diff options
Diffstat (limited to 'debian/patches/gssapi.patch')
-rw-r--r-- | debian/patches/gssapi.patch | 4002 |
1 files changed, 4002 insertions, 0 deletions
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch new file mode 100644 index 000000000..685923e47 --- /dev/null +++ b/debian/patches/gssapi.patch | |||
@@ -0,0 +1,4002 @@ | |||
1 | From 79f9d21b406c172878896ef41cdc2502fc2f84a7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Simon Wilkinson <simon@sxw.org.uk> | ||
3 | Date: Sun, 9 Feb 2014 16:09:48 +0000 | ||
4 | Subject: GSSAPI key exchange support | ||
5 | |||
6 | This patch has been rejected upstream: "None of the OpenSSH developers are | ||
7 | in favour of adding this, and this situation has not changed for several | ||
8 | years. This is not a slight on Simon's patch, which is of fine quality, but | ||
9 | just that a) we don't trust GSSAPI implementations that much and b) we don't | ||
10 | like adding new KEX since they are pre-auth attack surface. This one is | ||
11 | particularly scary, since it requires hooks out to typically root-owned | ||
12 | system resources." | ||
13 | |||
14 | However, quite a lot of people rely on this in Debian, and it's better to | ||
15 | have it merged into the main openssh package rather than having separate | ||
16 | -krb5 packages (as we used to have). It seems to have a generally good | ||
17 | security history. | ||
18 | |||
19 | Author: Simon Wilkinson <simon@sxw.org.uk> | ||
20 | Author: Colin Watson <cjwatson@debian.org> | ||
21 | Author: Jakub Jelen <jjelen@redhat.com> | ||
22 | Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master | ||
23 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 | ||
24 | Last-Updated: 2020-06-07 | ||
25 | |||
26 | Patch-Name: gssapi.patch | ||
27 | --- | ||
28 | Makefile.in | 3 +- | ||
29 | README.md | 33 +++ | ||
30 | auth.c | 96 +------- | ||
31 | auth2-gss.c | 56 ++++- | ||
32 | auth2.c | 2 + | ||
33 | canohost.c | 93 ++++++++ | ||
34 | canohost.h | 3 + | ||
35 | clientloop.c | 15 +- | ||
36 | configure.ac | 24 ++ | ||
37 | gss-genr.c | 300 +++++++++++++++++++++++- | ||
38 | gss-serv-krb5.c | 85 ++++++- | ||
39 | gss-serv.c | 186 +++++++++++++-- | ||
40 | kex.c | 66 +++++- | ||
41 | kex.h | 29 +++ | ||
42 | kexdh.c | 10 + | ||
43 | kexgen.c | 2 +- | ||
44 | kexgssc.c | 606 ++++++++++++++++++++++++++++++++++++++++++++++++ | ||
45 | kexgsss.c | 474 +++++++++++++++++++++++++++++++++++++ | ||
46 | monitor.c | 139 ++++++++++- | ||
47 | monitor.h | 2 + | ||
48 | monitor_wrap.c | 57 ++++- | ||
49 | monitor_wrap.h | 4 +- | ||
50 | readconf.c | 70 ++++++ | ||
51 | readconf.h | 6 + | ||
52 | servconf.c | 47 ++++ | ||
53 | servconf.h | 3 + | ||
54 | session.c | 10 +- | ||
55 | ssh-gss.h | 54 ++++- | ||
56 | ssh.1 | 8 + | ||
57 | ssh.c | 6 +- | ||
58 | ssh_config | 2 + | ||
59 | ssh_config.5 | 57 +++++ | ||
60 | sshconnect2.c | 154 +++++++++++- | ||
61 | sshd.c | 62 ++++- | ||
62 | sshd_config | 2 + | ||
63 | sshd_config.5 | 30 +++ | ||
64 | sshkey.c | 3 +- | ||
65 | sshkey.h | 1 + | ||
66 | 38 files changed, 2640 insertions(+), 160 deletions(-) | ||
67 | create mode 100644 kexgssc.c | ||
68 | create mode 100644 kexgsss.c | ||
69 | |||
70 | diff --git a/Makefile.in b/Makefile.in | ||
71 | index c9e4294d3..bf1e1de47 100644 | ||
72 | --- a/Makefile.in | ||
73 | +++ b/Makefile.in | ||
74 | @@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ | ||
75 | kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ | ||
76 | kexgexc.o kexgexs.o \ | ||
77 | sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \ | ||
78 | + kexgssc.o \ | ||
79 | sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \ | ||
80 | sshbuf-io.o | ||
81 | |||
82 | @@ -125,7 +126,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \ | ||
83 | auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \ | ||
84 | auth2-none.o auth2-passwd.o auth2-pubkey.o \ | ||
85 | monitor.o monitor_wrap.o auth-krb5.o \ | ||
86 | - auth2-gss.o gss-serv.o gss-serv-krb5.o \ | ||
87 | + auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \ | ||
88 | loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ | ||
89 | sftp-server.o sftp-common.o \ | ||
90 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ | ||
91 | diff --git a/README.md b/README.md | ||
92 | index 28fb43d2a..5b73d24c0 100644 | ||
93 | --- a/README.md | ||
94 | +++ b/README.md | ||
95 | @@ -1,3 +1,36 @@ | ||
96 | +Portable OpenSSH with GSSAPI Key Exchange patches | ||
97 | +================================================= | ||
98 | + | ||
99 | +Currently, there are two branches with gssapi key exchange related | ||
100 | +patches: | ||
101 | + | ||
102 | + * fedora/master: Changes that are shipped in Fedora | ||
103 | + * debian/master: Changes that are shipped in Debian | ||
104 | + | ||
105 | +The target is to converge to a shared repository with single master | ||
106 | +branch from where we could build releases for both OSes. | ||
107 | + | ||
108 | + | ||
109 | +What is in: | ||
110 | + | ||
111 | + * The original patch implementing missing parts of RFC4462 by Simon Wilkinson | ||
112 | + adapted to the current OpenSSH versions and with several fixes | ||
113 | + * New methods for GSSAPI Kex from IETF draft [1] from Jakub Jelen | ||
114 | + | ||
115 | + | ||
116 | +Missing kerberos-related parts: | ||
117 | + | ||
118 | + * .k5login and .kusers support available in Fedora [2] [3]. | ||
119 | + * Improved handling of kerberos ccache location [4] | ||
120 | + | ||
121 | + | ||
122 | +[1] https://tools.ietf.org/html/draft-ietf-curdle-gss-keyex-sha2-08 | ||
123 | +[2] https://src.fedoraproject.org/rpms/openssh/blob/master/f/openssh-6.6p1-kuserok.patch | ||
124 | +[3] https://src.fedoraproject.org/rpms/openssh/blob/master/f/openssh-6.6p1-GSSAPIEnablek5users.patch | ||
125 | +[4] https://bugzilla.mindrot.org/show_bug.cgi?id=2775 | ||
126 | + | ||
127 | +------------------------------------------------------------------------------- | ||
128 | + | ||
129 | # Portable OpenSSH | ||
130 | |||
131 | [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh) | ||
132 | diff --git a/auth.c b/auth.c | ||
133 | index 086b8ebb1..687c57b42 100644 | ||
134 | --- a/auth.c | ||
135 | +++ b/auth.c | ||
136 | @@ -400,7 +400,8 @@ auth_root_allowed(struct ssh *ssh, const char *method) | ||
137 | case PERMIT_NO_PASSWD: | ||
138 | if (strcmp(method, "publickey") == 0 || | ||
139 | strcmp(method, "hostbased") == 0 || | ||
140 | - strcmp(method, "gssapi-with-mic") == 0) | ||
141 | + strcmp(method, "gssapi-with-mic") == 0 || | ||
142 | + strcmp(method, "gssapi-keyex") == 0) | ||
143 | return 1; | ||
144 | break; | ||
145 | case PERMIT_FORCED_ONLY: | ||
146 | @@ -724,99 +725,6 @@ fakepw(void) | ||
147 | return (&fake); | ||
148 | } | ||
149 | |||
150 | -/* | ||
151 | - * Returns the remote DNS hostname as a string. The returned string must not | ||
152 | - * be freed. NB. this will usually trigger a DNS query the first time it is | ||
153 | - * called. | ||
154 | - * This function does additional checks on the hostname to mitigate some | ||
155 | - * attacks on legacy rhosts-style authentication. | ||
156 | - * XXX is RhostsRSAAuthentication vulnerable to these? | ||
157 | - * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) | ||
158 | - */ | ||
159 | - | ||
160 | -static char * | ||
161 | -remote_hostname(struct ssh *ssh) | ||
162 | -{ | ||
163 | - struct sockaddr_storage from; | ||
164 | - socklen_t fromlen; | ||
165 | - struct addrinfo hints, *ai, *aitop; | ||
166 | - char name[NI_MAXHOST], ntop2[NI_MAXHOST]; | ||
167 | - const char *ntop = ssh_remote_ipaddr(ssh); | ||
168 | - | ||
169 | - /* Get IP address of client. */ | ||
170 | - fromlen = sizeof(from); | ||
171 | - memset(&from, 0, sizeof(from)); | ||
172 | - if (getpeername(ssh_packet_get_connection_in(ssh), | ||
173 | - (struct sockaddr *)&from, &fromlen) == -1) { | ||
174 | - debug("getpeername failed: %.100s", strerror(errno)); | ||
175 | - return xstrdup(ntop); | ||
176 | - } | ||
177 | - | ||
178 | - ipv64_normalise_mapped(&from, &fromlen); | ||
179 | - if (from.ss_family == AF_INET6) | ||
180 | - fromlen = sizeof(struct sockaddr_in6); | ||
181 | - | ||
182 | - debug3("Trying to reverse map address %.100s.", ntop); | ||
183 | - /* Map the IP address to a host name. */ | ||
184 | - if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), | ||
185 | - NULL, 0, NI_NAMEREQD) != 0) { | ||
186 | - /* Host name not found. Use ip address. */ | ||
187 | - return xstrdup(ntop); | ||
188 | - } | ||
189 | - | ||
190 | - /* | ||
191 | - * if reverse lookup result looks like a numeric hostname, | ||
192 | - * someone is trying to trick us by PTR record like following: | ||
193 | - * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 | ||
194 | - */ | ||
195 | - memset(&hints, 0, sizeof(hints)); | ||
196 | - hints.ai_socktype = SOCK_DGRAM; /*dummy*/ | ||
197 | - hints.ai_flags = AI_NUMERICHOST; | ||
198 | - if (getaddrinfo(name, NULL, &hints, &ai) == 0) { | ||
199 | - logit("Nasty PTR record \"%s\" is set up for %s, ignoring", | ||
200 | - name, ntop); | ||
201 | - freeaddrinfo(ai); | ||
202 | - return xstrdup(ntop); | ||
203 | - } | ||
204 | - | ||
205 | - /* Names are stored in lowercase. */ | ||
206 | - lowercase(name); | ||
207 | - | ||
208 | - /* | ||
209 | - * Map it back to an IP address and check that the given | ||
210 | - * address actually is an address of this host. This is | ||
211 | - * necessary because anyone with access to a name server can | ||
212 | - * define arbitrary names for an IP address. Mapping from | ||
213 | - * name to IP address can be trusted better (but can still be | ||
214 | - * fooled if the intruder has access to the name server of | ||
215 | - * the domain). | ||
216 | - */ | ||
217 | - memset(&hints, 0, sizeof(hints)); | ||
218 | - hints.ai_family = from.ss_family; | ||
219 | - hints.ai_socktype = SOCK_STREAM; | ||
220 | - if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { | ||
221 | - logit("reverse mapping checking getaddrinfo for %.700s " | ||
222 | - "[%s] failed.", name, ntop); | ||
223 | - return xstrdup(ntop); | ||
224 | - } | ||
225 | - /* Look for the address from the list of addresses. */ | ||
226 | - for (ai = aitop; ai; ai = ai->ai_next) { | ||
227 | - if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, | ||
228 | - sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && | ||
229 | - (strcmp(ntop, ntop2) == 0)) | ||
230 | - break; | ||
231 | - } | ||
232 | - freeaddrinfo(aitop); | ||
233 | - /* If we reached the end of the list, the address was not there. */ | ||
234 | - if (ai == NULL) { | ||
235 | - /* Address not found for the host name. */ | ||
236 | - logit("Address %.100s maps to %.600s, but this does not " | ||
237 | - "map back to the address.", ntop, name); | ||
238 | - return xstrdup(ntop); | ||
239 | - } | ||
240 | - return xstrdup(name); | ||
241 | -} | ||
242 | - | ||
243 | /* | ||
244 | * Return the canonical name of the host in the other side of the current | ||
245 | * connection. The host name is cached, so it is efficient to call this | ||
246 | diff --git a/auth2-gss.c b/auth2-gss.c | ||
247 | index 9351e0428..d6446c0cf 100644 | ||
248 | --- a/auth2-gss.c | ||
249 | +++ b/auth2-gss.c | ||
250 | @@ -1,7 +1,7 @@ | ||
251 | /* $OpenBSD: auth2-gss.c,v 1.29 2018/07/31 03:10:27 djm Exp $ */ | ||
252 | |||
253 | /* | ||
254 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
255 | + * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
256 | * | ||
257 | * Redistribution and use in source and binary forms, with or without | ||
258 | * modification, are permitted provided that the following conditions | ||
259 | @@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh); | ||
260 | static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh); | ||
261 | static int input_gssapi_errtok(int, u_int32_t, struct ssh *); | ||
262 | |||
263 | +/* | ||
264 | + * The 'gssapi_keyex' userauth mechanism. | ||
265 | + */ | ||
266 | +static int | ||
267 | +userauth_gsskeyex(struct ssh *ssh) | ||
268 | +{ | ||
269 | + Authctxt *authctxt = ssh->authctxt; | ||
270 | + int r, authenticated = 0; | ||
271 | + struct sshbuf *b = NULL; | ||
272 | + gss_buffer_desc mic, gssbuf; | ||
273 | + u_char *p; | ||
274 | + size_t len; | ||
275 | + | ||
276 | + if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 || | ||
277 | + (r = sshpkt_get_end(ssh)) != 0) | ||
278 | + fatal("%s: %s", __func__, ssh_err(r)); | ||
279 | + | ||
280 | + if ((b = sshbuf_new()) == NULL) | ||
281 | + fatal("%s: sshbuf_new failed", __func__); | ||
282 | + | ||
283 | + mic.value = p; | ||
284 | + mic.length = len; | ||
285 | + | ||
286 | + ssh_gssapi_buildmic(b, authctxt->user, authctxt->service, | ||
287 | + "gssapi-keyex"); | ||
288 | + | ||
289 | + if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL) | ||
290 | + fatal("%s: sshbuf_mutable_ptr failed", __func__); | ||
291 | + gssbuf.length = sshbuf_len(b); | ||
292 | + | ||
293 | + /* gss_kex_context is NULL with privsep, so we can't check it here */ | ||
294 | + if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, | ||
295 | + &gssbuf, &mic)))) | ||
296 | + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, | ||
297 | + authctxt->pw, 1)); | ||
298 | + | ||
299 | + sshbuf_free(b); | ||
300 | + free(mic.value); | ||
301 | + | ||
302 | + return (authenticated); | ||
303 | +} | ||
304 | + | ||
305 | /* | ||
306 | * We only support those mechanisms that we know about (ie ones that we know | ||
307 | * how to check local user kuserok and the like) | ||
308 | @@ -260,7 +302,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh) | ||
309 | if ((r = sshpkt_get_end(ssh)) != 0) | ||
310 | fatal("%s: %s", __func__, ssh_err(r)); | ||
311 | |||
312 | - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); | ||
313 | + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, | ||
314 | + authctxt->pw, 1)); | ||
315 | |||
316 | if ((!use_privsep || mm_is_monitor()) && | ||
317 | (displayname = ssh_gssapi_displayname()) != NULL) | ||
318 | @@ -306,7 +349,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) | ||
319 | gssbuf.length = sshbuf_len(b); | ||
320 | |||
321 | if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))) | ||
322 | - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); | ||
323 | + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, | ||
324 | + authctxt->pw, 0)); | ||
325 | else | ||
326 | logit("GSSAPI MIC check failed"); | ||
327 | |||
328 | @@ -326,6 +370,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) | ||
329 | return 0; | ||
330 | } | ||
331 | |||
332 | +Authmethod method_gsskeyex = { | ||
333 | + "gssapi-keyex", | ||
334 | + userauth_gsskeyex, | ||
335 | + &options.gss_authentication | ||
336 | +}; | ||
337 | + | ||
338 | Authmethod method_gssapi = { | ||
339 | "gssapi-with-mic", | ||
340 | userauth_gssapi, | ||
341 | diff --git a/auth2.c b/auth2.c | ||
342 | index 91aaf34a6..a4a5e0069 100644 | ||
343 | --- a/auth2.c | ||
344 | +++ b/auth2.c | ||
345 | @@ -73,6 +73,7 @@ extern Authmethod method_passwd; | ||
346 | extern Authmethod method_kbdint; | ||
347 | extern Authmethod method_hostbased; | ||
348 | #ifdef GSSAPI | ||
349 | +extern Authmethod method_gsskeyex; | ||
350 | extern Authmethod method_gssapi; | ||
351 | #endif | ||
352 | |||
353 | @@ -80,6 +81,7 @@ Authmethod *authmethods[] = { | ||
354 | &method_none, | ||
355 | &method_pubkey, | ||
356 | #ifdef GSSAPI | ||
357 | + &method_gsskeyex, | ||
358 | &method_gssapi, | ||
359 | #endif | ||
360 | &method_passwd, | ||
361 | diff --git a/canohost.c b/canohost.c | ||
362 | index abea9c6e6..8e81b5193 100644 | ||
363 | --- a/canohost.c | ||
364 | +++ b/canohost.c | ||
365 | @@ -35,6 +35,99 @@ | ||
366 | #include "canohost.h" | ||
367 | #include "misc.h" | ||
368 | |||
369 | +/* | ||
370 | + * Returns the remote DNS hostname as a string. The returned string must not | ||
371 | + * be freed. NB. this will usually trigger a DNS query the first time it is | ||
372 | + * called. | ||
373 | + * This function does additional checks on the hostname to mitigate some | ||
374 | + * attacks on legacy rhosts-style authentication. | ||
375 | + * XXX is RhostsRSAAuthentication vulnerable to these? | ||
376 | + * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) | ||
377 | + */ | ||
378 | + | ||
379 | +char * | ||
380 | +remote_hostname(struct ssh *ssh) | ||
381 | +{ | ||
382 | + struct sockaddr_storage from; | ||
383 | + socklen_t fromlen; | ||
384 | + struct addrinfo hints, *ai, *aitop; | ||
385 | + char name[NI_MAXHOST], ntop2[NI_MAXHOST]; | ||
386 | + const char *ntop = ssh_remote_ipaddr(ssh); | ||
387 | + | ||
388 | + /* Get IP address of client. */ | ||
389 | + fromlen = sizeof(from); | ||
390 | + memset(&from, 0, sizeof(from)); | ||
391 | + if (getpeername(ssh_packet_get_connection_in(ssh), | ||
392 | + (struct sockaddr *)&from, &fromlen) == -1) { | ||
393 | + debug("getpeername failed: %.100s", strerror(errno)); | ||
394 | + return xstrdup(ntop); | ||
395 | + } | ||
