones that we know
52 * how to check local user kuserok and the like
53 */
54static int
55userauth_gssapi(Authctxt *authctxt)
56{
Darren Tucker3f9fdc72004-06-22 12:56:01 +100057 gss_OID_desc goid = {0, NULL};
Darren Tucker0efd1552003-08-26 11:49:55 +100058 Gssctxt *ctxt = NULL;
59 int mechs;
60 gss_OID_set supported;
61 int present;
62 OM_uint32 ms;
63 u_int len;
Damien Millereccb9de2005-06-17 12:59:34 +100064 u_char *doid = NULL;
Darren Tucker0efd1552003-08-26 11:49:55 +100065
66 if (!authctxt->valid || authctxt->user == NULL)
67 return (0);
68
69 mechs = packet_get_int();
70 if (mechs == 0) {
71 debug("Mechanism negotiation is not supported");
72 return (0);
73 }
74
75 ssh_gssapi_supported_oids(&supported);
76 do {
77 mechs--;
78
79 if (doid)
80 xfree(doid);
81
Darren Tucker655a5e02003-11-03 20:09:03 +110082 present = 0;
Darren Tucker0efd1552003-08-26 11:49:55 +100083 doid = packet_get_string(&len);
84
Damien Millera8e06ce2003-11-21 23:48:55 +110085 if (len > 2 &&
Darren Tucker655a5e02003-11-03 20:09:03 +110086 doid[0] == SSH_GSS_OIDTYPE &&
87 doid[1] == len - 2) {
Darren Tucker3f9fdc72004-06-22 12:56:01 +100088 goid.elements = doid + 2;
89 goid.length = len - 2;
90 gss_test_oid_set_member(&ms, &goid, supported,
Darren Tucker655a5e02003-11-03 20:09:03 +110091 &present);
Darren Tucker0efd1552003-08-26 11:49:55 +100092 } else {
Darren Tucker655a5e02003-11-03 20:09:03 +110093 logit("Badly formed OID received");
Darren Tucker0efd1552003-08-26 11:49:55 +100094 }
Darren Tucker0efd1552003-08-26 11:49:55 +100095 } while (mechs > 0 && !present);
96
97 gss_release_oid_set(&ms, &supported);
98
99 if (!present) {
100 xfree(doid);
101 return (0);
102 }
103
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000104 if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
Damien Miller982d3262003-09-02 22:59:01 +1000105 xfree(doid);
Darren Tucker0efd1552003-08-26 11:49:55 +1000106 return (0);
Damien Miller982d3262003-09-02 22:59:01 +1000107 }
Darren Tucker0efd1552003-08-26 11:49:55 +1000108
109 authctxt->methoddata=(void *)ctxt;
110
111 packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
112
Darren Tucker655a5e02003-11-03 20:09:03 +1100113 /* Return the OID that we received */
Darren Tucker0efd1552003-08-26 11:49:55 +1000114 packet_put_string(doid, len);
115
116 packet_send();
117 xfree(doid);
118
119 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
120 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
121 authctxt->postponed = 1;
122
123 return (0);
124}
125
126static void
127input_gssapi_token(int type, u_int32_t plen, void *ctxt)
128{
129 Authctxt *authctxt = ctxt;
130 Gssctxt *gssctxt;
131 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
132 gss_buffer_desc recv_tok;
Damien Miller0425d402003-11-17 22:18:21 +1100133 OM_uint32 maj_status, min_status, flags;
Darren Tucker0efd1552003-08-26 11:49:55 +1000134 u_int len;
135
136 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
137 fatal("No authentication or GSSAPI context");
138
139 gssctxt = authctxt->methoddata;
140 recv_tok.value = packet_get_string(&len);
141 recv_tok.length = len; /* u_int vs. size_t */
142
143 packet_check_eom();
144
145 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
Damien Miller0425d402003-11-17 22:18:21 +1100146 &send_tok, &flags));
Darren Tucker0efd1552003-08-26 11:49:55 +1000147
148 xfree(recv_tok.value);
149
150 if (GSS_ERROR(maj_status)) {
151 if (send_tok.length != 0) {
152 packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
153 packet_put_string(send_tok.value, send_tok.length);
154 packet_send();
155 }
156 authctxt->postponed = 0;
157 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
Damien Miller0425d402003-11-17 22:18:21 +1100158 userauth_finish(authctxt, 0, "gssapi-with-mic");
Darren Tucker0efd1552003-08-26 11:49:55 +1000159 } else {
160 if (send_tok.length != 0) {
161 packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
162 packet_put_string(send_tok.value, send_tok.length);
163 packet_send();
164 }
165 if (maj_status == GSS_S_COMPLETE) {
166 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
Damien Miller0425d402003-11-17 22:18:21 +1100167 if (flags & GSS_C_INTEG_FLAG)
168 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
169 &input_gssapi_mic);
170 else
171 dispatch_set(
172 SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
173 &input_gssapi_exchange_complete);
Darren Tucker0efd1552003-08-26 11:49:55 +1000174 }
175 }
176
177 gss_release_buffer(&min_status, &send_tok);
178}
179
180static void
181input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
