blob: 589283b720415332ee04bb44fe42b811f8e28b19 [file] [log] [blame]
djm@openbsd.org8f574952017-06-24 06:34:38 +00001/* $OpenBSD: auth2-gss.c,v 1.26 2017/06/24 06:34:38 djm Exp $ */
Darren Tucker0efd1552003-08-26 11:49:55 +10002
3/*
4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28
Darren Tucker8c6feda2006-08-05 15:24:59 +100029#ifdef GSSAPI
30
Damien Millerd7834352006-08-05 12:39:39 +100031#include <sys/types.h>
Darren Tucker0efd1552003-08-26 11:49:55 +100032
Damien Millerded319c2006-09-01 15:38:36 +100033#include <stdarg.h>
34
Damien Millerd7834352006-08-05 12:39:39 +100035#include "xmalloc.h"
36#include "key.h"
37#include "hostfile.h"
Darren Tucker0efd1552003-08-26 11:49:55 +100038#include "auth.h"
39#include "ssh2.h"
Darren Tucker0efd1552003-08-26 11:49:55 +100040#include "log.h"
41#include "dispatch.h"
Damien Millerd7834352006-08-05 12:39:39 +100042#include "buffer.h"
Darren Tucker450bc112014-07-19 06:23:18 +100043#include "misc.h"
Darren Tucker0efd1552003-08-26 11:49:55 +100044#include "servconf.h"
Darren Tucker0efd1552003-08-26 11:49:55 +100045#include "packet.h"
Darren Tucker0efd1552003-08-26 11:49:55 +100046#include "ssh-gss.h"
Damien Millerd7834352006-08-05 12:39:39 +100047#include "monitor_wrap.h"
Darren Tucker0efd1552003-08-26 11:49:55 +100048
49extern ServerOptions options;
50
markus@openbsd.org2ae666a2017-05-30 14:23:52 +000051static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh);
52static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
53static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
54static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
Darren Tucker0efd1552003-08-26 11:49:55 +100055
56/*
57 * We only support those mechanisms that we know about (ie ones that we know
Damien Miller6fd6def2005-11-05 15:07:05 +110058 * how to check local user kuserok and the like)
Darren Tucker0efd1552003-08-26 11:49:55 +100059 */
60static int
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +000061userauth_gssapi(struct ssh *ssh)
Darren Tucker0efd1552003-08-26 11:49:55 +100062{
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +000063 Authctxt *authctxt = ssh->authctxt;
Darren Tucker3f9fdc72004-06-22 12:56:01 +100064 gss_OID_desc goid = {0, NULL};
Darren Tucker0efd1552003-08-26 11:49:55 +100065 Gssctxt *ctxt = NULL;
66 int mechs;
Darren Tucker0efd1552003-08-26 11:49:55 +100067 int present;
68 OM_uint32 ms;
69 u_int len;
Damien Millereccb9de2005-06-17 12:59:34 +100070 u_char *doid = NULL;
Darren Tucker0efd1552003-08-26 11:49:55 +100071
72 if (!authctxt->valid || authctxt->user == NULL)
73 return (0);
74
75 mechs = packet_get_int();
76 if (mechs == 0) {
77 debug("Mechanism negotiation is not supported");
78 return (0);
79 }
80
Darren Tucker0efd1552003-08-26 11:49:55 +100081 do {
82 mechs--;
83
Darren Tuckera627d422013-06-02 07:31:17 +100084 free(doid);
Darren Tucker0efd1552003-08-26 11:49:55 +100085
Darren Tucker655a5e02003-11-03 20:09:03 +110086 present = 0;
Darren Tucker0efd1552003-08-26 11:49:55 +100087 doid = packet_get_string(&len);
88
Damien Miller0dc1bef2005-07-17 17:22:45 +100089 if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
90 doid[1] == len - 2) {
Darren Tucker3f9fdc72004-06-22 12:56:01 +100091 goid.elements = doid + 2;
92 goid.length = len - 2;
Damien Millere6a74ae2014-02-27 10:17:49 +110093 ssh_gssapi_test_oid_supported(&ms, &goid, &present);
Darren Tucker0efd1552003-08-26 11:49:55 +100094 } else {
Darren Tucker655a5e02003-11-03 20:09:03 +110095 logit("Badly formed OID received");
Darren Tucker0efd1552003-08-26 11:49:55 +100096 }
Darren Tucker0efd1552003-08-26 11:49:55 +100097 } while (mechs > 0 && !present);
98
Darren Tucker0efd1552003-08-26 11:49:55 +100099 if (!present) {
Darren Tuckera627d422013-06-02 07:31:17 +1000100 free(doid);
Damien Miller3fcdfd52011-05-05 14:04:11 +1000101 authctxt->server_caused_failure = 1;
Darren Tucker0efd1552003-08-26 11:49:55 +1000102 return (0);
103 }
104
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000105 if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
Damien Millerf23c0962006-03-26 00:04:53 +1100106 if (ctxt != NULL)
107 ssh_gssapi_delete_ctx(&ctxt);
Darren Tuckera627d422013-06-02 07:31:17 +1000108 free(doid);
Damien Miller3fcdfd52011-05-05 14:04:11 +1000109 authctxt->server_caused_failure = 1;
Darren Tucker0efd1552003-08-26 11:49:55 +1000110 return (0);
Damien Miller982d3262003-09-02 22:59:01 +1000111 }
Darren Tucker0efd1552003-08-26 11:49:55 +1000112
Damien Miller6fd6def2005-11-05 15:07:05 +1100113 authctxt->methoddata = (void *)ctxt;
Darren Tucker0efd1552003-08-26 11:49:55 +1000114
115 packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
116
Darren Tucker655a5e02003-11-03 20:09:03 +1100117 /* Return the OID that we received */
Darren Tucker0efd1552003-08-26 11:49:55 +1000118 packet_put_string(doid, len);
119
120 packet_send();
Darren Tuckera627d422013-06-02 07:31:17 +1000121 free(doid);