396 | + | ||
397 | + ipv64_normalise_mapped(&from, &fromlen); | ||
398 | + if (from.ss_family == AF_INET6) | ||
399 | + fromlen = sizeof(struct sockaddr_in6); | ||
400 | + | ||
401 | + debug3("Trying to reverse map address %.100s.", ntop); | ||
402 | + /* Map the IP address to a host name. */ | ||
403 | + if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), | ||
404 | + NULL, 0, NI_NAMEREQD) != 0) { | ||
405 | + /* Host name not found. Use ip address. */ | ||
406 | + return xstrdup(ntop); | ||
407 | + } | ||
408 | + | ||
409 | + /* | ||
410 | + * if reverse lookup result looks like a numeric hostname, | ||
411 | + * someone is trying to trick us by PTR record like following: | ||
412 | + * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 | ||
413 | + */ | ||
414 | + memset(&hints, 0, sizeof(hints)); | ||
415 | + hints.ai_socktype = SOCK_DGRAM; /*dummy*/ | ||
416 | + hints.ai_flags = AI_NUMERICHOST; | ||
417 | + if (getaddrinfo(name, NULL, &hints, &ai) == 0) { | ||
418 | + logit("Nasty PTR record \"%s\" is set up for %s, ignoring", | ||
419 | + name, ntop); | ||
420 | + freeaddrinfo(ai); | ||
421 | + return xstrdup(ntop); | ||
422 | + } | ||
423 | + | ||
424 | + /* Names are stored in lowercase. */ | ||
425 | + lowercase(name); | ||
426 | + | ||
427 | + /* | ||
428 | + * Map it back to an IP address and check that the given | ||
429 | + * address actually is an address of this host. This is | ||
430 | + * necessary because anyone with access to a name server can | ||
431 | + * define arbitrary names for an IP address. Mapping from | ||
432 | + * name to IP address can be trusted better (but can still be | ||
433 | + * fooled if the intruder has access to the name server of | ||
434 | + * the domain). | ||
435 | + */ | ||
436 | + memset(&hints, 0, sizeof(hints)); | ||
437 | + hints.ai_family = from.ss_family; | ||
438 | + hints.ai_socktype = SOCK_STREAM; | ||
439 | + if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { | ||
440 | + logit("reverse mapping checking getaddrinfo for %.700s " | ||
441 | + "[%s] failed.", name, ntop); | ||
442 | + return xstrdup(ntop); | ||
443 | + } | ||
444 | + /* Look for the address from the list of addresses. */ | ||
445 | + for (ai = aitop; ai; ai = ai->ai_next) { | ||
446 | + if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, | ||
447 | + sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && | ||
448 | + (strcmp(ntop, ntop2) == 0)) | ||
449 | + break; | ||
450 | + } | ||
451 | + freeaddrinfo(aitop); | ||
452 | + /* If we reached the end of the list, the address was not there. */ | ||
453 | + if (ai == NULL) { | ||
454 | + /* Address not found for the host name. */ | ||
455 | + logit("Address %.100s maps to %.600s, but this does not " | ||
456 | + "map back to the address.", ntop, name); | ||
457 | + return xstrdup(ntop); | ||
458 | + } | ||
459 | + return xstrdup(name); | ||
460 | +} | ||
461 | + | ||
462 | void | ||
463 | ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len) | ||
464 | { | ||
465 | diff --git a/canohost.h b/canohost.h | ||
466 | index 26d62855a..0cadc9f18 100644 | ||
467 | --- a/canohost.h | ||
468 | +++ b/canohost.h | ||
469 | @@ -15,6 +15,9 @@ | ||
470 | #ifndef _CANOHOST_H | ||
471 | #define _CANOHOST_H | ||
472 | |||
473 | +struct ssh; | ||
474 | + | ||
475 | +char *remote_hostname(struct ssh *); | ||
476 | char *get_peer_ipaddr(int); | ||
477 | int get_peer_port(int); | ||
478 | char *get_local_ipaddr(int); | ||
479 | diff --git a/clientloop.c b/clientloop.c | ||
480 | index da396c72a..42ace7789 100644 | ||
481 | --- a/clientloop.c | ||
482 | +++ b/clientloop.c | ||
483 | @@ -112,6 +112,10 @@ | ||
484 | #include "ssherr.h" | ||
485 | #include "hostfile.h" | ||
486 | |||
487 | +#ifdef GSSAPI | ||
488 | +#include "ssh-gss.h" | ||
489 | +#endif | ||
490 | + | ||
491 | /* import options */ | ||
492 | extern Options options; | ||
493 | |||
494 | @@ -1361,9 +1365,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, | ||
495 | break; | ||
496 | |||
497 | /* Do channel operations unless rekeying in progress. */ | ||
498 | - if (!ssh_packet_is_rekeying(ssh)) | ||
499 | + if (!ssh_packet_is_rekeying(ssh)) { | ||
500 | channel_after_select(ssh, readset, writeset); | ||
501 | |||
502 | +#ifdef GSSAPI | ||
503 | + if (options.gss_renewal_rekey && | ||
504 | + ssh_gssapi_credentials_updated(NULL)) { | ||
505 | + debug("credentials updated - forcing rekey"); | ||
506 | + need_rekeying = 1; | ||
507 | + } | ||
508 | +#endif | ||
509 | + } | ||
510 | + | ||
511 | /* Buffer input from the connection. */ | ||
512 | client_process_net_input(ssh, readset); | ||
513 | |||
514 | diff --git a/configure.ac b/configure.ac | ||
515 | index 460383757..d98e6f74a 100644 | ||
516 | --- a/configure.ac | ||
517 | +++ b/configure.ac | ||
518 | @@ -676,6 +676,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) | ||
519 | [Use tunnel device compatibility to OpenBSD]) | ||
520 | AC_DEFINE([SSH_TUN_PREPEND_AF], [1], | ||
521 | [Prepend the address family to IP tunnel traffic]) | ||
522 | + AC_MSG_CHECKING([if we have the Security Authorization Session API]) | ||
523 | + AC_TRY_COMPILE([#include <Security/AuthSession.h>], | ||
524 | + [SessionCreate(0, 0);], | ||
525 | + [ac_cv_use_security_session_api="yes" | ||
526 | + AC_DEFINE([USE_SECURITY_SESSION_API], [1], | ||
527 | + [platform has the Security Authorization Session API]) | ||
528 | + LIBS="$LIBS -framework Security" | ||
529 | + AC_MSG_RESULT([yes])], | ||
530 | + [ac_cv_use_security_session_api="no" | ||
531 | + AC_MSG_RESULT([no])]) | ||
532 | + AC_MSG_CHECKING([if we have an in-memory credentials cache]) | ||
533 | + AC_TRY_COMPILE( | ||
534 | + [#include <Kerberos/Kerberos.h>], | ||
535 | + [cc_context_t c; | ||
536 | + (void) cc_initialize (&c, 0, NULL, NULL);], | ||
537 | + [AC_DEFINE([USE_CCAPI], [1], | ||
538 | + [platform uses an in-memory credentials cache]) | ||
539 | + LIBS="$LIBS -framework Security" | ||
540 | + AC_MSG_RESULT([yes]) | ||
541 | + if test "x$ac_cv_use_security_session_api" = "xno"; then | ||
542 | + AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***]) | ||
543 | + fi], | ||
544 | + [AC_MSG_RESULT([no])] | ||
545 | + ) | ||
546 | m4_pattern_allow([AU_IPv]) | ||
547 | AC_CHECK_DECL([AU_IPv4], [], | ||
548 | AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records]) | ||
549 | diff --git a/gss-genr.c b/gss-genr.c | ||
550 | index d56257b4a..763a63ffa 100644 | ||
551 | --- a/gss-genr.c | ||
552 | +++ b/gss-genr.c | ||
553 | @@ -1,7 +1,7 @@ | ||
554 | /* $OpenBSD: gss-genr.c,v 1.26 2018/07/10 09:13:30 djm Exp $ */ | ||
555 | |||
556 | /* | ||
557 | - * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
558 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
559 | * | ||
560 | * Redistribution and use in source and binary forms, with or without | ||
561 | * modification, are permitted provided that the following conditions | ||
562 | @@ -41,12 +41,36 @@ | ||
563 | #include "sshbuf.h" | ||
564 | #include "log.h" | ||
565 | #include "ssh2.h" | ||
566 | +#include "cipher.h" | ||
567 | +#include "sshkey.h" | ||
568 | +#include "kex.h" | ||
569 | +#include "digest.h" | ||
570 | +#include "packet.h" | ||
571 | |||
572 | #include "ssh-gss.h" | ||
573 | |||
574 | extern u_char *session_id2; | ||
575 | extern u_int session_id2_len; | ||
576 | |||
577 | +typedef struct { | ||
578 | + char *encoded; | ||
579 | + gss_OID oid; | ||
580 | +} ssh_gss_kex_mapping; | ||
581 | + | ||
582 | +/* | ||
583 | + * XXX - It would be nice to find a more elegant way of handling the | ||
584 | + * XXX passing of the key exchange context to the userauth routines | ||
585 | + */ | ||
586 | + | ||
587 | +Gssctxt *gss_kex_context = NULL; | ||
588 | + | ||
589 | +static ssh_gss_kex_mapping *gss_enc2oid = NULL; | ||
590 | + | ||
591 | +int | ||
592 | +ssh_gssapi_oid_table_ok(void) { | ||
593 | + return (gss_enc2oid != NULL); | ||
594 | +} | ||
595 | + | ||
596 | /* sshbuf_get for gss_buffer_desc */ | ||
597 | int | ||
598 | ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g) | ||
599 | @@ -62,6 +86,162 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g) | ||
600 | return 0; | ||
601 | } | ||
602 | |||
603 | +/* sshpkt_get of gss_buffer_desc */ | ||
604 | +int | ||
605 | +ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *ssh, gss_buffer_desc *g) | ||
606 | +{ | ||
607 | + int r; | ||
608 | + u_char *p; | ||
609 | + size_t len; | ||
610 | + | ||
611 | + if ((r = sshpkt_get_string(ssh, &p, &len)) != 0) | ||
612 | + return r; | ||
613 | + g->value = p; | ||
614 | + g->length = len; | ||
615 | + return 0; | ||
616 | +} | ||
617 | + | ||
618 | +/* | ||
619 | + * Return a list of the gss-group1-sha1 mechanisms supported by this program | ||
620 | + * | ||
621 | + * We test mechanisms to ensure that we can use them, to avoid starting | ||
622 | + * a key exchange with a bad mechanism | ||
623 | + */ | ||
624 | + | ||
625 | +char * | ||
626 | +ssh_gssapi_client_mechanisms(const char *host, const char *client, | ||
627 | + const char *kex) { | ||
628 | + gss_OID_set gss_supported = NULL; | ||
629 | + OM_uint32 min_status; | ||
630 | + | ||
631 | + if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported))) | ||
632 | + return NULL; | ||
633 | + | ||
634 | + return ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism, | ||
635 | + host, client, kex); | ||
636 | +} | ||
637 | + | ||
638 | +char * | ||
639 | +ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check, | ||
640 | + const char *host, const char *client, const char *kex) { | ||
641 | + struct sshbuf *buf = NULL; | ||
642 | + size_t i; | ||
643 | + int r = SSH_ERR_ALLOC_FAIL; | ||
644 | + int oidpos, enclen; | ||
645 | + char *mechs, *encoded; | ||
646 | + u_char digest[SSH_DIGEST_MAX_LENGTH]; | ||
647 | + char deroid[2]; | ||
648 | + struct ssh_digest_ctx *md = NULL; | ||
649 | + char *s, *cp, *p; | ||
650 | + | ||
651 | + if (gss_enc2oid != NULL) { | ||
652 | + for (i = 0; gss_enc2oid[i].encoded != NULL; i++) | ||
653 | + free(gss_enc2oid[i].encoded); | ||
654 | + free(gss_enc2oid); | ||
655 | + } | ||
656 | + | ||
657 | + gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) * | ||
658 | + (gss_supported->count + 1)); | ||
659 | + | ||
660 | + if ((buf = sshbuf_new()) == NULL) | ||
661 | + fatal("%s: sshbuf_new failed", __func__); | ||
662 | + | ||
663 | + oidpos = 0; | ||
664 | + s = cp = xstrdup(kex); | ||
665 | + for (i = 0; i < gss_supported->count; i++) { | ||
666 | + if (gss_supported->elements[i].length < 128 && | ||
667 | + (*check)(NULL, &(gss_supported->elements[i]), host, client)) { | ||
668 | + | ||
669 | + deroid[0] = SSH_GSS_OIDTYPE; | ||
670 | + deroid[1] = gss_supported->elements[i].length; | ||
671 | + | ||
672 | + if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL || | ||
673 | + (r = ssh_digest_update(md, deroid, 2)) != 0 || | ||
674 | + (r = ssh_digest_update(md, | ||
675 | + gss_supported->elements[i].elements, | ||
676 | + gss_supported->elements[i].length)) != 0 || | ||
677 | + (r = ssh_digest_final(md, digest, sizeof(digest))) != 0) | ||
678 | + fatal("%s: digest failed: %s", __func__, | ||
679 | + ssh_err(r)); | ||
680 | + ssh_digest_free(md); | ||
681 | + md = NULL; | ||
682 | + | ||
683 | + encoded = xmalloc(ssh_digest_bytes(SSH_DIGEST_MD5) | ||
684 | + * 2); | ||
685 | + enclen = __b64_ntop(digest, | ||
686 | + ssh_digest_bytes(SSH_DIGEST_MD5), encoded, | ||
687 | + ssh_digest_bytes(SSH_DIGEST_MD5) * 2); | ||
688 | + | ||
689 | + cp = strncpy(s, kex, strlen(kex)); | ||
690 | + for ((p = strsep(&cp, ",")); p && *p != '\0'; | ||
691 | + (p = strsep(&cp, ","))) { | ||
692 | + if (sshbuf_len(buf) != 0 && | ||
693 | + (r = sshbuf_put_u8(buf, ',')) != 0) | ||
694 | + fatal("%s: sshbuf_put_u8 error: %s", | ||
695 | + __func__, ssh_err(r)); | ||
696 | + if ((r = sshbuf_put(buf, p, strlen(p))) != 0 || | ||
697 | + (r = sshbuf_put(buf, encoded, enclen)) != 0) | ||
698 | + fatal("%s: sshbuf_put error: %s", | ||
699 | + __func__, ssh_err(r)); | ||
700 | + } | ||
701 | + | ||
702 | + gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]); | ||
703 | + gss_enc2oid[oidpos].encoded = encoded; | ||
704 | + oidpos++; | ||
705 | + } | ||
706 | + } | ||
707 | + free(s); | ||
708 | + gss_enc2oid[oidpos].oid = NULL; | ||
709 | + gss_enc2oid[oidpos].encoded = NULL; | ||
710 | + | ||
711 | + if ((mechs = sshbuf_dup_string(buf)) == NULL) | ||
712 | + fatal("%s: sshbuf_dup_string failed", __func__); | ||
713 | + | ||
714 | + sshbuf_free(buf); | ||
715 | + | ||
716 | + if (strlen(mechs) == 0) { | ||
717 | + free(mechs); | ||
718 | + mechs = NULL; | ||
719 | + } | ||
720 | + | ||
721 | + return (mechs); | ||
722 | +} | ||
723 | + | ||
724 | +gss_OID | ||
725 | +ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) { | ||
726 | + int i = 0; | ||
727 | + | ||
728 | +#define SKIP_KEX_NAME(type) \ | ||
729 | + case type: \ | ||
730 | + if (strlen(name) < sizeof(type##_ID)) \ | ||
731 | + return GSS_C_NO_OID; \ | ||
732 | + name += sizeof(type##_ID) - 1; \ | ||
733 | + break; | ||
734 | + | ||
735 | + switch (kex_type) { | ||
736 | + SKIP_KEX_NAME(KEX_GSS_GRP1_SHA1) | ||
737 | + SKIP_KEX_NAME(KEX_GSS_GRP14_SHA1) | ||
738 | + SKIP_KEX_NAME(KEX_GSS_GRP14_SHA256) | ||
739 | + SKIP_KEX_NAME(KEX_GSS_GRP16_SHA512) | ||
740 | + SKIP_KEX_NAME(KEX_GSS_GEX_SHA1) | ||
741 | + SKIP_KEX_NAME(KEX_GSS_NISTP256_SHA256) | ||
742 | + SKIP_KEX_NAME(KEX_GSS_C25519_SHA256) | ||
743 | + default: | ||
744 | + return GSS_C_NO_OID; | ||
745 | + } | ||
746 | + | ||
747 | +#undef SKIP_KEX_NAME | ||
748 | + | ||
749 | + while (gss_enc2oid[i].encoded != NULL && | ||
750 | + strcmp(name, gss_enc2oid[i].encoded) != 0) | ||
751 | + i++; | ||
752 | + | ||
753 | + if (gss_enc2oid[i].oid != NULL && ctx != NULL) | ||
754 | + ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid); | ||
755 | + | ||
756 | + return gss_enc2oid[i].oid; | ||
757 | +} | ||
758 | + | ||
759 | /* Check that the OID in a data stream matches that in the context */ | ||
760 | int | ||
761 | ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len) | ||
762 | @@ -218,7 +398,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok, | ||
763 | } | ||
764 | |||
765 | ctx->major = gss_init_sec_context(&ctx->minor, | ||
766 | - GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid, | ||
767 | + ctx->client_creds, &ctx->context, ctx->name, ctx->oid, | ||
768 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag, | ||
769 | 0, NULL, recv_tok, NULL, send_tok, flags, NULL); | ||
770 | |||
771 | @@ -247,9 +427,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host) | ||
772 | return (ctx->major); | ||
773 | } | ||
774 | |||
775 | +OM_uint32 | ||
776 | +ssh_gssapi_client_identity(Gssctxt *ctx, const char *name) | ||
777 | +{ | ||
778 | + gss_buffer_desc gssbuf; | ||
779 | + gss_name_t gssname; | ||
780 | + OM_uint32 status; | ||
781 | + gss_OID_set oidset; | ||
782 | + | ||
783 | + gssbuf.value = (void *) name; | ||
784 | + gssbuf.length = strlen(gssbuf.value); | ||
785 | + | ||
786 | + gss_create_empty_oid_set(&status, &oidset); | ||
787 | + gss_add_oid_set_member(&status, ctx->oid, &oidset); | ||
788 | + | ||
789 | + ctx->major = gss_import_name(&ctx->minor, &gssbuf, | ||
790 | + GSS_C_NT_USER_NAME, &gssname); | ||
791 | + | ||
792 | + if (!ctx->major) | ||
793 | + ctx->major = gss_acquire_cred(&ctx->minor, | ||
794 | + gssname, 0, oidset, GSS_C_INITIATE, | ||
795 | + &ctx->client_creds, NULL, NULL); | ||
796 | + | ||
797 | + gss_release_name(&status, &gssname); | ||
798 | + gss_release_oid_set(&status, &oidset); | ||
799 | + | ||
800 | + if (ctx->major) | ||
801 | + ssh_gssapi_error(ctx); | ||
802 | + | ||
803 | + return(ctx->major); | ||
804 | +} | ||
805 | + | ||
806 | OM_uint32 | ||
807 | ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash) | ||
808 | { | ||
809 | + if (ctx == NULL) | ||
810 | + return -1; | ||
811 | + | ||
812 | if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context, | ||
813 | GSS_C_QOP_DEFAULT, buffer, hash))) | ||
814 | ssh_gssapi_error(ctx); | ||
815 | @@ -257,6 +471,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash) | ||
816 | return (ctx->major); | ||
817 | } | ||
818 | |||
819 | +/* Priviledged when used by server */ | ||
820 | +OM_uint32 | ||
821 | +ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
822 | +{ | ||
823 | + if (ctx == NULL) | ||
824 | + return -1; | ||
825 | + | ||
826 | + ctx->major = gss_verify_mic(&ctx->minor, ctx->context, | ||
827 | + gssbuf, gssmic, NULL); | ||
828 | + | ||
829 | + return (ctx->major); | ||
830 | +} | ||
831 | + | ||
832 | void | ||
833 | ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service, | ||
834 | const char *context) | ||
835 | @@ -273,11 +500,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service, | ||
836 | } | ||
837 | |||
838 | int | ||
839 | -ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) | ||
840 | +ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host, | ||
841 | + const char *client) | ||
842 | { | ||