182{
183 Authctxt *authctxt = ctxt;
184 Gssctxt *gssctxt;
185 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
186 gss_buffer_desc recv_tok;
187 OM_uint32 maj_status;
Damien Miller55c47ed2003-09-02 22:14:07 +1000188 u_int len;
Darren Tucker0efd1552003-08-26 11:49:55 +1000189
190 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
191 fatal("No authentication or GSSAPI context");
192
193 gssctxt = authctxt->methoddata;
Damien Miller55c47ed2003-09-02 22:14:07 +1000194 recv_tok.value = packet_get_string(&len);
195 recv_tok.length = len;
Darren Tucker0efd1552003-08-26 11:49:55 +1000196
197 packet_check_eom();
198
199 /* Push the error token into GSSAPI to see what it says */
200 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
201 &send_tok, NULL));
202
203 xfree(recv_tok.value);
204
205 /* We can't return anything to the client, even if we wanted to */
206 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
207 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
208
209 /* The client will have already moved on to the next auth */
210
211 gss_release_buffer(&maj_status, &send_tok);
212}
213
214/*
215 * This is called when the client thinks we've completed authentication.
216 * It should only be enabled in the dispatch handler by the function above,
217 * which only enables it once the GSSAPI exchange is complete.
218 */
219
220static void
221input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
222{
223 Authctxt *authctxt = ctxt;
224 Gssctxt *gssctxt;
225 int authenticated;
226
227 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
228 fatal("No authentication or GSSAPI context");
229
230 gssctxt = authctxt->methoddata;
231
232 /*
Damien Miller0425d402003-11-17 22:18:21 +1100233 * We don't need to check the status, because we're only enabled in
234 * the dispatcher once the exchange is complete
Darren Tucker0efd1552003-08-26 11:49:55 +1000235 */
236
237 packet_check_eom();
238
239 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
240
241 authctxt->postponed = 0;
242 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
243 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
Damien Miller0425d402003-11-17 22:18:21 +1100244 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
Darren Tucker0efd1552003-08-26 11:49:55 +1000245 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
Damien Miller0425d402003-11-17 22:18:21 +1100246 userauth_finish(authctxt, authenticated, "gssapi-with-mic");
247}
248
249static void
250input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
251{
252 Authctxt *authctxt = ctxt;
253 Gssctxt *gssctxt;
254 int authenticated = 0;
255 Buffer b;
256 gss_buffer_desc mic, gssbuf;
257 u_int len;
Damien Miller787b2ec2003-11-21 23:56:47 +1100258
Damien Miller0425d402003-11-17 22:18:21 +1100259 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
260 fatal("No authentication or GSSAPI context");
Damien Miller787b2ec2003-11-21 23:56:47 +1100261
Damien Miller0425d402003-11-17 22:18:21 +1100262 gssctxt = authctxt->methoddata;
Damien Miller787b2ec2003-11-21 23:56:47 +1100263
Damien Miller0425d402003-11-17 22:18:21 +1100264 mic.value = packet_get_string(&len);
265 mic.length = len;
Damien Miller787b2ec2003-11-21 23:56:47 +1100266
Damien Miller0425d402003-11-17 22:18:21 +1100267 ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
268 "gssapi-with-mic");
Damien Miller787b2ec2003-11-21 23:56:47 +1100269
Damien Miller0425d402003-11-17 22:18:21 +1100270 gssbuf.value = buffer_ptr(&b);
271 gssbuf.length = buffer_len(&b);
Damien Miller787b2ec2003-11-21 23:56:47 +1100272
Damien Miller0425d402003-11-17 22:18:21 +1100273 if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
274 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
275 else
276 logit("GSSAPI MIC check failed");
277
278 buffer_free(&b);
279 xfree(mic.value);
Damien Miller787b2ec2003-11-21 23:56:47 +1100280
Damien Miller0425d402003-11-17 22:18:21 +1100281 authctxt->postponed = 0;
282 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
283 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
284 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
285 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
286 userauth_finish(authctxt, authenticated, "gssapi-with-mic");
Darren Tucker0efd1552003-08-26 11:49:55 +1000287}
288
289Authmethod method_gssapi = {
Damien Miller0425d402003-11-17 22:18:21 +1100290 "gssapi-with-mic",
Darren Tucker0efd1552003-08-26 11:49:55 +1000291 userauth_gssapi,
292 &options.gss_authentication
293};
294
295#endif /* GSSAPI */