Darren Tucker0efd1552003-08-26 11:49:55 +1000122
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000123 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
124 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
Darren Tucker0efd1552003-08-26 11:49:55 +1000125 authctxt->postponed = 1;
126
127 return (0);
128}
129
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000130static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +0000131input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
Darren Tucker0efd1552003-08-26 11:49:55 +1000132{
markus@openbsd.org5f4082d2017-05-30 14:18:15 +0000133 Authctxt *authctxt = ssh->authctxt;
Darren Tucker0efd1552003-08-26 11:49:55 +1000134 Gssctxt *gssctxt;
135 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
136 gss_buffer_desc recv_tok;
Damien Miller0425d402003-11-17 22:18:21 +1100137 OM_uint32 maj_status, min_status, flags;
Darren Tucker0efd1552003-08-26 11:49:55 +1000138 u_int len;
139
140 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
141 fatal("No authentication or GSSAPI context");
142
143 gssctxt = authctxt->methoddata;
144 recv_tok.value = packet_get_string(&len);
145 recv_tok.length = len; /* u_int vs. size_t */
146
147 packet_check_eom();
148
149 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
Damien Miller0425d402003-11-17 22:18:21 +1100150 &send_tok, &flags));
Darren Tucker0efd1552003-08-26 11:49:55 +1000151
Darren Tuckera627d422013-06-02 07:31:17 +1000152 free(recv_tok.value);
Darren Tucker0efd1552003-08-26 11:49:55 +1000153
154 if (GSS_ERROR(maj_status)) {
155 if (send_tok.length != 0) {
156 packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
157 packet_put_string(send_tok.value, send_tok.length);
158 packet_send();
159 }
160 authctxt->postponed = 0;
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000161 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
162 userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
Darren Tucker0efd1552003-08-26 11:49:55 +1000163 } else {
164 if (send_tok.length != 0) {
165 packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
166 packet_put_string(send_tok.value, send_tok.length);
167 packet_send();
168 }
169 if (maj_status == GSS_S_COMPLETE) {
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000170 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
Damien Miller0425d402003-11-17 22:18:21 +1100171 if (flags & GSS_C_INTEG_FLAG)
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000172 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
Damien Miller0425d402003-11-17 22:18:21 +1100173 &input_gssapi_mic);
174 else
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000175 ssh_dispatch_set(ssh,
Damien Miller0425d402003-11-17 22:18:21 +1100176 SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
177 &input_gssapi_exchange_complete);
Darren Tucker0efd1552003-08-26 11:49:55 +1000178 }
179 }
180
181 gss_release_buffer(&min_status, &send_tok);
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000182 return 0;
Darren Tucker0efd1552003-08-26 11:49:55 +1000183}
184
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000185static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +0000186input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
Darren Tucker0efd1552003-08-26 11:49:55 +1000187{
markus@openbsd.org5f4082d2017-05-30 14:18:15 +0000188 Authctxt *authctxt = ssh->authctxt;
Darren Tucker0efd1552003-08-26 11:49:55 +1000189 Gssctxt *gssctxt;
190 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
191 gss_buffer_desc recv_tok;
192 OM_uint32 maj_status;
Damien Miller55c47ed2003-09-02 22:14:07 +1000193 u_int len;
Darren Tucker0efd1552003-08-26 11:49:55 +1000194
195 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
196 fatal("No authentication or GSSAPI context");
197
198 gssctxt = authctxt->methoddata;
Damien Miller55c47ed2003-09-02 22:14:07 +1000199 recv_tok.value = packet_get_string(&len);
200 recv_tok.length = len;
Darren Tucker0efd1552003-08-26 11:49:55 +1000201
202 packet_check_eom();
203
204 /* Push the error token into GSSAPI to see what it says */
205 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
206 &send_tok, NULL));
207
Darren Tuckera627d422013-06-02 07:31:17 +1000208 free(recv_tok.value);
Darren Tucker0efd1552003-08-26 11:49:55 +1000209
210 /* We can't return anything to the client, even if we wanted to */
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000211 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
212 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
Darren Tucker0efd1552003-08-26 11:49:55 +1000213
214 /* The client will have already moved on to the next auth */
215
216 gss_release_buffer(&maj_status, &send_tok);
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000217 return 0;
Darren Tucker0efd1552003-08-26 11:49:55 +1000218}
219
220/*
221 * This is called when the client thinks we've completed authentication.