843 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | ||
844 | OM_uint32 major, minor; | ||
845 | gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"}; | ||
846 | + Gssctxt *intctx = NULL; | ||
847 | + | ||
848 | + if (ctx == NULL) | ||
849 | + ctx = &intctx; | ||
850 | |||
851 | /* RFC 4462 says we MUST NOT do SPNEGO */ | ||
852 | if (oid->length == spnego_oid.length && | ||
853 | @@ -287,6 +519,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) | ||
854 | ssh_gssapi_build_ctx(ctx); | ||
855 | ssh_gssapi_set_oid(*ctx, oid); | ||
856 | major = ssh_gssapi_import_name(*ctx, host); | ||
857 | + | ||
858 | + if (!GSS_ERROR(major) && client) | ||
859 | + major = ssh_gssapi_client_identity(*ctx, client); | ||
860 | + | ||
861 | if (!GSS_ERROR(major)) { | ||
862 | major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, | ||
863 | NULL); | ||
864 | @@ -296,10 +532,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) | ||
865 | GSS_C_NO_BUFFER); | ||
866 | } | ||
867 | |||
868 | - if (GSS_ERROR(major)) | ||
869 | + if (GSS_ERROR(major) || intctx != NULL) | ||
870 | ssh_gssapi_delete_ctx(ctx); | ||
871 | |||
872 | return (!GSS_ERROR(major)); | ||
873 | } | ||
874 | |||
875 | +int | ||
876 | +ssh_gssapi_credentials_updated(Gssctxt *ctxt) { | ||
877 | + static gss_name_t saved_name = GSS_C_NO_NAME; | ||
878 | + static OM_uint32 saved_lifetime = 0; | ||
879 | + static gss_OID saved_mech = GSS_C_NO_OID; | ||
880 | + static gss_name_t name; | ||
881 | + static OM_uint32 last_call = 0; | ||
882 | + OM_uint32 lifetime, now, major, minor; | ||
883 | + int equal; | ||
884 | + | ||
885 | + now = time(NULL); | ||
886 | + | ||
887 | + if (ctxt) { | ||
888 | + debug("Rekey has happened - updating saved versions"); | ||
889 | + | ||
890 | + if (saved_name != GSS_C_NO_NAME) | ||
891 | + gss_release_name(&minor, &saved_name); | ||
892 | + | ||
893 | + major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, | ||
894 | + &saved_name, &saved_lifetime, NULL, NULL); | ||
895 | + | ||
896 | + if (!GSS_ERROR(major)) { | ||
897 | + saved_mech = ctxt->oid; | ||
898 | + saved_lifetime+= now; | ||
899 | + } else { | ||
900 | + /* Handle the error */ | ||
901 | + } | ||
902 | + return 0; | ||
903 | + } | ||
904 | + | ||
905 | + if (now - last_call < 10) | ||
906 | + return 0; | ||
907 | + | ||
908 | + last_call = now; | ||
909 | + | ||
910 | + if (saved_mech == GSS_C_NO_OID) | ||
911 | + return 0; | ||
912 | + | ||
913 | + major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, | ||
914 | + &name, &lifetime, NULL, NULL); | ||
915 | + if (major == GSS_S_CREDENTIALS_EXPIRED) | ||
916 | + return 0; | ||
917 | + else if (GSS_ERROR(major)) | ||
918 | + return 0; | ||
919 | + | ||
920 | + major = gss_compare_name(&minor, saved_name, name, &equal); | ||
921 | + gss_release_name(&minor, &name); | ||
922 | + if (GSS_ERROR(major)) | ||
923 | + return 0; | ||
924 | + | ||
925 | + if (equal && (saved_lifetime < lifetime + now - 10)) | ||
926 | + return 1; | ||
927 | + | ||
928 | + return 0; | ||
929 | +} | ||
930 | + | ||
931 | #endif /* GSSAPI */ | ||
932 | diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c | ||
933 | index a151bc1e4..ef9beb67c 100644 | ||
934 | --- a/gss-serv-krb5.c | ||
935 | +++ b/gss-serv-krb5.c | ||
936 | @@ -1,7 +1,7 @@ | ||
937 | /* $OpenBSD: gss-serv-krb5.c,v 1.9 2018/07/09 21:37:55 markus Exp $ */ | ||
938 | |||
939 | /* | ||
940 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
941 | + * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. | ||
942 | * | ||
943 | * Redistribution and use in source and binary forms, with or without | ||
944 | * modification, are permitted provided that the following conditions | ||
945 | @@ -120,8 +120,8 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client) | ||
946 | krb5_error_code problem; | ||
947 | krb5_principal princ; | ||
948 | OM_uint32 maj_status, min_status; | ||
949 | - int len; | ||
950 | const char *errmsg; | ||
951 | + const char *new_ccname; | ||
952 | |||
953 | if (client->creds == NULL) { | ||
954 | debug("No credentials stored"); | ||
955 | @@ -180,11 +180,16 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client) | ||
956 | return; | ||
957 | } | ||
958 | |||
959 | - client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache)); | ||
960 | + new_ccname = krb5_cc_get_name(krb_context, ccache); | ||
961 | + | ||
962 | client->store.envvar = "KRB5CCNAME"; | ||
963 | - len = strlen(client->store.filename) + 6; | ||
964 | - client->store.envval = xmalloc(len); | ||
965 | - snprintf(client->store.envval, len, "FILE:%s", client->store.filename); | ||
966 | +#ifdef USE_CCAPI | ||
967 | + xasprintf(&client->store.envval, "API:%s", new_ccname); | ||
968 | + client->store.filename = NULL; | ||
969 | +#else | ||
970 | + xasprintf(&client->store.envval, "FILE:%s", new_ccname); | ||
971 | + client->store.filename = xstrdup(new_ccname); | ||
972 | +#endif | ||
973 | |||
974 | #ifdef USE_PAM | ||
975 | if (options.use_pam) | ||
976 | @@ -196,6 +201,71 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client) | ||
977 | return; | ||
978 | } | ||
979 | |||
980 | +int | ||
981 | +ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, | ||
982 | + ssh_gssapi_client *client) | ||
983 | +{ | ||
984 | + krb5_ccache ccache = NULL; | ||
985 | + krb5_principal principal = NULL; | ||
986 | + char *name = NULL; | ||
987 | + krb5_error_code problem; | ||
988 | + OM_uint32 maj_status, min_status; | ||
989 | + | ||
990 | + if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) { | ||
991 | + logit("krb5_cc_resolve(): %.100s", | ||
992 | + krb5_get_err_text(krb_context, problem)); | ||
993 | + return 0; | ||
994 | + } | ||
995 | + | ||
996 | + /* Find out who the principal in this cache is */ | ||
997 | + if ((problem = krb5_cc_get_principal(krb_context, ccache, | ||
998 | + &principal))) { | ||
999 | + logit("krb5_cc_get_principal(): %.100s", | ||
1000 | + krb5_get_err_text(krb_context, problem)); | ||
1001 | + krb5_cc_close(krb_context, ccache); | ||
1002 | + return 0; | ||
1003 | + } | ||
1004 | + | ||
1005 | + if ((problem = krb5_unparse_name(krb_context, principal, &name))) { | ||
1006 | + logit("krb5_unparse_name(): %.100s", | ||
1007 | + krb5_get_err_text(krb_context, problem)); | ||
1008 | + krb5_free_principal(krb_context, principal); | ||
1009 | + krb5_cc_close(krb_context, ccache); | ||
1010 | + return 0; | ||
1011 | + } | ||
1012 | + | ||
1013 | + | ||
1014 | + if (strcmp(name,client->exportedname.value)!=0) { | ||
1015 | + debug("Name in local credentials cache differs. Not storing"); | ||
1016 | + krb5_free_principal(krb_context, principal); | ||
1017 | + krb5_cc_close(krb_context, ccache); | ||
1018 | + krb5_free_unparsed_name(krb_context, name); | ||
1019 | + return 0; | ||
1020 | + } | ||
1021 | + krb5_free_unparsed_name(krb_context, name); | ||
1022 | + | ||
1023 | + /* Name matches, so lets get on with it! */ | ||
1024 | + | ||
1025 | + if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) { | ||
1026 | + logit("krb5_cc_initialize(): %.100s", | ||
1027 | + krb5_get_err_text(krb_context, problem)); | ||
1028 | + krb5_free_principal(krb_context, principal); | ||
1029 | + krb5_cc_close(krb_context, ccache); | ||
1030 | + return 0; | ||
1031 | + } | ||
1032 | + | ||
1033 | + krb5_free_principal(krb_context, principal); | ||
1034 | + | ||
1035 | + if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds, | ||
1036 | + ccache))) { | ||
1037 | + logit("gss_krb5_copy_ccache() failed. Sorry!"); | ||
1038 | + krb5_cc_close(krb_context, ccache); | ||
1039 | + return 0; | ||
1040 | + } | ||
1041 | + | ||
1042 | + return 1; | ||
1043 | +} | ||
1044 | + | ||
1045 | ssh_gssapi_mech gssapi_kerberos_mech = { | ||
1046 | "toWM5Slw5Ew8Mqkay+al2g==", | ||
1047 | "Kerberos", | ||
1048 | @@ -203,7 +273,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = { | ||
1049 | NULL, | ||
1050 | &ssh_gssapi_krb5_userok, | ||
1051 | NULL, | ||
1052 | - &ssh_gssapi_krb5_storecreds | ||
1053 | + &ssh_gssapi_krb5_storecreds, | ||
1054 | + &ssh_gssapi_krb5_updatecreds | ||
1055 | }; | ||
1056 | |||
1057 | #endif /* KRB5 */ | ||
1058 | diff --git a/gss-serv.c b/gss-serv.c | ||
1059 | index b5d4bb2d1..55f4d4bda 100644 | ||
1060 | --- a/gss-serv.c | ||
1061 | +++ b/gss-serv.c | ||
1062 | @@ -1,7 +1,7 @@ | ||
1063 | /* $OpenBSD: gss-serv.c,v 1.32 2020/03/13 03:17:07 djm Exp $ */ | ||
1064 | |||
1065 | /* | ||
1066 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
1067 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
1068 | * | ||
1069 | * Redistribution and use in source and binary forms, with or without | ||
1070 | * modification, are permitted provided that the following conditions | ||
1071 | @@ -44,17 +44,19 @@ | ||
1072 | #include "session.h" | ||
1073 | #include "misc.h" | ||
1074 | #include "servconf.h" | ||
1075 | +#include "uidswap.h" | ||
1076 | |||
1077 | #include "ssh-gss.h" | ||
1078 | +#include "monitor_wrap.h" | ||
1079 | |||
1080 | extern ServerOptions options; | ||
1081 | |||
1082 | static ssh_gssapi_client gssapi_client = | ||
1083 | - { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, | ||
1084 | - GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}}; | ||
1085 | + { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL, | ||
1086 | + GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0}; | ||
1087 | |||
1088 | ssh_gssapi_mech gssapi_null_mech = | ||
1089 | - { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL}; | ||
1090 | + { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL}; | ||
1091 | |||
1092 | #ifdef KRB5 | ||
1093 | extern ssh_gssapi_mech gssapi_kerberos_mech; | ||
1094 | @@ -140,6 +142,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) | ||
1095 | return (ssh_gssapi_acquire_cred(*ctx)); | ||
1096 | } | ||
1097 | |||
1098 | +/* Unprivileged */ | ||
1099 | +char * | ||
1100 | +ssh_gssapi_server_mechanisms(void) { | ||
1101 | + if (supported_oids == NULL) | ||
1102 | + ssh_gssapi_prepare_supported_oids(); | ||
1103 | + return (ssh_gssapi_kex_mechs(supported_oids, | ||
1104 | + &ssh_gssapi_server_check_mech, NULL, NULL, | ||
1105 | + options.gss_kex_algorithms)); | ||
1106 | +} | ||
1107 | + | ||
1108 | +/* Unprivileged */ | ||
1109 | +int | ||
1110 | +ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data, | ||
1111 | + const char *dummy) { | ||
1112 | + Gssctxt *ctx = NULL; | ||
1113 | + int res; | ||
1114 | + | ||
1115 | + res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid))); | ||
1116 | + ssh_gssapi_delete_ctx(&ctx); | ||
1117 | + | ||
1118 | + return (res); | ||
1119 | +} | ||
1120 | + | ||
1121 | /* Unprivileged */ | ||
1122 | void | ||
1123 | ssh_gssapi_supported_oids(gss_OID_set *oidset) | ||
1124 | @@ -150,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset) | ||
1125 | gss_OID_set supported; | ||
1126 | |||
1127 | gss_create_empty_oid_set(&min_status, oidset); | ||
1128 | - gss_indicate_mechs(&min_status, &supported); | ||
1129 | + | ||
1130 | + if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported))) | ||
1131 | + return; | ||
1132 | |||
1133 | while (supported_mechs[i]->name != NULL) { | ||
1134 | if (GSS_ERROR(gss_test_oid_set_member(&min_status, | ||
1135 | @@ -276,8 +303,48 @@ OM_uint32 | ||
1136 | ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) | ||
1137 | { | ||
1138 | int i = 0; | ||
1139 | + int equal = 0; | ||
1140 | + gss_name_t new_name = GSS_C_NO_NAME; | ||
1141 | + gss_buffer_desc ename = GSS_C_EMPTY_BUFFER; | ||
1142 | + | ||
1143 | + if (options.gss_store_rekey && client->used && ctx->client_creds) { | ||
1144 | + if (client->mech->oid.length != ctx->oid->length || | ||
1145 | + (memcmp(client->mech->oid.elements, | ||
1146 | + ctx->oid->elements, ctx->oid->length) !=0)) { | ||
1147 | + debug("Rekeyed credentials have different mechanism"); | ||
1148 | + return GSS_S_COMPLETE; | ||
1149 | + } | ||
1150 | + | ||
1151 | + if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, | ||
1152 | + ctx->client_creds, ctx->oid, &new_name, | ||
1153 | + NULL, NULL, NULL))) { | ||
1154 | + ssh_gssapi_error(ctx); | ||
1155 | + return (ctx->major); | ||
1156 | + } | ||
1157 | + | ||
1158 | + ctx->major = gss_compare_name(&ctx->minor, client->name, | ||
1159 | + new_name, &equal); | ||
1160 | + | ||
1161 | + if (GSS_ERROR(ctx->major)) { | ||
1162 | + ssh_gssapi_error(ctx); | ||
1163 | + return (ctx->major); | ||
1164 | + } | ||
1165 | + | ||
1166 | + if (!equal) { | ||
1167 | + debug("Rekeyed credentials have different name"); | ||
1168 | + return GSS_S_COMPLETE; | ||
1169 | + } | ||
1170 | |||
1171 | - gss_buffer_desc ename; | ||
1172 | + debug("Marking rekeyed credentials for export"); | ||
1173 | + | ||
1174 | + gss_release_name(&ctx->minor, &client->name); | ||
1175 | + gss_release_cred(&ctx->minor, &client->creds); | ||
1176 | + client->name = new_name; | ||
1177 | + client->creds = ctx->client_creds; | ||
1178 | + ctx->client_creds = GSS_C_NO_CREDENTIAL; | ||
1179 | + client->updated = 1; | ||
1180 | + return GSS_S_COMPLETE; | ||
1181 | + } | ||
1182 | |||
1183 | client->mech = NULL; | ||
1184 | |||
1185 | @@ -292,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) | ||
1186 | if (client->mech == NULL) | ||
1187 | return GSS_S_FAILURE; | ||
1188 | |||
1189 | + if (ctx->client_creds && | ||
1190 | + (ctx->major = gss_inquire_cred_by_mech(&ctx->minor, | ||
1191 | + ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) { | ||
1192 | + ssh_gssapi_error(ctx); | ||
1193 | + return (ctx->major); | ||
1194 | + } | ||
1195 | + | ||
1196 | if ((ctx->major = gss_display_name(&ctx->minor, ctx->client, | ||
1197 | &client->displayname, NULL))) { | ||
1198 | ssh_gssapi_error(ctx); | ||
1199 | @@ -309,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) | ||
1200 | return (ctx->major); | ||
1201 | } | ||
1202 | |||
1203 | + gss_release_buffer(&ctx->minor, &ename); | ||
1204 | + | ||
1205 | /* We can't copy this structure, so we just move the pointer to it */ | ||
1206 | client->creds = ctx->client_creds; | ||
1207 | ctx->client_creds = GSS_C_NO_CREDENTIAL; | ||
1208 | @@ -356,19 +432,23 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep) | ||
1209 | |||
1210 | /* Privileged */ | ||
1211 | int | ||
1212 | -ssh_gssapi_userok(char *user) | ||
1213 | +ssh_gssapi_userok(char *user, struct passwd *pw, int kex) | ||
1214 | { | ||
1215 | OM_uint32 lmin; | ||
1216 | |||
1217 | + (void) kex; /* used in privilege separation */ | ||
1218 | + | ||
1219 | if (gssapi_client.exportedname.length == 0 || | ||
1220 | gssapi_client.exportedname.value == NULL) { | ||
1221 | debug("No suitable client data"); | ||
1222 | return 0; | ||
1223 | } | ||
1224 | if (gssapi_client.mech && gssapi_client.mech->userok) | ||
1225 | - if ((*gssapi_client.mech->userok)(&gssapi_client, user)) | ||
1226 | + if ((*gssapi_client.mech->userok)(&gssapi_client, user)) { | ||
1227 | + gssapi_client.used = 1; | ||
1228 | + gssapi_client.store.owner = pw; | ||
1229 | return 1; | ||
1230 | - else { | ||
1231 | + } else { | ||
1232 | /* Destroy delegated credentials if userok fails */ | ||
1233 | gss_release_buffer(&lmin, &gssapi_client.displayname); | ||
1234 | gss_release_buffer(&lmin, &gssapi_client.exportedname); | ||
1235 | @@ -382,14 +462,90 @@ ssh_gssapi_userok(char *user) | ||
1236 | return (0); | ||
1237 | } | ||
1238 | |||
1239 | -/* Privileged */ | ||
1240 | -OM_uint32 | ||
1241 | -ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
1242 | +/* These bits are only used for rekeying. The unpriviledged child is running | ||
1243 | + * as the user, the monitor is root. | ||
1244 | + * | ||
1245 | + * In the child, we want to : | ||
1246 | + * *) Ask the monitor to store our credentials into the store we specify | ||
1247 | + * *) If it succeeds, maybe do a PAM update | ||
1248 | + */ | ||
1249 | + | ||
1250 | +/* Stuff for PAM */ | ||
1251 | + | ||
1252 | +#ifdef USE_PAM | ||
1253 | +static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, | ||
1254 | + struct pam_response **resp, void *data) | ||
1255 | { | ||
1256 | - ctx->major = gss_verify_mic(&ctx->minor, ctx->context, | ||
1257 | - gssbuf, gssmic, NULL); | ||
1258 | + return (PAM_CONV_ERR); | ||
1259 | +} | ||
1260 | +#endif | ||
1261 | |||
1262 | - return (ctx->major); | ||
1263 | +void | ||
1264 | +ssh_gssapi_rekey_creds(void) { | ||
1265 | + int ok; | ||
1266 | +#ifdef USE_PAM | ||
1267 | + int ret; | ||
1268 | + pam_handle_t *pamh = NULL; | ||
1269 | + struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL}; | ||
1270 | + char *envstr; | ||
1271 | +#endif | ||
1272 | + | ||
1273 | + if (gssapi_client.store.filename == NULL && | ||
1274 | + gssapi_client.store.envval == NULL && | ||
1275 | + gssapi_client.store.envvar == NULL) | ||
1276 | + return; | ||
1277 | + | ||
1278 | + ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store)); | ||
1279 | + | ||
1280 | + if (!ok) | ||
1281 | + return; | ||
1282 | + | ||
1283 | + debug("Rekeyed credentials stored successfully"); | ||
1284 | + | ||
