auth2-gss.c revision 264377 
1/* $OpenBSD: auth2-gss.c,v 1.21 2014/02/26 20:28:44 djm Exp $ */
2
3/*
4 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28
29#ifdef GSSAPI
30
31#include <sys/types.h>
32
33#include <stdarg.h>
34
35#include "xmalloc.h"
36#include "key.h"
37#include "hostfile.h"
38#include "auth.h"
39#include "ssh2.h"
40#include "log.h"
41#include "dispatch.h"
42#include "buffer.h"
43#include "servconf.h"
44#include "packet.h"
45#include "ssh-gss.h"
46#include "monitor_wrap.h"
47
48extern ServerOptions options;
49
50static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
51static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
52static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
53static void input_gssapi_errtok(int, u_int32_t, void *);
54
55/*
56 * We only support those mechanisms that we know about (ie ones that we know
57 * how to check local user kuserok and the like)
58 */
59static int
60userauth_gssapi(Authctxt *authctxt)
61{
62	gss_OID_desc goid = {0, NULL};
63	Gssctxt *ctxt = NULL;
64	int mechs;
65	int present;
66	OM_uint32 ms;
67	u_int len;
68	u_char *doid = NULL;
69
70	if (!authctxt->valid || authctxt->user == NULL)
71		return (0);
72
73	mechs = packet_get_int();
74	if (mechs == 0) {
75		debug("Mechanism negotiation is not supported");
76		return (0);
77	}
78
79	do {
80		mechs--;
81
82		free(doid);
83
84		present = 0;
85		doid = packet_get_string(&len);
86
87		if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
88		    doid[1] == len - 2) {
89			goid.elements = doid + 2;
90			goid.length   = len - 2;
91			ssh_gssapi_test_oid_supported(&ms, &goid, &present);
92		} else {
93			logit("Badly formed OID received");
94		}
95	} while (mechs > 0 && !present);
96
97	if (!present) {
98		free(doid);
99		authctxt->server_caused_failure = 1;
100		return (0);
101	}
102
103	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
104		if (ctxt != NULL)
105			ssh_gssapi_delete_ctx(&ctxt);
106		free(doid);
107		authctxt->server_caused_failure = 1;
108		return (0);
109	}
110
111	authctxt->methoddata = (void *)ctxt;
112
113	packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
114
115	/* Return the OID that we received */
116	packet_put_string(doid, len);
117
118	packet_send();
119	free(doid);
120
121	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
122	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
123	authctxt->postponed = 1;
124
125	return (0);
126}
127
128static void
129input_gssapi_token(int type, u_int32_t plen, void *ctxt)
130{
131	Authctxt *authctxt = ctxt;
132	Gssctxt *gssctxt;
133	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
134	gss_buffer_desc recv_tok;
135	OM_uint32 maj_status, min_status, flags;
136	u_int len;
137
138	if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
139		fatal("No authentication or GSSAPI context");
140
141	gssctxt = authctxt->methoddata;
142	recv_tok.value = packet_get_string(&len);
143	recv_tok.length = len; /* u_int vs. size_t */
144
145	packet_check_eom();
146
147	maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
148	    &send_tok, &flags));
149
150	free(recv_tok.value);
151
152	if (GSS_ERROR(maj_status)) {
153		if (send_tok.length != 0) {
154			packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
155			packet_put_string(send_tok.value, send_tok.length);
156			packet_send();
157		}
158		authctxt->postponed = 0;
159		dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
160		userauth_finish(authctxt, 0, "gssapi-with-mic", NULL);
161	} else {
162		if (send_tok.length != 0) {
163			packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
164			packet_put_string(send_tok.value, send_tok.length);
165			packet_send();
166		}
167		if (maj_status == GSS_S_COMPLETE) {
168			dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
169			if (flags & GSS_C_INTEG_FLAG)
170				dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
171				    &input_gssapi_mic);
172			else
173				dispatch_set(
174				    SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
175				    &input_gssapi_exchange_complete);
176		}
177	}
178
179	gss_release_buffer(&min_status, &send_tok);
180}
181
182static void
183input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
184{
185	Authctxt *authctxt = ctxt;
186	Gssctxt *gssctxt;
187	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
188	gss_buffer_desc recv_tok;
189	OM_uint32 maj_status;
190	u_int len;
191
192	if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
193		fatal("No authentication or GSSAPI context");
194
195	gssctxt = authctxt->methoddata;
196	recv_tok.value = packet_get_string(&len);
197	recv_tok.length = len;
198
199	packet_check_eom();
200
201	/* Push the error token into GSSAPI to see what it says */
202	maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
203	    &send_tok, NULL));
204
205	free(recv_tok.value);
206
207	/* We can't return anything to the client, even if we wanted to */
208	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
209	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
210
211	/* The client will have already moved on to the next auth */
212
213	gss_release_buffer(&maj_status, &send_tok);
214}
215
216/*
217 * This is called when the client thinks we've completed authentication.
218 * It should only be enabled in the dispatch handler by the function above,
219 * which only enables it once the GSSAPI exchange is complete.
220 */
221
222static void
223input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
224{
225	Authctxt *authctxt = ctxt;
226	int authenticated;
227
228	if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
229		fatal("No authentication or GSSAPI context");
230
231	/*
232	 * We don't need to check the status, because we're only enabled in
233	 * the dispatcher once the exchange is complete
234	 */
235
236	packet_check_eom();
237
238	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
239
240	authctxt->postponed = 0;
241	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
242	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
243	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
244	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
245	userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
246}
247
248static void
249input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
250{
251	Authctxt *authctxt = ctxt;
252	Gssctxt *gssctxt;
253	int authenticated = 0;
254	Buffer b;
255	gss_buffer_desc mic, gssbuf;
256	u_int len;
257
258	if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
259		fatal("No authentication or GSSAPI context");
260
261	gssctxt = authctxt->methoddata;
262
263	mic.value = packet_get_string(&len);
264	mic.length = len;
265
266	ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
267	    "gssapi-with-mic");
268
269	gssbuf.value = buffer_ptr(&b);
270	gssbuf.length = buffer_len(&b);
271
272	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
273		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
274	else
275		logit("GSSAPI MIC check failed");
276
277	buffer_free(&b);
278	free(mic.value);
279
280	authctxt->postponed = 0;
281	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
282	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
283	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
284	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
285	userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
286}
287
288Authmethod method_gssapi = {
289	"gssapi-with-mic",
290	userauth_gssapi,
291	&options.gss_authentication
292};
293
294#endif /* GSSAPI */
295