222 * It should only be enabled in the dispatch handler by the function above,
223 * which only enables it once the GSSAPI exchange is complete.
224 */
225
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000226static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +0000227input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
Darren Tucker0efd1552003-08-26 11:49:55 +1000228{
markus@openbsd.org5f4082d2017-05-30 14:18:15 +0000229 Authctxt *authctxt = ssh->authctxt;
Darren Tucker0efd1552003-08-26 11:49:55 +1000230 int authenticated;
djm@openbsd.org8f574952017-06-24 06:34:38 +0000231 const char *displayname;
Darren Tucker0efd1552003-08-26 11:49:55 +1000232
233 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
234 fatal("No authentication or GSSAPI context");
235
Darren Tucker0efd1552003-08-26 11:49:55 +1000236 /*
Damien Miller0425d402003-11-17 22:18:21 +1100237 * We don't need to check the status, because we're only enabled in
238 * the dispatcher once the exchange is complete
Darren Tucker0efd1552003-08-26 11:49:55 +1000239 */
240
241 packet_check_eom();
242
243 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
244
djm@openbsd.org8f574952017-06-24 06:34:38 +0000245 if ((!use_privsep || mm_is_monitor()) &&
246 (displayname = ssh_gssapi_displayname()) != NULL)
247 auth2_record_info(authctxt, "%s", displayname);
248
Darren Tucker0efd1552003-08-26 11:49:55 +1000249 authctxt->postponed = 0;
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000250 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
251 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
252 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
253 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
254 userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000255 return 0;
Damien Miller0425d402003-11-17 22:18:21 +1100256}
257
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000258static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +0000259input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
Damien Miller0425d402003-11-17 22:18:21 +1100260{
markus@openbsd.org5f4082d2017-05-30 14:18:15 +0000261 Authctxt *authctxt = ssh->authctxt;
Damien Miller0425d402003-11-17 22:18:21 +1100262 Gssctxt *gssctxt;
263 int authenticated = 0;
264 Buffer b;
265 gss_buffer_desc mic, gssbuf;
266 u_int len;
djm@openbsd.org8f574952017-06-24 06:34:38 +0000267 const char *displayname;
Damien Miller787b2ec2003-11-21 23:56:47 +1100268
Damien Miller0425d402003-11-17 22:18:21 +1100269 if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
270 fatal("No authentication or GSSAPI context");
Damien Miller787b2ec2003-11-21 23:56:47 +1100271
Damien Miller0425d402003-11-17 22:18:21 +1100272 gssctxt = authctxt->methoddata;
Damien Miller787b2ec2003-11-21 23:56:47 +1100273
Damien Miller0425d402003-11-17 22:18:21 +1100274 mic.value = packet_get_string(&len);
275 mic.length = len;
Damien Miller787b2ec2003-11-21 23:56:47 +1100276
Damien Miller0425d402003-11-17 22:18:21 +1100277 ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
278 "gssapi-with-mic");
Damien Miller787b2ec2003-11-21 23:56:47 +1100279
Damien Miller0425d402003-11-17 22:18:21 +1100280 gssbuf.value = buffer_ptr(&b);
281 gssbuf.length = buffer_len(&b);
Damien Miller787b2ec2003-11-21 23:56:47 +1100282
Damien Miller0425d402003-11-17 22:18:21 +1100283 if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
284 authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
285 else
286 logit("GSSAPI MIC check failed");
287
288 buffer_free(&b);
Darren Tuckera627d422013-06-02 07:31:17 +1000289 free(mic.value);
Damien Miller787b2ec2003-11-21 23:56:47 +1100290
djm@openbsd.org8f574952017-06-24 06:34:38 +0000291 if ((!use_privsep || mm_is_monitor()) &&
292 (displayname = ssh_gssapi_displayname()) != NULL)
293 auth2_record_info(authctxt, "%s", displayname);
294
Damien Miller0425d402003-11-17 22:18:21 +1100295 authctxt->postponed = 0;
markus@openbsd.orgeb272ea2017-05-30 14:29:59 +0000296 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
297 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
298 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
299 ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
300 userauth_finish(ssh, authenticated, "gssapi-with-mic", NULL);
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000301 return 0;
Darren Tucker0efd1552003-08-26 11:49:55 +1000302}
303
304Authmethod method_gssapi = {
Damien Miller0425d402003-11-17 22:18:21 +1100305 "gssapi-with-mic",
Darren Tucker0efd1552003-08-26 11:49:55 +1000306 userauth_gssapi,
307 &options.gss_authentication
308};
Darren Tucker8c6feda2006-08-05 15:24:59 +1000309
310#endif /* GSSAPI */