1285 | + /* Actually managing to play with the ssh pam stack from here will | ||
1286 | + * be next to impossible. In any case, we may want different options | ||
1287 | + * for rekeying. So, use our own :) | ||
1288 | + */ | ||
1289 | +#ifdef USE_PAM | ||
1290 | + if (!use_privsep) { | ||
1291 | + debug("Not even going to try and do PAM with privsep disabled"); | ||
1292 | + return; | ||
1293 | + } | ||
1294 | + | ||
1295 | + ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name, | ||
1296 | + &pamconv, &pamh); | ||
1297 | + if (ret) | ||
1298 | + return; | ||
1299 | + | ||
1300 | + xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, | ||
1301 | + gssapi_client.store.envval); | ||
1302 | + | ||
1303 | + ret = pam_putenv(pamh, envstr); | ||
1304 | + if (!ret) | ||
1305 | + pam_setcred(pamh, PAM_REINITIALIZE_CRED); | ||
1306 | + pam_end(pamh, PAM_SUCCESS); | ||
1307 | +#endif | ||
1308 | +} | ||
1309 | + | ||
1310 | +int | ||
1311 | +ssh_gssapi_update_creds(ssh_gssapi_ccache *store) { | ||
1312 | + int ok = 0; | ||
1313 | + | ||
1314 | + /* Check we've got credentials to store */ | ||
1315 | + if (!gssapi_client.updated) | ||
1316 | + return 0; | ||
1317 | + | ||
1318 | + gssapi_client.updated = 0; | ||
1319 | + | ||
1320 | + temporarily_use_uid(gssapi_client.store.owner); | ||
1321 | + if (gssapi_client.mech && gssapi_client.mech->updatecreds) | ||
1322 | + ok = (*gssapi_client.mech->updatecreds)(store, &gssapi_client); | ||
1323 | + else | ||
1324 | + debug("No update function for this mechanism"); | ||
1325 | + | ||
1326 | + restore_uid(); | ||
1327 | + | ||
1328 | + return ok; | ||
1329 | } | ||
1330 | |||
1331 | /* Privileged */ | ||
1332 | diff --git a/kex.c b/kex.c | ||
1333 | index 09c7258e0..144dee512 100644 | ||
1334 | --- a/kex.c | ||
1335 | +++ b/kex.c | ||
1336 | @@ -57,11 +57,16 @@ | ||
1337 | #include "misc.h" | ||
1338 | #include "dispatch.h" | ||
1339 | #include "monitor.h" | ||
1340 | +#include "xmalloc.h" | ||
1341 | |||
1342 | #include "ssherr.h" | ||
1343 | #include "sshbuf.h" | ||
1344 | #include "digest.h" | ||
1345 | |||
1346 | +#ifdef GSSAPI | ||
1347 | +#include "ssh-gss.h" | ||
1348 | +#endif | ||
1349 | + | ||
1350 | /* prototype */ | ||
1351 | static int kex_choose_conf(struct ssh *); | ||
1352 | static int kex_input_newkeys(int, u_int32_t, struct ssh *); | ||
1353 | @@ -115,15 +120,28 @@ static const struct kexalg kexalgs[] = { | ||
1354 | #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */ | ||
1355 | { NULL, 0, -1, -1}, | ||
1356 | }; | ||
1357 | +static const struct kexalg gss_kexalgs[] = { | ||
1358 | +#ifdef GSSAPI | ||
1359 | + { KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 }, | ||
1360 | + { KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 }, | ||
1361 | + { KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 }, | ||
1362 | + { KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 }, | ||
1363 | + { KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 }, | ||
1364 | + { KEX_GSS_NISTP256_SHA256_ID, KEX_GSS_NISTP256_SHA256, | ||
1365 | + NID_X9_62_prime256v1, SSH_DIGEST_SHA256 }, | ||
1366 | + { KEX_GSS_C25519_SHA256_ID, KEX_GSS_C25519_SHA256, 0, SSH_DIGEST_SHA256 }, | ||
1367 | +#endif | ||
1368 | + { NULL, 0, -1, -1}, | ||
1369 | +}; | ||
1370 | |||
1371 | -char * | ||
1372 | -kex_alg_list(char sep) | ||
1373 | +static char * | ||
1374 | +kex_alg_list_internal(char sep, const struct kexalg *algs) | ||
1375 | { | ||
1376 | char *ret = NULL, *tmp; | ||
1377 | size_t nlen, rlen = 0; | ||
1378 | const struct kexalg *k; | ||
1379 | |||
1380 | - for (k = kexalgs; k->name != NULL; k++) { | ||
1381 | + for (k = algs; k->name != NULL; k++) { | ||
1382 | if (ret != NULL) | ||
1383 | ret[rlen++] = sep; | ||
1384 | nlen = strlen(k->name); | ||
1385 | @@ -138,6 +156,18 @@ kex_alg_list(char sep) | ||
1386 | return ret; | ||
1387 | } | ||
1388 | |||
1389 | +char * | ||
1390 | +kex_alg_list(char sep) | ||
1391 | +{ | ||
1392 | + return kex_alg_list_internal(sep, kexalgs); | ||
1393 | +} | ||
1394 | + | ||
1395 | +char * | ||
1396 | +kex_gss_alg_list(char sep) | ||
1397 | +{ | ||
1398 | + return kex_alg_list_internal(sep, gss_kexalgs); | ||
1399 | +} | ||
1400 | + | ||
1401 | static const struct kexalg * | ||
1402 | kex_alg_by_name(const char *name) | ||
1403 | { | ||
1404 | @@ -147,6 +177,10 @@ kex_alg_by_name(const char *name) | ||
1405 | if (strcmp(k->name, name) == 0) | ||
1406 | return k; | ||
1407 | } | ||
1408 | + for (k = gss_kexalgs; k->name != NULL; k++) { | ||
1409 | + if (strncmp(k->name, name, strlen(k->name)) == 0) | ||
1410 | + return k; | ||
1411 | + } | ||
1412 | return NULL; | ||
1413 | } | ||
1414 | |||
1415 | @@ -315,6 +349,29 @@ kex_assemble_names(char **listp, const char *def, const char *all) | ||
1416 | return r; | ||
1417 | } | ||
1418 | |||
1419 | +/* Validate GSS KEX method name list */ | ||
1420 | +int | ||
1421 | +kex_gss_names_valid(const char *names) | ||
1422 | +{ | ||
1423 | + char *s, *cp, *p; | ||
1424 | + | ||
1425 | + if (names == NULL || *names == '\0') | ||
1426 | + return 0; | ||
1427 | + s = cp = xstrdup(names); | ||
1428 | + for ((p = strsep(&cp, ",")); p && *p != '\0'; | ||
1429 | + (p = strsep(&cp, ","))) { | ||
1430 | + if (strncmp(p, "gss-", 4) != 0 | ||
1431 | + || kex_alg_by_name(p) == NULL) { | ||
1432 | + error("Unsupported KEX algorithm \"%.100s\"", p); | ||
1433 | + free(s); | ||
1434 | + return 0; | ||
1435 | + } | ||
1436 | + } | ||
1437 | + debug3("gss kex names ok: [%s]", names); | ||
1438 | + free(s); | ||
1439 | + return 1; | ||
1440 | +} | ||
1441 | + | ||
1442 | /* put algorithm proposal into buffer */ | ||
1443 | int | ||
1444 | kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX]) | ||
1445 | @@ -697,6 +754,9 @@ kex_free(struct kex *kex) | ||
1446 | sshbuf_free(kex->server_version); | ||
1447 | sshbuf_free(kex->client_pub); | ||
1448 | free(kex->session_id); | ||
1449 | +#ifdef GSSAPI | ||
1450 | + free(kex->gss_host); | ||
1451 | +#endif /* GSSAPI */ | ||
1452 | free(kex->failed_choice); | ||
1453 | free(kex->hostkey_alg); | ||
1454 | free(kex->name); | ||
1455 | diff --git a/kex.h b/kex.h | ||
1456 | index a5ae6ac05..fe7141414 100644 | ||
1457 | --- a/kex.h | ||
1458 | +++ b/kex.h | ||
1459 | @@ -102,6 +102,15 @@ enum kex_exchange { | ||
1460 | KEX_ECDH_SHA2, | ||
1461 | KEX_C25519_SHA256, | ||
1462 | KEX_KEM_SNTRUP4591761X25519_SHA512, | ||
1463 | +#ifdef GSSAPI | ||
1464 | + KEX_GSS_GRP1_SHA1, | ||
1465 | + KEX_GSS_GRP14_SHA1, | ||
1466 | + KEX_GSS_GRP14_SHA256, | ||
1467 | + KEX_GSS_GRP16_SHA512, | ||
1468 | + KEX_GSS_GEX_SHA1, | ||
1469 | + KEX_GSS_NISTP256_SHA256, | ||
1470 | + KEX_GSS_C25519_SHA256, | ||
1471 | +#endif | ||
1472 | KEX_MAX | ||
1473 | }; | ||
1474 | |||
1475 | @@ -153,6 +162,12 @@ struct kex { | ||
1476 | u_int flags; | ||
1477 | int hash_alg; | ||
1478 | int ec_nid; | ||
1479 | +#ifdef GSSAPI | ||
1480 | + int gss_deleg_creds; | ||
1481 | + int gss_trust_dns; | ||
1482 | + char *gss_host; | ||
1483 | + char *gss_client; | ||
1484 | +#endif | ||
1485 | char *failed_choice; | ||
1486 | int (*verify_host_key)(struct sshkey *, struct ssh *); | ||
1487 | struct sshkey *(*load_host_public_key)(int, int, struct ssh *); | ||
1488 | @@ -174,8 +189,10 @@ struct kex { | ||
1489 | |||
1490 | int kex_names_valid(const char *); | ||
1491 | char *kex_alg_list(char); | ||
1492 | +char *kex_gss_alg_list(char); | ||
1493 | char *kex_names_cat(const char *, const char *); | ||
1494 | int kex_assemble_names(char **, const char *, const char *); | ||
1495 | +int kex_gss_names_valid(const char *); | ||
1496 | |||
1497 | int kex_exchange_identification(struct ssh *, int, const char *); | ||
1498 | |||
1499 | @@ -202,6 +219,12 @@ int kexgex_client(struct ssh *); | ||
1500 | int kexgex_server(struct ssh *); | ||
1501 | int kex_gen_client(struct ssh *); | ||
1502 | int kex_gen_server(struct ssh *); | ||
1503 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
1504 | +int kexgssgex_client(struct ssh *); | ||
1505 | +int kexgssgex_server(struct ssh *); | ||
1506 | +int kexgss_client(struct ssh *); | ||
1507 | +int kexgss_server(struct ssh *); | ||
1508 | +#endif | ||
1509 | |||
1510 | int kex_dh_keypair(struct kex *); | ||
1511 | int kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **, | ||
1512 | @@ -234,6 +257,12 @@ int kexgex_hash(int, const struct sshbuf *, const struct sshbuf *, | ||
1513 | const BIGNUM *, const u_char *, size_t, | ||
1514 | u_char *, size_t *); | ||
1515 | |||
1516 | +int kex_gen_hash(int hash_alg, const struct sshbuf *client_version, | ||
1517 | + const struct sshbuf *server_version, const struct sshbuf *client_kexinit, | ||
1518 | + const struct sshbuf *server_kexinit, const struct sshbuf *server_host_key_blob, | ||
1519 | + const struct sshbuf *client_pub, const struct sshbuf *server_pub, | ||
1520 | + const struct sshbuf *shared_secret, u_char *hash, size_t *hashlen); | ||
1521 | + | ||
1522 | void kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE]) | ||
1523 | __attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE))) | ||
1524 | __attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE))); | ||
1525 | diff --git a/kexdh.c b/kexdh.c | ||
1526 | index 67133e339..edaa46762 100644 | ||
1527 | --- a/kexdh.c | ||
1528 | +++ b/kexdh.c | ||
1529 | @@ -48,13 +48,23 @@ kex_dh_keygen(struct kex *kex) | ||
1530 | { | ||
1531 | switch (kex->kex_type) { | ||
1532 | case KEX_DH_GRP1_SHA1: | ||
1533 | +#ifdef GSSAPI | ||
1534 | + case KEX_GSS_GRP1_SHA1: | ||
1535 | +#endif | ||
1536 | kex->dh = dh_new_group1(); | ||
1537 | break; | ||
1538 | case KEX_DH_GRP14_SHA1: | ||
1539 | case KEX_DH_GRP14_SHA256: | ||
1540 | +#ifdef GSSAPI | ||
1541 | + case KEX_GSS_GRP14_SHA1: | ||
1542 | + case KEX_GSS_GRP14_SHA256: | ||
1543 | +#endif | ||
1544 | kex->dh = dh_new_group14(); | ||
1545 | break; | ||
1546 | case KEX_DH_GRP16_SHA512: | ||
1547 | +#ifdef GSSAPI | ||
1548 | + case KEX_GSS_GRP16_SHA512: | ||
1549 | +#endif | ||
1550 | kex->dh = dh_new_group16(); | ||
1551 | break; | ||
1552 | case KEX_DH_GRP18_SHA512: | ||
1553 | diff --git a/kexgen.c b/kexgen.c | ||
1554 | index 69348b964..c0e8c2f44 100644 | ||
1555 | --- a/kexgen.c | ||
1556 | +++ b/kexgen.c | ||
1557 | @@ -44,7 +44,7 @@ | ||
1558 | static int input_kex_gen_init(int, u_int32_t, struct ssh *); | ||
1559 | static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh); | ||
1560 | |||
1561 | -static int | ||
1562 | +int | ||
1563 | kex_gen_hash( | ||
1564 | int hash_alg, | ||
1565 | const struct sshbuf *client_version, | ||
1566 | diff --git a/kexgssc.c b/kexgssc.c | ||
1567 | new file mode 100644 | ||
1568 | index 000000000..f6e1405eb | ||
1569 | --- /dev/null | ||
1570 | +++ b/kexgssc.c | ||
1571 | @@ -0,0 +1,606 @@ | ||
1572 | +/* | ||
1573 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
1574 | + * | ||
1575 | + * Redistribution and use in source and binary forms, with or without | ||
1576 | + * modification, are permitted provided that the following conditions | ||
1577 | + * are met: | ||
1578 | + * 1. Redistributions of source code must retain the above copyright | ||
1579 | + * notice, this list of conditions and the following disclaimer. | ||
1580 | + * 2. Redistributions in binary form must reproduce the above copyright | ||
1581 | + * notice, this list of conditions and the following disclaimer in the | ||
1582 | + * documentation and/or other materials provided with the distribution. | ||
1583 | + * | ||
1584 | + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR | ||
1585 | + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
1586 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
1587 | + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
1588 | + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
1589 | + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
1590 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
1591 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
1592 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
1593 | + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
1594 | + */ | ||
1595 | + | ||
1596 | +#include "includes.h" | ||
1597 | + | ||
1598 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
1599 | + | ||
1600 | +#include "includes.h" | ||
1601 | + | ||
1602 | +#include <openssl/crypto.h> | ||
1603 | +#include <openssl/bn.h> | ||
1604 | + | ||
1605 | +#include <string.h> | ||
1606 | + | ||
1607 | +#include "xmalloc.h" | ||
1608 | +#include "sshbuf.h" | ||
1609 | +#include "ssh2.h" | ||
1610 | +#include "sshkey.h" | ||
1611 | +#include "cipher.h" | ||
1612 | +#include "kex.h" | ||
1613 | +#include "log.h" | ||
1614 | +#include "packet.h" | ||
1615 | +#include "dh.h" | ||
1616 | +#include "digest.h" | ||
1617 | +#include "ssherr.h" | ||
1618 | + | ||
1619 | +#include "ssh-gss.h" | ||
1620 | + | ||
1621 | +int | ||
1622 | +kexgss_client(struct ssh *ssh) | ||
1623 | +{ | ||
1624 | + struct kex *kex = ssh->kex; | ||
1625 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER, | ||
1626 | + recv_tok = GSS_C_EMPTY_BUFFER, | ||
1627 | + gssbuf, msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr; | ||
1628 | + Gssctxt *ctxt; | ||
1629 | + OM_uint32 maj_status, min_status, ret_flags; | ||
1630 | + struct sshbuf *server_blob = NULL; | ||
1631 | + struct sshbuf *shared_secret = NULL; | ||
1632 | + struct sshbuf *server_host_key_blob = NULL; | ||
1633 | + struct sshbuf *empty = NULL; | ||
1634 | + u_char *msg; | ||
1635 | + int type = 0; | ||
1636 | + int first = 1; | ||
1637 | + u_char hash[SSH_DIGEST_MAX_LENGTH]; | ||
1638 | + size_t hashlen; | ||
1639 | + u_char c; | ||
1640 | + int r; | ||
1641 | + | ||
1642 | + /* Initialise our GSSAPI world */ | ||
1643 | + ssh_gssapi_build_ctx(&ctxt); | ||
1644 | + if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type) | ||
1645 | + == GSS_C_NO_OID) | ||
1646 | + fatal("Couldn't identify host exchange"); | ||
1647 | + | ||
1648 | + if (ssh_gssapi_import_name(ctxt, kex->gss_host)) | ||
1649 | + fatal("Couldn't import hostname"); | ||
1650 | + | ||
1651 | + if (kex->gss_client && | ||
1652 | + ssh_gssapi_client_identity(ctxt, kex->gss_client)) | ||
1653 | + fatal("Couldn't acquire client credentials"); | ||
1654 | + | ||
1655 | + /* Step 1 */ | ||
1656 | + switch (kex->kex_type) { | ||
1657 | + case KEX_GSS_GRP1_SHA1: | ||
1658 | + case KEX_GSS_GRP14_SHA1: | ||
1659 | + case KEX_GSS_GRP14_SHA256: | ||
1660 | + case KEX_GSS_GRP16_SHA512: | ||
1661 | + r = kex_dh_keypair(kex); | ||
1662 | + break; | ||
1663 | + case KEX_GSS_NISTP256_SHA256: | ||
1664 | + r = kex_ecdh_keypair(kex); | ||
1665 | + break; | ||
1666 | + case KEX_GSS_C25519_SHA256: | ||
1667 | + r = kex_c25519_keypair(kex); | ||
1668 | + break; | ||
1669 | + default: | ||
1670 | + fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type); | ||
1671 | + } | ||
1672 | + if (r != 0) | ||
1673 | + return r; | ||
1674 | + | ||
1675 | + token_ptr = GSS_C_NO_BUFFER; | ||
1676 | + | ||
1677 | + do { | ||
1678 | + debug("Calling gss_init_sec_context"); | ||
1679 | + | ||
1680 | + maj_status = ssh_gssapi_init_ctx(ctxt, | ||
1681 | + kex->gss_deleg_creds, token_ptr, &send_tok, | ||
1682 | + &ret_flags); | ||
1683 | + | ||
1684 | + if (GSS_ERROR(maj_status)) { | ||
1685 | + /* XXX Useles code: Missing send? */ | ||
1686 | + if (send_tok.length != 0) { | ||
1687 | + if ((r = sshpkt_start(ssh, | ||
1688 | + SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
1689 | + (r = sshpkt_put_string(ssh, send_tok.value, | ||
1690 | + send_tok.length)) != 0) | ||
1691 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
1692 | + } | ||
1693 | + fatal("gss_init_context failed"); | ||
1694 | + } | ||
1695 | + | ||
1696 | + /* If we've got an old receive buffer get rid of it */ | ||
1697 | + if (token_ptr != GSS_C_NO_BUFFER) | ||
1698 | + gss_release_buffer(&min_status, &recv_tok); | ||
1699 | + | ||
1700 | + if (maj_status == GSS_S_COMPLETE) { | ||
1701 | + /* If mutual state flag is not true, kex fails */ | ||
1702 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
1703 | + fatal("Mutual authentication failed"); | ||
1704 | + | ||
1705 | + /* If integ avail flag is not true kex fails */ | ||
1706 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
1707 | + fatal("Integrity check failed"); | ||
1708 | + } | ||
1709 | + | ||
1710 | + /* | ||
1711 | + * If we have data to send, then the last message that we | ||
1712 | + * received cannot have been a 'complete'. | ||
1713 | + */ | ||
1714 | + if (send_tok.length != 0) { | ||
1715 | + if (first) { | ||
1716 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 || | ||
1717 | + (r = sshpkt_put_string(ssh, send_tok.value, | ||
1718 | + send_tok.length)) != 0 || | ||
1719 | + (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0) | ||
1720 | + fatal("failed to construct packet: %s", ssh_err(r)); | ||
1721 | + first = 0; | ||
1722 | + } else { | ||
1723 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
1724 | + (r = sshpkt_put_string(ssh, send_tok.value, | ||
