summaryrefslogtreecommitdiff
path: root/ssh-gss.h
diff options
context:
space:
mode:
authorSimon Wilkinson <simon@sxw.org.uk>2014-02-09 16:09:48 +0000
committerColin Watson <cjwatson@debian.org>2020-06-07 10:24:45 +0100
commit79f9d21b406c172878896ef41cdc2502fc2f84a7 (patch)
tree71507aaefd925223b1543b10f4342f2df9ea0ee3 /ssh-gss.h
parent202f5a676221c244cd450086c334c2b59f339e86 (diff)
GSSAPI key exchange support
This patch has been rejected upstream: "None of the OpenSSH developers are in favour of adding this, and this situation has not changed for several years. This is not a slight on Simon's patch, which is of fine quality, but just that a) we don't trust GSSAPI implementations that much and b) we don't like adding new KEX since they are pre-auth attack surface. This one is particularly scary, since it requires hooks out to typically root-owned system resources." However, quite a lot of people rely on this in Debian, and it's better to have it merged into the main openssh package rather than having separate -krb5 packages (as we used to have). It seems to have a generally good security history. Author: Simon Wilkinson <simon@sxw.org.uk> Author: Colin Watson <cjwatson@debian.org> Author: Jakub Jelen <jjelen@redhat.com> Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 Last-Updated: 2020-06-07 Patch-Name: gssapi.patch
Diffstat (limited to 'ssh-gss.h')
-rw-r--r--ssh-gss.h54
1 files changed, 50 insertions, 4 deletions
diff --git a/ssh-gss.h b/ssh-gss.h
index 36180d07a..50d80bbca 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -1,6 +1,6 @@
1/* $OpenBSD: ssh-gss.h,v 1.14 2018/07/10 09:13:30 djm Exp $ */ 1/* $OpenBSD: ssh-gss.h,v 1.14 2018/07/10 09:13:30 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. 3 * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
4 * 4 *
5 * Redistribution and use in source and binary forms, with or without 5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions 6 * modification, are permitted provided that the following conditions
@@ -61,10 +61,34 @@
61 61
62#define SSH_GSS_OIDTYPE 0x06 62#define SSH_GSS_OIDTYPE 0x06
63 63
64#define SSH2_MSG_KEXGSS_INIT 30
65#define SSH2_MSG_KEXGSS_CONTINUE 31
66#define SSH2_MSG_KEXGSS_COMPLETE 32
67#define SSH2_MSG_KEXGSS_HOSTKEY 33
68#define SSH2_MSG_KEXGSS_ERROR 34
69#define SSH2_MSG_KEXGSS_GROUPREQ 40
70#define SSH2_MSG_KEXGSS_GROUP 41
71#define KEX_GSS_GRP1_SHA1_ID "gss-group1-sha1-"
72#define KEX_GSS_GRP14_SHA1_ID "gss-group14-sha1-"
73#define KEX_GSS_GRP14_SHA256_ID "gss-group14-sha256-"
74#define KEX_GSS_GRP16_SHA512_ID "gss-group16-sha512-"
75#define KEX_GSS_GEX_SHA1_ID "gss-gex-sha1-"
76#define KEX_GSS_NISTP256_SHA256_ID "gss-nistp256-sha256-"
77#define KEX_GSS_C25519_SHA256_ID "gss-curve25519-sha256-"
78
79#define GSS_KEX_DEFAULT_KEX \
80 KEX_GSS_GRP14_SHA256_ID "," \
81 KEX_GSS_GRP16_SHA512_ID "," \
82 KEX_GSS_NISTP256_SHA256_ID "," \
83 KEX_GSS_C25519_SHA256_ID "," \
84 KEX_GSS_GRP14_SHA1_ID "," \
85 KEX_GSS_GEX_SHA1_ID
86
64typedef struct { 87typedef struct {
65 char *filename; 88 char *filename;
66 char *envvar; 89 char *envvar;
67 char *envval; 90 char *envval;
91 struct passwd *owner;
68 void *data; 92 void *data;
69} ssh_gssapi_ccache; 93} ssh_gssapi_ccache;
70 94
@@ -72,8 +96,11 @@ typedef struct {
72 gss_buffer_desc displayname; 96 gss_buffer_desc displayname;
73 gss_buffer_desc exportedname; 97 gss_buffer_desc exportedname;
74 gss_cred_id_t creds; 98 gss_cred_id_t creds;
99 gss_name_t name;
75 struct ssh_gssapi_mech_struct *mech; 100 struct ssh_gssapi_mech_struct *mech;
76 ssh_gssapi_ccache store; 101 ssh_gssapi_ccache store;
102 int used;
103 int updated;
77} ssh_gssapi_client; 104} ssh_gssapi_client;
78 105
79typedef struct ssh_gssapi_mech_struct { 106typedef struct ssh_gssapi_mech_struct {
@@ -84,6 +111,7 @@ typedef struct ssh_gssapi_mech_struct {