1725 | + send_tok.length)) != 0) | ||
1726 | + fatal("failed to construct packet: %s", ssh_err(r)); | ||
1727 | + } | ||
1728 | + if ((r = sshpkt_send(ssh)) != 0) | ||
1729 | + fatal("failed to send packet: %s", ssh_err(r)); | ||
1730 | + gss_release_buffer(&min_status, &send_tok); | ||
1731 | + | ||
1732 | + /* If we've sent them data, they should reply */ | ||
1733 | + do { | ||
1734 | + type = ssh_packet_read(ssh); | ||
1735 | + if (type == SSH2_MSG_KEXGSS_HOSTKEY) { | ||
1736 | + debug("Received KEXGSS_HOSTKEY"); | ||
1737 | + if (server_host_key_blob) | ||
1738 | + fatal("Server host key received more than once"); | ||
1739 | + if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0) | ||
1740 | + fatal("Failed to read server host key: %s", ssh_err(r)); | ||
1741 | + } | ||
1742 | + } while (type == SSH2_MSG_KEXGSS_HOSTKEY); | ||
1743 | + | ||
1744 | + switch (type) { | ||
1745 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
1746 | + debug("Received GSSAPI_CONTINUE"); | ||
1747 | + if (maj_status == GSS_S_COMPLETE) | ||
1748 | + fatal("GSSAPI Continue received from server when complete"); | ||
1749 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
1750 | + &recv_tok)) != 0 || | ||
1751 | + (r = sshpkt_get_end(ssh)) != 0) | ||
1752 | + fatal("Failed to read token: %s", ssh_err(r)); | ||
1753 | + break; | ||
1754 | + case SSH2_MSG_KEXGSS_COMPLETE: | ||
1755 | + debug("Received GSSAPI_COMPLETE"); | ||
1756 | + if (msg_tok.value != NULL) | ||
1757 | + fatal("Received GSSAPI_COMPLETE twice?"); | ||
1758 | + if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 || | ||
1759 | + (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
1760 | + &msg_tok)) != 0) | ||
1761 | + fatal("Failed to read message: %s", ssh_err(r)); | ||
1762 | + | ||
1763 | + /* Is there a token included? */ | ||
1764 | + if ((r = sshpkt_get_u8(ssh, &c)) != 0) | ||
1765 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
1766 | + if (c) { | ||
1767 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc( | ||
1768 | + ssh, &recv_tok)) != 0) | ||
1769 | + fatal("Failed to read token: %s", ssh_err(r)); | ||
1770 | + /* If we're already complete - protocol error */ | ||
1771 | + if (maj_status == GSS_S_COMPLETE) | ||
1772 | + sshpkt_disconnect(ssh, "Protocol error: received token when complete"); | ||
1773 | + } else { | ||
1774 | + /* No token included */ | ||
1775 | + if (maj_status != GSS_S_COMPLETE) | ||
1776 | + sshpkt_disconnect(ssh, "Protocol error: did not receive final token"); | ||
1777 | + } | ||
1778 | + if ((r = sshpkt_get_end(ssh)) != 0) { | ||
1779 | + fatal("Expecting end of packet."); | ||
1780 | + } | ||
1781 | + break; | ||
1782 | + case SSH2_MSG_KEXGSS_ERROR: | ||
1783 | + debug("Received Error"); | ||
1784 | + if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 || | ||
1785 | + (r = sshpkt_get_u32(ssh, &min_status)) != 0 || | ||
1786 | + (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 || | ||
1787 | + (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */ | ||
1788 | + (r = sshpkt_get_end(ssh)) != 0) | ||
1789 | + fatal("sshpkt_get failed: %s", ssh_err(r)); | ||
1790 | + fatal("GSSAPI Error: \n%.400s", msg); | ||
1791 | + default: | ||
1792 | + sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d", | ||
1793 | + type); | ||
1794 | + } | ||
1795 | + token_ptr = &recv_tok; | ||
1796 | + } else { | ||
1797 | + /* No data, and not complete */ | ||
1798 | + if (maj_status != GSS_S_COMPLETE) | ||
1799 | + fatal("Not complete, and no token output"); | ||
1800 | + } | ||
1801 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
1802 | + | ||
1803 | + /* | ||
1804 | + * We _must_ have received a COMPLETE message in reply from the | ||
1805 | + * server, which will have set server_blob and msg_tok | ||
1806 | + */ | ||
1807 | + | ||
1808 | + if (type != SSH2_MSG_KEXGSS_COMPLETE) | ||
1809 | + fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it"); | ||
1810 | + | ||
1811 | + /* compute shared secret */ | ||
1812 | + switch (kex->kex_type) { | ||
1813 | + case KEX_GSS_GRP1_SHA1: | ||
1814 | + case KEX_GSS_GRP14_SHA1: | ||
1815 | + case KEX_GSS_GRP14_SHA256: | ||
1816 | + case KEX_GSS_GRP16_SHA512: | ||
1817 | + r = kex_dh_dec(kex, server_blob, &shared_secret); | ||
1818 | + break; | ||
1819 | + case KEX_GSS_C25519_SHA256: | ||
1820 | + if (sshbuf_ptr(server_blob)[sshbuf_len(server_blob)] & 0x80) | ||
1821 | + fatal("The received key has MSB of last octet set!"); | ||
1822 | + r = kex_c25519_dec(kex, server_blob, &shared_secret); | ||
1823 | + break; | ||
1824 | + case KEX_GSS_NISTP256_SHA256: | ||
1825 | + if (sshbuf_len(server_blob) != 65) | ||
1826 | + fatal("The received NIST-P256 key did not match" | ||
1827 | + "expected length (expected 65, got %zu)", sshbuf_len(server_blob)); | ||
1828 | + | ||
1829 | + if (sshbuf_ptr(server_blob)[0] != POINT_CONVERSION_UNCOMPRESSED) | ||
1830 | + fatal("The received NIST-P256 key does not have first octet 0x04"); | ||
1831 | + | ||
1832 | + r = kex_ecdh_dec(kex, server_blob, &shared_secret); | ||
1833 | + break; | ||
1834 | + default: | ||
1835 | + r = SSH_ERR_INVALID_ARGUMENT; | ||
1836 | + break; | ||
1837 | + } | ||
1838 | + if (r != 0) | ||
1839 | + goto out; | ||
1840 | + | ||
1841 | + if ((empty = sshbuf_new()) == NULL) { | ||
1842 | + r = SSH_ERR_ALLOC_FAIL; | ||
1843 | + goto out; | ||
1844 | + } | ||
1845 | + | ||
1846 | + hashlen = sizeof(hash); | ||
1847 | + if ((r = kex_gen_hash( | ||
1848 | + kex->hash_alg, | ||
1849 | + kex->client_version, | ||
1850 | + kex->server_version, | ||
1851 | + kex->my, | ||
1852 | + kex->peer, | ||
1853 | + (server_host_key_blob ? server_host_key_blob : empty), | ||
1854 | + kex->client_pub, | ||
1855 | + server_blob, | ||
1856 | + shared_secret, | ||
1857 | + hash, &hashlen)) != 0) | ||
1858 | + fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type); | ||
1859 | + | ||
1860 | + gssbuf.value = hash; | ||
1861 | + gssbuf.length = hashlen; | ||
1862 | + | ||
1863 | + /* Verify that the hash matches the MIC we just got. */ | ||
1864 | + if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok))) | ||
1865 | + sshpkt_disconnect(ssh, "Hash's MIC didn't verify"); | ||
1866 | + | ||
1867 | + gss_release_buffer(&min_status, &msg_tok); | ||
1868 | + | ||
1869 | + if (kex->gss_deleg_creds) | ||
1870 | + ssh_gssapi_credentials_updated(ctxt); | ||
1871 | + | ||
1872 | + if (gss_kex_context == NULL) | ||
1873 | + gss_kex_context = ctxt; | ||
1874 | + else | ||
1875 | + ssh_gssapi_delete_ctx(&ctxt); | ||
1876 | + | ||
1877 | + if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) | ||
1878 | + r = kex_send_newkeys(ssh); | ||
1879 | + | ||
1880 | +out: | ||
1881 | + explicit_bzero(hash, sizeof(hash)); | ||
1882 | + explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key)); | ||
1883 | + sshbuf_free(empty); | ||
1884 | + sshbuf_free(server_host_key_blob); | ||
1885 | + sshbuf_free(server_blob); | ||
1886 | + sshbuf_free(shared_secret); | ||
1887 | + sshbuf_free(kex->client_pub); | ||
1888 | + kex->client_pub = NULL; | ||
1889 | + return r; | ||
1890 | +} | ||
1891 | + | ||
1892 | +int | ||
1893 | +kexgssgex_client(struct ssh *ssh) | ||
1894 | +{ | ||
1895 | + struct kex *kex = ssh->kex; | ||
1896 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER, | ||
1897 | + recv_tok = GSS_C_EMPTY_BUFFER, gssbuf, | ||
1898 | + msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr; | ||
1899 | + Gssctxt *ctxt; | ||
1900 | + OM_uint32 maj_status, min_status, ret_flags; | ||
1901 | + struct sshbuf *shared_secret = NULL; | ||
1902 | + BIGNUM *p = NULL; | ||
1903 | + BIGNUM *g = NULL; | ||
1904 | + struct sshbuf *buf = NULL; | ||
1905 | + struct sshbuf *server_host_key_blob = NULL; | ||
1906 | + struct sshbuf *server_blob = NULL; | ||
1907 | + BIGNUM *dh_server_pub = NULL; | ||
1908 | + u_char *msg; | ||
1909 | + int type = 0; | ||
1910 | + int first = 1; | ||
1911 | + u_char hash[SSH_DIGEST_MAX_LENGTH]; | ||
1912 | + size_t hashlen; | ||
1913 | + const BIGNUM *pub_key, *dh_p, *dh_g; | ||
1914 | + int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX; | ||
1915 | + struct sshbuf *empty = NULL; | ||
1916 | + u_char c; | ||
1917 | + int r; | ||
1918 | + | ||
1919 | + /* Initialise our GSSAPI world */ | ||
1920 | + ssh_gssapi_build_ctx(&ctxt); | ||
1921 | + if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type) | ||
1922 | + == GSS_C_NO_OID) | ||
1923 | + fatal("Couldn't identify host exchange"); | ||
1924 | + | ||
1925 | + if (ssh_gssapi_import_name(ctxt, kex->gss_host)) | ||
1926 | + fatal("Couldn't import hostname"); | ||
1927 | + | ||
1928 | + if (kex->gss_client && | ||
1929 | + ssh_gssapi_client_identity(ctxt, kex->gss_client)) | ||
1930 | + fatal("Couldn't acquire client credentials"); | ||
1931 | + | ||
1932 | + debug("Doing group exchange"); | ||
1933 | + nbits = dh_estimate(kex->dh_need * 8); | ||
1934 | + | ||
1935 | + kex->min = DH_GRP_MIN; | ||
1936 | + kex->max = DH_GRP_MAX; | ||
1937 | + kex->nbits = nbits; | ||
1938 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUPREQ)) != 0 || | ||
1939 | + (r = sshpkt_put_u32(ssh, min)) != 0 || | ||
1940 | + (r = sshpkt_put_u32(ssh, nbits)) != 0 || | ||
1941 | + (r = sshpkt_put_u32(ssh, max)) != 0 || | ||
1942 | + (r = sshpkt_send(ssh)) != 0) | ||
1943 | + fatal("Failed to construct a packet: %s", ssh_err(r)); | ||
1944 | + | ||
1945 | + if ((r = ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0) | ||
1946 | + fatal("Error: %s", ssh_err(r)); | ||
1947 | + | ||
1948 | + if ((r = sshpkt_get_bignum2(ssh, &p)) != 0 || | ||
1949 | + (r = sshpkt_get_bignum2(ssh, &g)) != 0 || | ||
1950 | + (r = sshpkt_get_end(ssh)) != 0) | ||
1951 | + fatal("shpkt_get_bignum2 failed: %s", ssh_err(r)); | ||
1952 | + | ||
1953 | + if (BN_num_bits(p) < min || BN_num_bits(p) > max) | ||
1954 | + fatal("GSSGRP_GEX group out of range: %d !< %d !< %d", | ||
1955 | + min, BN_num_bits(p), max); | ||
1956 | + | ||
1957 | + if ((kex->dh = dh_new_group(g, p)) == NULL) | ||
1958 | + fatal("dn_new_group() failed"); | ||
1959 | + p = g = NULL; /* belong to kex->dh now */ | ||
1960 | + | ||
1961 | + if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0) | ||
1962 | + goto out; | ||
1963 | + DH_get0_key(kex->dh, &pub_key, NULL); | ||
1964 | + | ||
1965 | + token_ptr = GSS_C_NO_BUFFER; | ||
1966 | + | ||
1967 | + do { | ||
1968 | + /* Step 2 - call GSS_Init_sec_context() */ | ||
1969 | + debug("Calling gss_init_sec_context"); | ||
1970 | + | ||
1971 | + maj_status = ssh_gssapi_init_ctx(ctxt, | ||
1972 | + kex->gss_deleg_creds, token_ptr, &send_tok, | ||
1973 | + &ret_flags); | ||
1974 | + | ||
1975 | + if (GSS_ERROR(maj_status)) { | ||
1976 | + /* XXX Useles code: Missing send? */ | ||
1977 | + if (send_tok.length != 0) { | ||
1978 | + if ((r = sshpkt_start(ssh, | ||
1979 | + SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
1980 | + (r = sshpkt_put_string(ssh, send_tok.value, | ||
1981 | + send_tok.length)) != 0) | ||
1982 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
1983 | + } | ||
1984 | + fatal("gss_init_context failed"); | ||
1985 | + } | ||
1986 | + | ||
1987 | + /* If we've got an old receive buffer get rid of it */ | ||
1988 | + if (token_ptr != GSS_C_NO_BUFFER) | ||
1989 | + gss_release_buffer(&min_status, &recv_tok); | ||
1990 | + | ||
1991 | + if (maj_status == GSS_S_COMPLETE) { | ||
1992 | + /* If mutual state flag is not true, kex fails */ | ||
1993 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
1994 | + fatal("Mutual authentication failed"); | ||
1995 | + | ||
1996 | + /* If integ avail flag is not true kex fails */ | ||
1997 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
1998 | + fatal("Integrity check failed"); | ||
1999 | + } | ||
2000 | + | ||
2001 | + /* | ||
2002 | + * If we have data to send, then the last message that we | ||
2003 | + * received cannot have been a 'complete'. | ||
2004 | + */ | ||
2005 | + if (send_tok.length != 0) { | ||
2006 | + if (first) { | ||
2007 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 || | ||
2008 | + (r = sshpkt_put_string(ssh, send_tok.value, | ||
2009 | + send_tok.length)) != 0 || | ||
2010 | + (r = sshpkt_put_bignum2(ssh, pub_key)) != 0) | ||
2011 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2012 | + first = 0; | ||
2013 | + } else { | ||
2014 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
2015 | + (r = sshpkt_put_string(ssh,send_tok.value, | ||
2016 | + send_tok.length)) != 0) | ||
2017 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2018 | + } | ||
2019 | + if ((r = sshpkt_send(ssh)) != 0) | ||
2020 | + fatal("sshpkt_send failed: %s", ssh_err(r)); | ||
2021 | + gss_release_buffer(&min_status, &send_tok); | ||
2022 | + | ||
2023 | + /* If we've sent them data, they should reply */ | ||
2024 | + do { | ||
2025 | + type = ssh_packet_read(ssh); | ||
2026 | + if (type == SSH2_MSG_KEXGSS_HOSTKEY) { | ||
2027 | + debug("Received KEXGSS_HOSTKEY"); | ||
2028 | + if (server_host_key_blob) | ||
2029 | + fatal("Server host key received more than once"); | ||
2030 | + if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0) | ||
2031 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2032 | + } | ||
2033 | + } while (type == SSH2_MSG_KEXGSS_HOSTKEY); | ||
2034 | + | ||
2035 | + switch (type) { | ||
2036 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
2037 | + debug("Received GSSAPI_CONTINUE"); | ||
2038 | + if (maj_status == GSS_S_COMPLETE) | ||
2039 | + fatal("GSSAPI Continue received from server when complete"); | ||
2040 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
2041 | + &recv_tok)) != 0 || | ||
2042 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2043 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2044 | + break; | ||
2045 | + case SSH2_MSG_KEXGSS_COMPLETE: | ||
2046 | + debug("Received GSSAPI_COMPLETE"); | ||
2047 | + if (msg_tok.value != NULL) | ||
2048 | + fatal("Received GSSAPI_COMPLETE twice?"); | ||
2049 | + if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 || | ||
2050 | + (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
2051 | + &msg_tok)) != 0) | ||
2052 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2053 | + | ||
2054 | + /* Is there a token included? */ | ||
2055 | + if ((r = sshpkt_get_u8(ssh, &c)) != 0) | ||
2056 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2057 | + if (c) { | ||
2058 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc( | ||
2059 | + ssh, &recv_tok)) != 0 || | ||
2060 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2061 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2062 | + /* If we're already complete - protocol error */ | ||
2063 | + if (maj_status == GSS_S_COMPLETE) | ||
2064 | + sshpkt_disconnect(ssh, "Protocol error: received token when complete"); | ||
2065 | + } else { | ||
2066 | + /* No token included */ | ||
2067 | + if (maj_status != GSS_S_COMPLETE) | ||
2068 | + sshpkt_disconnect(ssh, "Protocol error: did not receive final token"); | ||
2069 | + } | ||
2070 | + break; | ||
2071 | + case SSH2_MSG_KEXGSS_ERROR: | ||
2072 | + debug("Received Error"); | ||
2073 | + if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 || | ||
2074 | + (r = sshpkt_get_u32(ssh, &min_status)) != 0 || | ||
2075 | + (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 || | ||
2076 | + (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */ | ||
2077 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2078 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2079 | + fatal("GSSAPI Error: \n%.400s", msg); | ||
2080 | + default: | ||
2081 | + sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d", | ||
2082 | + type); | ||
2083 | + } | ||
2084 | + token_ptr = &recv_tok; | ||
2085 | + } else { | ||
2086 | + /* No data, and not complete */ | ||
2087 | + if (maj_status != GSS_S_COMPLETE) | ||
2088 | + fatal("Not complete, and no token output"); | ||
2089 | + } | ||
2090 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
2091 | + | ||
2092 | + /* | ||
2093 | + * We _must_ have received a COMPLETE message in reply from the | ||
2094 | + * server, which will have set dh_server_pub and msg_tok | ||
2095 | + */ | ||
2096 | + | ||
2097 | + if (type != SSH2_MSG_KEXGSS_COMPLETE) | ||
2098 | + fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it"); | ||
2099 | + | ||
2100 | + /* 7. C verifies that the key Q_S is valid */ | ||
2101 | + /* 8. C computes shared secret */ | ||
2102 | + if ((buf = sshbuf_new()) == NULL || | ||
2103 | + (r = sshbuf_put_stringb(buf, server_blob)) != 0 || | ||
2104 | + (r = sshbuf_get_bignum2(buf, &dh_server_pub)) != 0) | ||
2105 | + goto out; | ||
2106 | + sshbuf_free(buf); | ||
2107 | + buf = NULL; | ||
2108 | + | ||
2109 | + if ((shared_secret = sshbuf_new()) == NULL) { | ||
2110 | + r = SSH_ERR_ALLOC_FAIL; | ||
2111 | + goto out; | ||
2112 | + } | ||
2113 | + | ||
2114 | + if ((r = kex_dh_compute_key(kex, dh_server_pub, shared_secret)) != 0) | ||
2115 | + goto out; | ||
2116 | + if ((empty = sshbuf_new()) == NULL) { | ||
2117 | + r = SSH_ERR_ALLOC_FAIL; | ||
2118 | + goto out; | ||
2119 | + } | ||
2120 | + | ||
2121 | + DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g); | ||
2122 | + hashlen = sizeof(hash); | ||
2123 | + if ((r = kexgex_hash( | ||
2124 | + kex->hash_alg, | ||
2125 | + kex->client_version, | ||
2126 | + kex->server_version, | ||
2127 | + kex->my, | ||
2128 | + kex->peer, | ||
2129 | + (server_host_key_blob ? server_host_key_blob : empty), | ||
2130 | + kex->min, kex->nbits, kex->max, | ||
2131 | + dh_p, dh_g, | ||
2132 | + pub_key, | ||
2133 | + dh_server_pub, | ||
2134 | + sshbuf_ptr(shared_secret), sshbuf_len(shared_secret), | ||
2135 | + hash, &hashlen)) != 0) | ||
2136 | + fatal("Failed to calculate hash: %s", ssh_err(r)); | ||
2137 | + | ||
2138 | + gssbuf.value = hash; | ||
2139 | + gssbuf.length = hashlen; | ||
2140 | + | ||
2141 | + /* Verify that the hash matches the MIC we just got. */ | ||
2142 | + if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok))) | ||
2143 | + sshpkt_disconnect(ssh, "Hash's MIC didn't verify"); | ||
2144 | + | ||
2145 | + gss_release_buffer(&min_status, &msg_tok); | ||
2146 | + | ||
2147 | + /* save session id */ | ||
2148 | + if (kex->session_id == NULL) { | ||
2149 | + kex->session_id_len = hashlen; | ||
2150 | + kex->session_id = xmalloc(kex->session_id_len); | ||
2151 | + memcpy(kex->session_id, hash, kex->session_id_len); | ||
2152 | + } | ||
2153 | + | ||
2154 | + if (kex->gss_deleg_creds) | ||
2155 | + ssh_gssapi_credentials_updated(ctxt); | ||
2156 | + | ||
2157 | + if (gss_kex_context == NULL) | ||
2158 | + gss_kex_context = ctxt; | ||
2159 | + else | ||
2160 | + ssh_gssapi_delete_ctx(&ctxt); | ||
2161 | + | ||
2162 | + /* Finally derive the keys and send them */ | ||
2163 | + if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) | ||
2164 | + r = kex_send_newkeys(ssh); | ||
2165 | +out: | ||
2166 | + sshbuf_free(buf); | ||
2167 | + sshbuf_free(server_blob); | ||
2168 | + sshbuf_free(empty); | ||
2169 | + explicit_bzero(hash, sizeof(hash)); | ||
2170 | + DH_free(kex->dh); | ||
2171 | + kex->dh = NULL; | ||
2172 | + BN_clear_free(dh_server_pub); | ||
2173 | + sshbuf_free(shared_secret); | ||
2174 | + sshbuf_free(server_host_key_blob); | ||
2175 | + return r; | ||
2176 | +} | ||
2177 | +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */ | ||
2178 | diff --git a/kexgsss.c b/kexgsss.c | ||
2179 | new file mode 100644 | ||
2180 | index 000000000..60bc02deb | ||
2181 | --- /dev/null | ||
2182 | +++ b/kexgsss.c | ||
2183 | @@ -0,0 +1,474 @@ | ||
2184 | +/* | ||
2185 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
2186 | + * | ||
2187 | + * Redistribution and use in source and binary forms, with or without | ||
2188 | + * modification, are permitted provided that the following conditions | ||
2189 | + * are met: | ||
2190 | + * 1. Redistributions of source code must retain the above copyright | ||
2191 | + * notice, this list of conditions and the following disclaimer. | ||
2192 | + * 2. Redistributions in binary form must reproduce the above copyright | ||
2193 | + * notice, this list of conditions and the following disclaimer in the | ||
2194 | + * documentation and/or other materials provided with the distribution. | ||
2195 | + * | ||
2196 | + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR | ||
2197 | + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
2198 | + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
2199 | + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
2200 | + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
2201 | + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
2202 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
2203 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
2204 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
2205 | + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
2206 | + */ | ||
2207 | + | ||
2208 | +#include "includes.h" | ||
2209 | + | ||
2210 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
2211 | + | ||
2212 | +#include <string.h> | ||
2213 | + | ||
2214 | +#include <openssl/crypto.h> | ||
2215 | +#include <openssl/bn.h> | ||
2216 | + | ||
2217 | +#include "xmalloc.h" | ||
2218 | +#include "sshbuf.h" | ||
2219 | +#include "ssh2.h" | ||
2220 | +#include "sshkey.h" | ||
2221 | +#include "cipher.h" | ||
2222 | +#include "kex.h" | ||
2223 | +#include "log.h" | ||
2224 | +#include "packet.h" | ||
2225 | +#include "dh.h" | ||
2226 | +#include "ssh-gss.h" | ||
2227 | +#include "monitor_wrap.h" | ||
2228 | +#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */ | ||
2229 | +#include "servconf.h" | ||
2230 | +#include "ssh-gss.h" | ||
2231 | +#include "digest.h" | ||
2232 | +#include "ssherr.h" | ||
2233 | + | ||
2234 | +extern ServerOptions options; | ||
2235 | + | ||
2236 | +int | ||
2237 | +kexgss_server(struct ssh *ssh) | ||
2238 | +{ | ||
2239 | + struct kex *kex = ssh->kex; | ||
2240 | + OM_uint32 maj_status, min_status; | ||
2241 | + | ||
2242 | + /* | ||
2243 | + * Some GSSAPI implementations use the input value of ret_flags (an | ||
2244 | + * output variable) as a means of triggering mechanism specific | ||
2245 | + * features. Initializing it to zero avoids inadvertently | ||
2246 | + * activating this non-standard behaviour. | ||
2247 | + */ | ||
2248 | + | ||
2249 | + OM_uint32 ret_flags = 0; | ||
2250 | + gss_buffer_desc gssbuf, recv_tok, msg_tok; | ||
2251 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; | ||
2252 | + Gssctxt *ctxt = NULL; | ||
2253 | + struct sshbuf *shared_secret = NULL; | ||
2254 | + struct sshbuf *client_pubkey = NULL; | ||
2255 | + struct sshbuf *server_pubkey = NULL; | ||
2256 | + struct sshbuf *empty = sshbuf_new(); | ||
2257 | + int type = 0; | ||
2258 | + gss_OID oid; | ||
2259 | + char *mechs; | ||
2260 | + u_char hash[SSH_DIGEST_MAX_LENGTH]; | ||
2261 | + size_t hashlen; | ||
2262 | + int r; | ||
2263 | + | ||
2264 | + /* Initialise GSSAPI */ | ||
2265 | + | ||
2266 | + /* If we're rekeying, privsep means that some of the private structures | ||
2267 | + * in the GSSAPI code are no longer available. This kludges them back | ||
2268 | + * into life | ||
2269 | + */ | ||
2270 | + if (!ssh_gssapi_oid_table_ok()) { | ||
2271 | + mechs = ssh_gssapi_server_mechanisms(); | ||
2272 | + free(mechs); | ||
2273 | + } | ||
2274 | + | ||
2275 | + debug2("%s: Identifying %s", __func__, kex->name); | ||
2276 | + oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type); | ||
2277 | + if (oid == GSS_C_NO_OID) | ||
2278 | + fatal("Unknown gssapi mechanism"); | ||
2279 | + | ||
2280 | + debug2("%s: Acquiring credentials", __func__); | ||
2281 | + | ||
2282 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid)))) | ||
2283 | + fatal("Unable to acquire credentials for the server"); | ||
2284 | + | ||
2285 | + do { | ||
2286 | + debug("Wait SSH2_MSG_KEXGSS_INIT"); | ||
2287 | + type = ssh_packet_read(ssh); | ||
2288 | + switch(type) { | ||
2289 | + case SSH2_MSG_KEXGSS_INIT: | ||
2290 | + if (client_pubkey != NULL) | ||
2291 | + fatal("Received KEXGSS_INIT after initialising"); | ||
2292 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
2293 | + &recv_tok)) != 0 || | ||
2294 | + (r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 || | ||
2295 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2296 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2297 | + | ||
2298 | + switch (kex->kex_type) { | ||
2299 | + case KEX_GSS_GRP1_SHA1: | ||
2300 | + case KEX_GSS_GRP14_SHA1: | ||
2301 | + case KEX_GSS_GRP14_SHA256: | ||
2302 | + case KEX_GSS_GRP16_SHA512: | ||
2303 | + r = kex_dh_enc(kex, client_pubkey, &server_pubkey, | ||
2304 | + &shared_secret); | ||
2305 | + break; | ||
2306 | + case KEX_GSS_NISTP256_SHA256: | ||
2307 | + r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey, | ||
2308 | + &shared_secret); | ||
2309 | + break; | ||
2310 | + case KEX_GSS_C25519_SHA256: | ||
2311 | + r = kex_c25519_enc(kex, client_pubkey, &server_pubkey, | ||
2312 | + &shared_secret); | ||
2313 | + break; | ||
2314 | + default: | ||
2315 | + fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type); | ||
2316 | + } | ||
2317 | + if (r != 0) | ||
2318 | + goto out; | ||
2319 | + | ||
2320 | + /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */ | ||
2321 | + break; | ||
2322 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
2323 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
2324 | + &recv_tok)) != 0 || | ||
2325 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2326 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2327 | + break; | ||
2328 | + default: | ||
2329 | + sshpkt_disconnect(ssh, | ||
2330 | + "Protocol error: didn't expect packet type %d", | ||
2331 | + type); | ||
2332 | + } | ||
2333 | + | ||
2334 | + maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, | ||
2335 | + &send_tok, &ret_flags)); | ||
2336 | + | ||
2337 | + gss_release_buffer(&min_status, &recv_tok); | ||
2338 | + | ||
2339 | + if (maj_status != GSS_S_COMPLETE && send_tok.length == 0) | ||
2340 | + fatal("Zero length token output when incomplete"); | ||
2341 | + | ||
2342 | + if (client_pubkey == NULL) | ||
2343 | + fatal("No client public key"); | ||
2344 | + | ||
2345 | + if (maj_status & GSS_S_CONTINUE_NEEDED) { | ||
2346 | + debug("Sending GSSAPI_CONTINUE"); | ||
2347 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
2348 | + (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 || | ||
2349 | + (r = sshpkt_send(ssh)) != 0) | ||
2350 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2351 | + gss_release_buffer(&min_status, &send_tok); | ||
2352 | + } | ||
2353 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
2354 | + | ||
2355 | + if (GSS_ERROR(maj_status)) { | ||
2356 | + if (send_tok.length > 0) { | ||
2357 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
2358 | + (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 || | ||
2359 | + (r = sshpkt_send(ssh)) != 0) | ||
2360 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2361 | + } | ||
2362 | + fatal("accept_ctx died"); | ||
2363 | + } | ||
2364 | + | ||
2365 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
2366 | + fatal("Mutual Authentication flag wasn't set"); | ||
2367 | + | ||
2368 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
2369 | + fatal("Integrity flag wasn't set"); | ||
2370 | + | ||
2371 | + hashlen = sizeof(hash); | ||
2372 | + if ((r = kex_gen_hash( | ||
2373 | + kex->hash_alg, | ||
2374 | + kex->client_version, | ||
2375 | + kex->server_version, | ||
2376 | + kex->peer, | ||
2377 | + kex->my, | ||
2378 | + empty, | ||
2379 | + client_pubkey, | ||
2380 | + server_pubkey, | ||
2381 | + shared_secret, | ||
2382 | + hash, &hashlen)) != 0) | ||
2383 | + goto out; | ||
2384 | + | ||
2385 | + gssbuf.value = hash; | ||
2386 | + gssbuf.length = hashlen; | ||
2387 | + | ||
2388 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok)))) | ||
2389 | + fatal("Couldn't get MIC"); | ||
2390 | + | ||
2391 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 || | ||
2392 | + (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 || | ||
2393 | + (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0) | ||
2394 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2395 | + | ||
2396 | + if (send_tok.length != 0) { | ||
2397 | + if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */ | ||
2398 | + (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0) | ||
2399 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2400 | + } else { | ||
2401 | + if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */ | ||
2402 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2403 | + } | ||
2404 | + if ((r = sshpkt_send(ssh)) != 0) | ||
2405 | + fatal("sshpkt_send failed: %s", ssh_err(r)); | ||
2406 | + | ||
2407 | + gss_release_buffer(&min_status, &send_tok); | ||
2408 | + gss_release_buffer(&min_status, &msg_tok); | ||
2409 | + | ||
2410 | + if (gss_kex_context == NULL) | ||
2411 | + gss_kex_context = ctxt; | ||
2412 | + else | ||
2413 | + ssh_gssapi_delete_ctx(&ctxt); | ||
2414 | + | ||
2415 | + if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) | ||
2416 | + r = kex_send_newkeys(ssh); | ||
2417 | + | ||
2418 | + /* If this was a rekey, then save out any delegated credentials we | ||
2419 | + * just exchanged. */ | ||
2420 | + if (options.gss_store_rekey) | ||
2421 | + ssh_gssapi_rekey_creds(); | ||
2422 | +out: | ||
2423 | + sshbuf_free(empty); | ||
2424 | + explicit_bzero(hash, sizeof(hash)); | ||
2425 | + sshbuf_free(shared_secret); | ||
2426 | + sshbuf_free(client_pubkey); | ||
2427 | + sshbuf_free(server_pubkey); | ||
2428 | + return r; | ||
2429 | +} | ||
2430 | + | ||
2431 | +int | ||
2432 | +kexgssgex_server(struct ssh *ssh) | ||
2433 | +{ | ||
2434 | + struct kex *kex = ssh->kex; | ||
2435 | + OM_uint32 maj_status, min_status; | ||
2436 | + | ||
2437 | + /* | ||
2438 | + * Some GSSAPI implementations use the input value of ret_flags (an | ||
2439 | + * output variable) as a means of triggering mechanism specific | ||
2440 | + * features. Initializing it to zero avoids inadvertently | ||
2441 | + * activating this non-standard behaviour. | ||
2442 | + */ | ||
2443 | + | ||
2444 | + OM_uint32 ret_flags = 0; | ||
2445 | + gss_buffer_desc gssbuf, recv_tok, msg_tok; | ||
2446 | + gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; | ||
2447 | + Gssctxt *ctxt = NULL; | ||
2448 | + struct sshbuf *shared_secret = NULL; | ||
2449 | + int type = 0; | ||
2450 | + gss_OID oid; | ||
2451 | + char *mechs; | ||
2452 | + u_char hash[SSH_DIGEST_MAX_LENGTH]; | ||
2453 | + size_t hashlen; | ||
2454 | + BIGNUM *dh_client_pub = NULL; | ||
2455 | + const BIGNUM *pub_key, *dh_p, *dh_g; | ||
2456 | + int min = -1, max = -1, nbits = -1; | ||
2457 | + int cmin = -1, cmax = -1; /* client proposal */ | ||
2458 | + struct sshbuf *empty = sshbuf_new(); | ||
2459 | + int r; | ||
2460 | + | ||
2461 | + /* Initialise GSSAPI */ | ||
2462 | + | ||
2463 | + /* If we're rekeying, privsep means that some of the private structures | ||
2464 | + * in the GSSAPI code are no longer available. This kludges them back | ||
2465 | + * into life | ||
2466 | + */ | ||
2467 | + if (!ssh_gssapi_oid_table_ok()) | ||
2468 | + if ((mechs = ssh_gssapi_server_mechanisms())) | ||
2469 | + free(mechs); | ||
2470 | + | ||
2471 | + debug2("%s: Identifying %s", __func__, kex->name); | ||
2472 | + oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type); | ||
2473 | + if (oid == GSS_C_NO_OID) | ||
2474 | + fatal("Unknown gssapi mechanism"); | ||
2475 | + | ||
2476 | + debug2("%s: Acquiring credentials", __func__); | ||
2477 | + | ||
2478 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid)))) | ||
2479 | + fatal("Unable to acquire credentials for the server"); | ||
2480 | + | ||
2481 | + /* 5. S generates an ephemeral key pair (do the allocations early) */ | ||
2482 | + debug("Doing group exchange"); | ||
2483 | + ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUPREQ); | ||
2484 | + /* store client proposal to provide valid signature */ | ||
2485 | + if ((r = sshpkt_get_u32(ssh, &cmin)) != 0 || | ||
2486 | + (r = sshpkt_get_u32(ssh, &nbits)) != 0 || | ||
2487 | + (r = sshpkt_get_u32(ssh, &cmax)) != 0 || | ||
2488 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2489 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2490 | + kex->nbits = nbits; | ||
2491 | + kex->min = cmin; | ||
2492 | + kex->max = cmax; | ||
2493 | + min = MAX(DH_GRP_MIN, cmin); | ||
2494 | + max = MIN(DH_GRP_MAX, cmax); | ||
2495 | + nbits = MAXIMUM(DH_GRP_MIN, nbits); | ||
2496 | + nbits = MINIMUM(DH_GRP_MAX, nbits); | ||
2497 | + if (max < min || nbits < min || max < nbits) | ||
2498 | + fatal("GSS_GEX, bad parameters: %d !< %d !< %d", | ||
2499 | + min, nbits, max); | ||
2500 | + kex->dh = PRIVSEP(choose_dh(min, nbits, max)); | ||
2501 | + if (kex->dh == NULL) { | ||
2502 | + sshpkt_disconnect(ssh, "Protocol error: no matching group found"); | ||
2503 | + fatal("Protocol error: no matching group found"); | ||
2504 | + } | ||
2505 | + | ||
2506 | + DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g); | ||
2507 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0 || | ||
2508 | + (r = sshpkt_put_bignum2(ssh, dh_p)) != 0 || | ||
2509 | + (r = sshpkt_put_bignum2(ssh, dh_g)) != 0 || | ||
2510 | + (r = sshpkt_send(ssh)) != 0) | ||
2511 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2512 | + | ||
2513 | + if ((r = ssh_packet_write_wait(ssh)) != 0) | ||
2514 | + fatal("ssh_packet_write_wait: %s", ssh_err(r)); | ||
2515 | + | ||
2516 | + /* Compute our exchange value in parallel with the client */ | ||
2517 | + if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0) | ||
2518 | + goto out; | ||
2519 | + | ||
2520 | + do { | ||
2521 | + debug("Wait SSH2_MSG_GSSAPI_INIT"); | ||
2522 | + type = ssh_packet_read(ssh); | ||
2523 | + switch(type) { | ||
2524 | + case SSH2_MSG_KEXGSS_INIT: | ||
2525 | + if (dh_client_pub != NULL) | ||