84 int (*userok) (ssh_gssapi_client *, char *); 111 int (*userok) (ssh_gssapi_client *, char *);
85 int (*localname) (ssh_gssapi_client *, char **); 112 int (*localname) (ssh_gssapi_client *, char **);
86 void (*storecreds) (ssh_gssapi_client *); 113 void (*storecreds) (ssh_gssapi_client *);
114 int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
87} ssh_gssapi_mech; 115} ssh_gssapi_mech;
88 116
89typedef struct { 117typedef struct {
@@ -94,10 +122,11 @@ typedef struct {
94 gss_OID oid; /* client */ 122 gss_OID oid; /* client */
95 gss_cred_id_t creds; /* server */ 123 gss_cred_id_t creds; /* server */
96 gss_name_t client; /* server */ 124 gss_name_t client; /* server */
97 gss_cred_id_t client_creds; /* server */ 125 gss_cred_id_t client_creds; /* both */
98} Gssctxt; 126} Gssctxt;
99 127
100extern ssh_gssapi_mech *supported_mechs[]; 128extern ssh_gssapi_mech *supported_mechs[];
129extern Gssctxt *gss_kex_context;
101 130
102int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); 131int ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
103void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); 132void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
@@ -109,6 +138,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *);
109 138
110struct sshbuf; 139struct sshbuf;
111int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *); 140int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
141int ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *, gss_buffer_desc *);
112 142
113OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *); 143OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
114OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int, 144OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
@@ -123,17 +153,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
123OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); 153OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
124void ssh_gssapi_buildmic(struct sshbuf *, const char *, 154void ssh_gssapi_buildmic(struct sshbuf *, const char *,
125 const char *, const char *); 155 const char *, const char *);
126int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *); 156int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *);
157OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *);
158int ssh_gssapi_credentials_updated(Gssctxt *);
127 159
128/* In the server */ 160/* In the server */
161typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *,
162 const char *);
163char *ssh_gssapi_client_mechanisms(const char *, const char *, const char *);
164char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
165 const char *, const char *);
166gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
167int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *,
168 const char *);
129OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID); 169OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
130int ssh_gssapi_userok(char *name); 170int ssh_gssapi_userok(char *name, struct passwd *, int kex);
131OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); 171OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
132void ssh_gssapi_do_child(char ***, u_int *); 172void ssh_gssapi_do_child(char ***, u_int *);
133void ssh_gssapi_cleanup_creds(void); 173void ssh_gssapi_cleanup_creds(void);
134void ssh_gssapi_storecreds(void); 174void ssh_gssapi_storecreds(void);
135const char *ssh_gssapi_displayname(void); 175const char *ssh_gssapi_displayname(void);
136 176
177char *ssh_gssapi_server_mechanisms(void);
178int ssh_gssapi_oid_table_ok(void);
179
180int ssh_gssapi_update_creds(ssh_gssapi_ccache *store);
181void ssh_gssapi_rekey_creds(void);
182
137#endif /* GSSAPI */ 183#endif /* GSSAPI */
138 184
139#endif /* _SSH_GSS_H */ 185#endif /* _SSH_GSS_H */