2526 | + fatal("Received KEXGSS_INIT after initialising"); | ||
2527 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
2528 | + &recv_tok)) != 0 || | ||
2529 | + (r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 || | ||
2530 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2531 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2532 | + | ||
2533 | + /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */ | ||
2534 | + break; | ||
2535 | + case SSH2_MSG_KEXGSS_CONTINUE: | ||
2536 | + if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh, | ||
2537 | + &recv_tok)) != 0 || | ||
2538 | + (r = sshpkt_get_end(ssh)) != 0) | ||
2539 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2540 | + break; | ||
2541 | + default: | ||
2542 | + sshpkt_disconnect(ssh, | ||
2543 | + "Protocol error: didn't expect packet type %d", | ||
2544 | + type); | ||
2545 | + } | ||
2546 | + | ||
2547 | + maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, | ||
2548 | + &send_tok, &ret_flags)); | ||
2549 | + | ||
2550 | + gss_release_buffer(&min_status, &recv_tok); | ||
2551 | + | ||
2552 | + if (maj_status != GSS_S_COMPLETE && send_tok.length == 0) | ||
2553 | + fatal("Zero length token output when incomplete"); | ||
2554 | + | ||
2555 | + if (dh_client_pub == NULL) | ||
2556 | + fatal("No client public key"); | ||
2557 | + | ||
2558 | + if (maj_status & GSS_S_CONTINUE_NEEDED) { | ||
2559 | + debug("Sending GSSAPI_CONTINUE"); | ||
2560 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
2561 | + (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 || | ||
2562 | + (r = sshpkt_send(ssh)) != 0) | ||
2563 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2564 | + gss_release_buffer(&min_status, &send_tok); | ||
2565 | + } | ||
2566 | + } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
2567 | + | ||
2568 | + if (GSS_ERROR(maj_status)) { | ||
2569 | + if (send_tok.length > 0) { | ||
2570 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 || | ||
2571 | + (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 || | ||
2572 | + (r = sshpkt_send(ssh)) != 0) | ||
2573 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2574 | + } | ||
2575 | + fatal("accept_ctx died"); | ||
2576 | + } | ||
2577 | + | ||
2578 | + if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
2579 | + fatal("Mutual Authentication flag wasn't set"); | ||
2580 | + | ||
2581 | + if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
2582 | + fatal("Integrity flag wasn't set"); | ||
2583 | + | ||
2584 | + /* calculate shared secret */ | ||
2585 | + if ((shared_secret = sshbuf_new()) == NULL) { | ||
2586 | + r = SSH_ERR_ALLOC_FAIL; | ||
2587 | + goto out; | ||
2588 | + } | ||
2589 | + if ((r = kex_dh_compute_key(kex, dh_client_pub, shared_secret)) != 0) | ||
2590 | + goto out; | ||
2591 | + | ||
2592 | + DH_get0_key(kex->dh, &pub_key, NULL); | ||
2593 | + DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g); | ||
2594 | + hashlen = sizeof(hash); | ||
2595 | + if ((r = kexgex_hash( | ||
2596 | + kex->hash_alg, | ||
2597 | + kex->client_version, | ||
2598 | + kex->server_version, | ||
2599 | + kex->peer, | ||
2600 | + kex->my, | ||
2601 | + empty, | ||
2602 | + cmin, nbits, cmax, | ||
2603 | + dh_p, dh_g, | ||
2604 | + dh_client_pub, | ||
2605 | + pub_key, | ||
2606 | + sshbuf_ptr(shared_secret), sshbuf_len(shared_secret), | ||
2607 | + hash, &hashlen)) != 0) | ||
2608 | + fatal("kexgex_hash failed: %s", ssh_err(r)); | ||
2609 | + | ||
2610 | + gssbuf.value = hash; | ||
2611 | + gssbuf.length = hashlen; | ||
2612 | + | ||
2613 | + if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok)))) | ||
2614 | + fatal("Couldn't get MIC"); | ||
2615 | + | ||
2616 | + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 || | ||
2617 | + (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 || | ||
2618 | + (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0) | ||
2619 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2620 | + | ||
2621 | + if (send_tok.length != 0) { | ||
2622 | + if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */ | ||
2623 | + (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0) | ||
2624 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2625 | + } else { | ||
2626 | + if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */ | ||
2627 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2628 | + } | ||
2629 | + if ((r = sshpkt_send(ssh)) != 0) | ||
2630 | + fatal("sshpkt failed: %s", ssh_err(r)); | ||
2631 | + | ||
2632 | + gss_release_buffer(&min_status, &send_tok); | ||
2633 | + gss_release_buffer(&min_status, &msg_tok); | ||
2634 | + | ||
2635 | + if (gss_kex_context == NULL) | ||
2636 | + gss_kex_context = ctxt; | ||
2637 | + else | ||
2638 | + ssh_gssapi_delete_ctx(&ctxt); | ||
2639 | + | ||
2640 | + /* Finally derive the keys and send them */ | ||
2641 | + if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) | ||
2642 | + r = kex_send_newkeys(ssh); | ||
2643 | + | ||
2644 | + /* If this was a rekey, then save out any delegated credentials we | ||
2645 | + * just exchanged. */ | ||
2646 | + if (options.gss_store_rekey) | ||
2647 | + ssh_gssapi_rekey_creds(); | ||
2648 | +out: | ||
2649 | + sshbuf_free(empty); | ||
2650 | + explicit_bzero(hash, sizeof(hash)); | ||
2651 | + DH_free(kex->dh); | ||
2652 | + kex->dh = NULL; | ||
2653 | + BN_clear_free(dh_client_pub); | ||
2654 | + sshbuf_free(shared_secret); | ||
2655 | + return r; | ||
2656 | +} | ||
2657 | +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */ | ||
2658 | diff --git a/monitor.c b/monitor.c | ||
2659 | index b6e855d5d..5347e900d 100644 | ||
2660 | --- a/monitor.c | ||
2661 | +++ b/monitor.c | ||
2662 | @@ -148,6 +148,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *); | ||
2663 | int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *); | ||
2664 | int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *); | ||
2665 | int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *); | ||
2666 | +int mm_answer_gss_sign(struct ssh *, int, struct sshbuf *); | ||
2667 | +int mm_answer_gss_updatecreds(struct ssh *, int, struct sshbuf *); | ||
2668 | #endif | ||
2669 | |||
2670 | #ifdef SSH_AUDIT_EVENTS | ||
2671 | @@ -220,11 +222,18 @@ struct mon_table mon_dispatch_proto20[] = { | ||
2672 | {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx}, | ||
2673 | {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok}, | ||
2674 | {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic}, | ||
2675 | + {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign}, | ||
2676 | #endif | ||
2677 | {0, 0, NULL} | ||
2678 | }; | ||
2679 | |||
2680 | struct mon_table mon_dispatch_postauth20[] = { | ||
2681 | +#ifdef GSSAPI | ||
2682 | + {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx}, | ||
2683 | + {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx}, | ||
2684 | + {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign}, | ||
2685 | + {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds}, | ||
2686 | +#endif | ||
2687 | #ifdef WITH_OPENSSL | ||
2688 | {MONITOR_REQ_MODULI, 0, mm_answer_moduli}, | ||
2689 | #endif | ||
2690 | @@ -293,6 +302,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor) | ||
2691 | /* Permit requests for moduli and signatures */ | ||
2692 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | ||
2693 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | ||
2694 | +#ifdef GSSAPI | ||
2695 | + /* and for the GSSAPI key exchange */ | ||
2696 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
2697 | +#endif | ||
2698 | |||
2699 | /* The first few requests do not require asynchronous access */ | ||
2700 | while (!authenticated) { | ||
2701 | @@ -406,6 +419,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor) | ||
2702 | monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); | ||
2703 | monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); | ||
2704 | monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); | ||
2705 | +#ifdef GSSAPI | ||
2706 | + /* and for the GSSAPI key exchange */ | ||
2707 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1); | ||
2708 | +#endif | ||
2709 | |||
2710 | if (auth_opts->permit_pty_flag) { | ||
2711 | monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1); | ||
2712 | @@ -1712,6 +1729,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor) | ||
2713 | # ifdef OPENSSL_HAS_ECC | ||
2714 | kex->kex[KEX_ECDH_SHA2] = kex_gen_server; | ||
2715 | # endif | ||
2716 | +# ifdef GSSAPI | ||
2717 | + if (options.gss_keyex) { | ||
2718 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
2719 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
2720 | + kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server; | ||
2721 | + kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server; | ||
2722 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server; | ||
2723 | + kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server; | ||
2724 | + kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server; | ||
2725 | + } | ||
2726 | +# endif | ||
2727 | #endif /* WITH_OPENSSL */ | ||
2728 | kex->kex[KEX_C25519_SHA256] = kex_gen_server; | ||
2729 | kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server; | ||
2730 | @@ -1805,8 +1833,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2731 | u_char *p; | ||
2732 | int r; | ||
2733 | |||
2734 | - if (!options.gss_authentication) | ||
2735 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2736 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2737 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2738 | |||
2739 | if ((r = sshbuf_get_string(m, &p, &len)) != 0) | ||
2740 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2741 | @@ -1838,8 +1866,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2742 | OM_uint32 flags = 0; /* GSI needs this */ | ||
2743 | int r; | ||
2744 | |||
2745 | - if (!options.gss_authentication) | ||
2746 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2747 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2748 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2749 | |||
2750 | if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0) | ||
2751 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2752 | @@ -1859,6 +1887,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2753 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0); | ||
2754 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); | ||
2755 | monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1); | ||
2756 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1); | ||
2757 | } | ||
2758 | return (0); | ||
2759 | } | ||
2760 | @@ -1870,8 +1899,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2761 | OM_uint32 ret; | ||
2762 | int r; | ||
2763 | |||
2764 | - if (!options.gss_authentication) | ||
2765 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2766 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2767 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2768 | |||
2769 | if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 || | ||
2770 | (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0) | ||
2771 | @@ -1897,13 +1926,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2772 | int | ||
2773 | mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2774 | { | ||
2775 | - int r, authenticated; | ||
2776 | + int r, authenticated, kex; | ||
2777 | const char *displayname; | ||
2778 | |||
2779 | - if (!options.gss_authentication) | ||
2780 | - fatal("%s: GSSAPI authentication not enabled", __func__); | ||
2781 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2782 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2783 | |||
2784 | - authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user); | ||
2785 | + if ((r = sshbuf_get_u32(m, &kex)) != 0) | ||
2786 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2787 | + | ||
2788 | + authenticated = authctxt->valid && | ||
2789 | + ssh_gssapi_userok(authctxt->user, authctxt->pw, kex); | ||
2790 | |||
2791 | sshbuf_reset(m); | ||
2792 | if ((r = sshbuf_put_u32(m, authenticated)) != 0) | ||
2793 | @@ -1912,7 +1945,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2794 | debug3("%s: sending result %d", __func__, authenticated); | ||
2795 | mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m); | ||
2796 | |||
2797 | - auth_method = "gssapi-with-mic"; | ||
2798 | + if (kex) { | ||
2799 | + auth_method = "gssapi-keyex"; | ||
2800 | + } else { | ||
2801 | + auth_method = "gssapi-with-mic"; | ||
2802 | + } | ||
2803 | |||
2804 | if ((displayname = ssh_gssapi_displayname()) != NULL) | ||
2805 | auth2_record_info(authctxt, "%s", displayname); | ||
2806 | @@ -1920,5 +1957,85 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) | ||
2807 | /* Monitor loop will terminate if authenticated */ | ||
2808 | return (authenticated); | ||
2809 | } | ||
2810 | + | ||
2811 | +int | ||
2812 | +mm_answer_gss_sign(struct ssh *ssh, int socket, struct sshbuf *m) | ||
2813 | +{ | ||
2814 | + gss_buffer_desc data; | ||
2815 | + gss_buffer_desc hash = GSS_C_EMPTY_BUFFER; | ||
2816 | + OM_uint32 major, minor; | ||
2817 | + size_t len; | ||
2818 | + u_char *p = NULL; | ||
2819 | + int r; | ||
2820 | + | ||
2821 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2822 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2823 | + | ||
2824 | + if ((r = sshbuf_get_string(m, &p, &len)) != 0) | ||
2825 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2826 | + data.value = p; | ||
2827 | + data.length = len; | ||
2828 | + /* Lengths of SHA-1, SHA-256 and SHA-512 hashes that are used */ | ||
2829 | + if (data.length != 20 && data.length != 32 && data.length != 64) | ||
2830 | + fatal("%s: data length incorrect: %d", __func__, | ||
2831 | + (int) data.length); | ||
2832 | + | ||
2833 | + /* Save the session ID on the first time around */ | ||
2834 | + if (session_id2_len == 0) { | ||
2835 | + session_id2_len = data.length; | ||
2836 | + session_id2 = xmalloc(session_id2_len); | ||
2837 | + memcpy(session_id2, data.value, session_id2_len); | ||
2838 | + } | ||
2839 | + major = ssh_gssapi_sign(gsscontext, &data, &hash); | ||
2840 | + | ||
2841 | + free(data.value); | ||
2842 | + | ||
2843 | + sshbuf_reset(m); | ||
2844 | + | ||
2845 | + if ((r = sshbuf_put_u32(m, major)) != 0 || | ||
2846 | + (r = sshbuf_put_string(m, hash.value, hash.length)) != 0) | ||
2847 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2848 | + | ||
2849 | + mm_request_send(socket, MONITOR_ANS_GSSSIGN, m); | ||
2850 | + | ||
2851 | + gss_release_buffer(&minor, &hash); | ||
2852 | + | ||
2853 | + /* Turn on getpwnam permissions */ | ||
2854 | + monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1); | ||
2855 | + | ||
2856 | + /* And credential updating, for when rekeying */ | ||
2857 | + monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1); | ||
2858 | + | ||
2859 | + return (0); | ||
2860 | +} | ||
2861 | + | ||
2862 | +int | ||
2863 | +mm_answer_gss_updatecreds(struct ssh *ssh, int socket, struct sshbuf *m) { | ||
2864 | + ssh_gssapi_ccache store; | ||
2865 | + int r, ok; | ||
2866 | + | ||
2867 | + if (!options.gss_authentication && !options.gss_keyex) | ||
2868 | + fatal("%s: GSSAPI not enabled", __func__); | ||
2869 | + | ||
2870 | + if ((r = sshbuf_get_string(m, (u_char **)&store.filename, NULL)) != 0 || | ||
2871 | + (r = sshbuf_get_string(m, (u_char **)&store.envvar, NULL)) != 0 || | ||
2872 | + (r = sshbuf_get_string(m, (u_char **)&store.envval, NULL)) != 0) | ||
2873 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2874 | + | ||
2875 | + ok = ssh_gssapi_update_creds(&store); | ||
2876 | + | ||
2877 | + free(store.filename); | ||
2878 | + free(store.envvar); | ||
2879 | + free(store.envval); | ||
2880 | + | ||
2881 | + sshbuf_reset(m); | ||
2882 | + if ((r = sshbuf_put_u32(m, ok)) != 0) | ||
2883 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2884 | + | ||
2885 | + mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m); | ||
2886 | + | ||
2887 | + return(0); | ||
2888 | +} | ||
2889 | + | ||
2890 | #endif /* GSSAPI */ | ||
2891 | |||
2892 | diff --git a/monitor.h b/monitor.h | ||
2893 | index 683e5e071..2b1a2d590 100644 | ||
2894 | --- a/monitor.h | ||
2895 | +++ b/monitor.h | ||
2896 | @@ -63,6 +63,8 @@ enum monitor_reqtype { | ||
2897 | MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111, | ||
2898 | MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113, | ||
2899 | |||
2900 | + MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151, | ||
2901 | + MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153, | ||
2902 | }; | ||
2903 | |||
2904 | struct ssh; | ||
2905 | diff --git a/monitor_wrap.c b/monitor_wrap.c | ||
2906 | index 001a8fa1c..6edb509a3 100644 | ||
2907 | --- a/monitor_wrap.c | ||
2908 | +++ b/monitor_wrap.c | ||
2909 | @@ -993,13 +993,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) | ||
2910 | } | ||
2911 | |||
2912 | int | ||
2913 | -mm_ssh_gssapi_userok(char *user) | ||
2914 | +mm_ssh_gssapi_userok(char *user, struct passwd *pw, int kex) | ||
2915 | { | ||
2916 | struct sshbuf *m; | ||
2917 | int r, authenticated = 0; | ||
2918 | |||
2919 | if ((m = sshbuf_new()) == NULL) | ||
2920 | fatal("%s: sshbuf_new failed", __func__); | ||
2921 | + if ((r = sshbuf_put_u32(m, kex)) != 0) | ||
2922 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2923 | |||
2924 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m); | ||
2925 | mm_request_receive_expect(pmonitor->m_recvfd, | ||
2926 | @@ -1012,4 +1014,57 @@ mm_ssh_gssapi_userok(char *user) | ||
2927 | debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not "); | ||
2928 | return (authenticated); | ||
2929 | } | ||
2930 | + | ||
2931 | +OM_uint32 | ||
2932 | +mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash) | ||
2933 | +{ | ||
2934 | + struct sshbuf *m; | ||
2935 | + OM_uint32 major; | ||
2936 | + int r; | ||
2937 | + | ||
2938 | + if ((m = sshbuf_new()) == NULL) | ||
2939 | + fatal("%s: sshbuf_new failed", __func__); | ||
2940 | + if ((r = sshbuf_put_string(m, data->value, data->length)) != 0) | ||
2941 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2942 | + | ||
2943 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, m); | ||
2944 | + mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, m); | ||
2945 | + | ||
2946 | + if ((r = sshbuf_get_u32(m, &major)) != 0 || | ||
2947 | + (r = ssh_gssapi_get_buffer_desc(m, hash)) != 0) | ||
2948 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2949 | + | ||
2950 | + sshbuf_free(m); | ||
2951 | + | ||
2952 | + return (major); | ||
2953 | +} | ||
2954 | + | ||
2955 | +int | ||
2956 | +mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store) | ||
2957 | +{ | ||
2958 | + struct sshbuf *m; | ||
2959 | + int r, ok; | ||
2960 | + | ||
2961 | + if ((m = sshbuf_new()) == NULL) | ||
2962 | + fatal("%s: sshbuf_new failed", __func__); | ||
2963 | + | ||
2964 | + if ((r = sshbuf_put_cstring(m, | ||
2965 | + store->filename ? store->filename : "")) != 0 || | ||
2966 | + (r = sshbuf_put_cstring(m, | ||
2967 | + store->envvar ? store->envvar : "")) != 0 || | ||
2968 | + (r = sshbuf_put_cstring(m, | ||
2969 | + store->envval ? store->envval : "")) != 0) | ||
2970 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2971 | + | ||
2972 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, m); | ||
2973 | + mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, m); | ||
2974 | + | ||
2975 | + if ((r = sshbuf_get_u32(m, &ok)) != 0) | ||
2976 | + fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
2977 | + | ||
2978 | + sshbuf_free(m); | ||
2979 | + | ||
2980 | + return (ok); | ||
2981 | +} | ||
2982 | + | ||
2983 | #endif /* GSSAPI */ | ||
2984 | diff --git a/monitor_wrap.h b/monitor_wrap.h | ||
2985 | index 23ab096aa..485590c18 100644 | ||
2986 | --- a/monitor_wrap.h | ||
2987 | +++ b/monitor_wrap.h | ||
2988 | @@ -64,8 +64,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t, | ||
2989 | OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID); | ||
2990 | OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *, | ||
2991 | gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *); | ||
2992 | -int mm_ssh_gssapi_userok(char *user); | ||
2993 | +int mm_ssh_gssapi_userok(char *user, struct passwd *, int kex); | ||
2994 | OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2995 | +OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
2996 | +int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *); | ||
2997 | #endif | ||
2998 | |||
2999 | #ifdef USE_PAM | ||
3000 | diff --git a/readconf.c b/readconf.c | ||
3001 | index 2afcbaeca..fb585e248 100644 | ||
3002 | --- a/readconf.c | ||
3003 | +++ b/readconf.c | ||
3004 | @@ -67,6 +67,7 @@ | ||
3005 | #include "uidswap.h" | ||
3006 | #include "myproposal.h" | ||
3007 | #include "digest.h" | ||
3008 | +#include "ssh-gss.h" | ||
3009 | |||
3010 | /* Format of the configuration file: | ||
3011 | |||
3012 | @@ -160,6 +161,8 @@ typedef enum { | ||
3013 | oClearAllForwardings, oNoHostAuthenticationForLocalhost, | ||
3014 | oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, | ||
3015 | oAddressFamily, oGssAuthentication, oGssDelegateCreds, | ||
3016 | + oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey, | ||
3017 | + oGssServerIdentity, oGssKexAlgorithms, | ||
3018 | oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, | ||
3019 | oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist, | ||
3020 | oHashKnownHosts, | ||
3021 | @@ -204,10 +207,22 @@ static struct { | ||
3022 | /* Sometimes-unsupported options */ | ||
3023 | #if defined(GSSAPI) | ||
3024 | { "gssapiauthentication", oGssAuthentication }, | ||
3025 | + { "gssapikeyexchange", oGssKeyEx }, | ||
3026 | { "gssapidelegatecredentials", oGssDelegateCreds }, | ||
3027 | + { "gssapitrustdns", oGssTrustDns }, | ||
3028 | + { "gssapiclientidentity", oGssClientIdentity }, | ||
3029 | + { "gssapiserveridentity", oGssServerIdentity }, | ||
3030 | + { "gssapirenewalforcesrekey", oGssRenewalRekey }, | ||
3031 | + { "gssapikexalgorithms", oGssKexAlgorithms }, | ||
3032 | # else | ||
3033 | { "gssapiauthentication", oUnsupported }, | ||
3034 | + { "gssapikeyexchange", oUnsupported }, | ||
3035 | { "gssapidelegatecredentials", oUnsupported }, | ||
3036 | + { "gssapitrustdns", oUnsupported }, | ||
3037 | + { "gssapiclientidentity", oUnsupported }, | ||
3038 | + { "gssapiserveridentity", oUnsupported }, | ||
3039 | + { "gssapirenewalforcesrekey", oUnsupported }, | ||
3040 | + { "gssapikexalgorithms", oUnsupported }, | ||
3041 | #endif | ||
3042 | #ifdef ENABLE_PKCS11 | ||
3043 | { "pkcs11provider", oPKCS11Provider }, | ||
3044 | @@ -1053,10 +1068,42 @@ parse_time: | ||
3045 | intptr = &options->gss_authentication; | ||
3046 | goto parse_flag; | ||
3047 | |||
3048 | + case oGssKeyEx: | ||
3049 | + intptr = &options->gss_keyex; | ||
3050 | + goto parse_flag; | ||
3051 | + | ||
3052 | case oGssDelegateCreds: | ||
3053 | intptr = &options->gss_deleg_creds; | ||
3054 | goto parse_flag; | ||
3055 | |||
3056 | + case oGssTrustDns: | ||
3057 | + intptr = &options->gss_trust_dns; | ||
3058 | + goto parse_flag; | ||
3059 | + | ||
3060 | + case oGssClientIdentity: | ||
3061 | + charptr = &options->gss_client_identity; | ||
3062 | + goto parse_string; | ||
3063 | + | ||
3064 | + case oGssServerIdentity: | ||
3065 | + charptr = &options->gss_server_identity; | ||
3066 | + goto parse_string; | ||
3067 | + | ||
3068 | + case oGssRenewalRekey: | ||
3069 | + intptr = &options->gss_renewal_rekey; | ||
3070 | + goto parse_flag; | ||
3071 | + | ||
3072 | + case oGssKexAlgorithms: | ||
3073 | + arg = strdelim(&s); | ||
3074 | + if (!arg || *arg == '\0') | ||
3075 | + fatal("%.200s line %d: Missing argument.", | ||
3076 | + filename, linenum); | ||
3077 | + if (!kex_gss_names_valid(arg)) | ||
3078 | + fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.", | ||
3079 | + filename, linenum, arg ? arg : "<NONE>"); | ||
3080 | + if (*activep && options->gss_kex_algorithms == NULL) | ||
3081 | + options->gss_kex_algorithms = xstrdup(arg); | ||
3082 | + break; | ||
3083 | + | ||
3084 | case oBatchMode: | ||
3085 | intptr = &options->batch_mode; | ||
3086 | goto parse_flag; | ||
3087 | @@ -1935,7 +1982,13 @@ initialize_options(Options * options) | ||
3088 | options->pubkey_authentication = -1; | ||
3089 | options->challenge_response_authentication = -1; | ||
3090 | options->gss_authentication = -1; | ||
3091 | + options->gss_keyex = -1; | ||
3092 | options->gss_deleg_creds = -1; | ||
3093 | + options->gss_trust_dns = -1; | ||
3094 | + options->gss_renewal_rekey = -1; | ||
3095 | + options->gss_client_identity = NULL; | ||
3096 | + options->gss_server_identity = NULL; | ||
3097 | + options->gss_kex_algorithms = NULL; | ||
3098 | options->password_authentication = -1; | ||
3099 | options->kbd_interactive_authentication = -1; | ||
3100 | options->kbd_interactive_devices = NULL; | ||
3101 | @@ -2083,8 +2136,18 @@ fill_default_options(Options * options) | ||
3102 | options->challenge_response_authentication = 1; | ||
3103 | if (options->gss_authentication == -1) | ||
3104 | options->gss_authentication = 0; | ||
3105 | + if (options->gss_keyex == -1) | ||
3106 | + options->gss_keyex = 0; | ||
3107 | if (options->gss_deleg_creds == -1) | ||
3108 | options->gss_deleg_creds = 0; | ||
3109 | + if (options->gss_trust_dns == -1) | ||
3110 | + options->gss_trust_dns = 0; | ||
3111 | + if (options->gss_renewal_rekey == -1) | ||
3112 | + options->gss_renewal_rekey = 0; | ||
3113 | +#ifdef GSSAPI | ||
3114 | + if (options->gss_kex_algorithms == NULL) | ||
3115 | + options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX); | ||
3116 | +#endif | ||
3117 | if (options->password_authentication == -1) | ||
3118 | options->password_authentication = 1; | ||
3119 | if (options->kbd_interactive_authentication == -1) | ||
3120 | @@ -2726,7 +2789,14 @@ dump_client_config(Options *o, const char *host) | ||
3121 | dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports); | ||
3122 | #ifdef GSSAPI | ||
3123 | dump_cfg_fmtint(oGssAuthentication, o->gss_authentication); | ||
3124 | + dump_cfg_fmtint(oGssKeyEx, o->gss_keyex); | ||
3125 | dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds); | ||
3126 | + dump_cfg_fmtint(oGssTrustDns, o->gss_trust_dns); | ||
3127 | + dump_cfg_fmtint(oGssRenewalRekey, o->gss_renewal_rekey); | ||
3128 | + dump_cfg_string(oGssClientIdentity, o->gss_client_identity); | ||
3129 | + dump_cfg_string(oGssServerIdentity, o->gss_server_identity); | ||
3130 | + dump_cfg_string(oGssKexAlgorithms, o->gss_kex_algorithms ? | ||
3131 | + o->gss_kex_algorithms : GSS_KEX_DEFAULT_KEX); | ||
3132 | #endif /* GSSAPI */ | ||
3133 | dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts); | ||
3134 | dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication); | ||
3135 | diff --git a/readconf.h b/readconf.h | ||
3136 | index e143a1082..c405b837f 100644 | ||
3137 | --- a/readconf.h | ||
3138 | +++ b/readconf.h | ||
3139 | @@ -41,7 +41,13 @@ typedef struct { | ||
3140 | int challenge_response_authentication; | ||
3141 | /* Try S/Key or TIS, authentication. */ | ||
3142 | int gss_authentication; /* Try GSS authentication */ | ||
3143 | + int gss_keyex; /* Try GSS key exchange */ | ||
3144 | int gss_deleg_creds; /* Delegate GSS credentials */ | ||
3145 | + int gss_trust_dns; /* Trust DNS for GSS canonicalization */ | ||
3146 | + int gss_renewal_rekey; /* Credential renewal forces rekey */ | ||
3147 | + char *gss_client_identity; /* Principal to initiate GSSAPI with */ | ||
3148 | + char *gss_server_identity; /* GSSAPI target principal */ | ||
3149 | + char *gss_kex_algorithms; /* GSSAPI kex methods to be offered by client. */ | ||
3150 | int password_authentication; /* Try password | ||
3151 | * authentication. */ | ||
3152 | int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ | ||
3153 | diff --git a/servconf.c b/servconf.c | ||
3154 | index ba0a92c7b..f38ba9e44 100644 | ||
3155 | --- a/servconf.c | ||
3156 | +++ b/servconf.c | ||
3157 | @@ -69,6 +69,7 @@ | ||
3158 | #include "auth.h" | ||
3159 | #include "myproposal.h" | ||
3160 | #include "digest.h" | ||
3161 | +#include "ssh-gss.h" | ||
3162 | |||
3163 | static void add_listen_addr(ServerOptions *, const char *, | ||
3164 | const char *, int); | ||
3165 | @@ -133,8 +134,11 @@ initialize_server_options(ServerOptions *options) | ||
3166 | options->kerberos_ticket_cleanup = -1; | ||
3167 | options->kerberos_get_afs_token = -1; | ||
3168 | options->gss_authentication=-1; | ||
3169 | + options->gss_keyex = -1; | ||
3170 | options->gss_cleanup_creds = -1; | ||
3171 | options->gss_strict_acceptor = -1; | ||
3172 | + options->gss_store_rekey = -1; | ||
3173 | + options->gss_kex_algorithms = NULL; | ||
3174 | options->password_authentication = -1; | ||
3175 | options->kbd_interactive_authentication = -1; | ||
3176 | options->challenge_response_authentication = -1; | ||
3177 | @@ -375,10 +379,18 @@ fill_default_server_options(ServerOptions *options) | ||
3178 | options->kerberos_get_afs_token = 0; | ||
3179 | if (options->gss_authentication == -1) | ||
3180 | options->gss_authentication = 0; | ||
3181 | + if (options->gss_keyex == -1) | ||
3182 | + options->gss_keyex = 0; | ||
3183 | if (options->gss_cleanup_creds == -1) | ||
3184 | options->gss_cleanup_creds = 1; | ||
3185 | if (options->gss_strict_acceptor == -1) | ||
3186 | options->gss_strict_acceptor = 1; | ||
3187 | + if (options->gss_store_rekey == -1) | ||
3188 | + options->gss_store_rekey = 0; | ||
3189 | +#ifdef GSSAPI | ||
3190 | + if (options->gss_kex_algorithms == NULL) | ||
3191 | + options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX); | ||
3192 | +#endif | ||
3193 | if (options->password_authentication == -1) | ||
3194 | options->password_authentication = 1; | ||
3195 | if (options->kbd_interactive_authentication == -1) | ||
3196 | @@ -531,6 +543,7 @@ typedef enum { | ||
3197 | sHostKeyAlgorithms, | ||
3198 | sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, | ||
3199 | sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, | ||
3200 | + sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey, | ||
3201 | sAcceptEnv, sSetEnv, sPermitTunnel, | ||
3202 | sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory, | ||
3203 | sUsePrivilegeSeparation, sAllowAgentForwarding, | ||
3204 | @@ -607,12 +620,22 @@ static struct { | ||
3205 | #ifdef GSSAPI | ||
3206 | { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, | ||
3207 | { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, | ||
3208 | + { "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL }, | ||
3209 | { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL }, | ||
3210 | + { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL }, | ||
3211 | + { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL }, | ||
3212 | + { "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL }, | ||
3213 | #else | ||
3214 | { "gssapiauthentication", sUnsupported, SSHCFG_ALL }, | ||
3215 | { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, | ||
3216 | + { "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL }, | ||
3217 | { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL }, | ||
3218 | + { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL }, | ||
3219 | + { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL }, | ||
3220 | + { "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL }, | ||
3221 | #endif | ||
3222 | + { "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL }, | ||
3223 | + { "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL }, | ||
3224 | { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, | ||
3225 | { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, | ||
3226 | { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, | ||
3227 | @@ -1555,6 +1578,10 @@ process_server_config_line_depth(ServerOptions *options, char *line, | ||
3228 | intptr = &options->gss_authentication; | ||
3229 | goto parse_flag; | ||
3230 | |||
3231 | + case sGssKeyEx: | ||
3232 | + intptr = &options->gss_keyex; | ||
3233 | + goto parse_flag; | ||
3234 | + | ||
3235 | case sGssCleanupCreds: | ||
3236 | intptr = &options->gss_cleanup_creds; | ||
3237 | goto parse_flag; | ||
3238 | @@ -1563,6 +1590,22 @@ process_server_config_line_depth(ServerOptions *options, char *line, | ||
3239 | intptr = &options->gss_strict_acceptor; | ||
3240 | goto parse_flag; | ||
3241 | |||
3242 | + case sGssStoreRekey: | ||
3243 | + intptr = &options->gss_store_rekey; | ||
3244 | + goto parse_flag; | ||
3245 | + | ||
3246 | + case sGssKexAlgorithms: | ||
3247 | + arg = strdelim(&cp); | ||
3248 | + if (!arg || *arg == '\0') | ||
3249 | + fatal("%.200s line %d: Missing argument.", | ||
3250 | + filename, linenum); | ||
3251 | + if (!kex_gss_names_valid(arg)) | ||
3252 | + fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.", | ||
3253 | + filename, linenum, arg ? arg : "<NONE>"); | ||
3254 | + if (*activep && options->gss_kex_algorithms == NULL) | ||
3255 | + options->gss_kex_algorithms = xstrdup(arg); | ||
3256 | + break; | ||
3257 | + | ||
3258 | case sPasswordAuthentication: | ||
3259 | intptr = &options->password_authentication; | ||
3260 | goto parse_flag; | ||
3261 | @@ -2791,6 +2834,10 @@ dump_config(ServerOptions *o) | ||
3262 | #ifdef GSSAPI | ||
3263 | dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); | ||
3264 | dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); | ||
3265 | + dump_cfg_fmtint(sGssKeyEx, o->gss_keyex); | ||
3266 | + dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor); | ||
3267 | + dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey); | ||
3268 | + dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms); | ||
3269 | #endif | ||
3270 | dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); | ||
3271 | dump_cfg_fmtint(sKbdInteractiveAuthentication, | ||
3272 | diff --git a/servconf.h b/servconf.h | ||
3273 | index a420f398d..253cad97e 100644 | ||
3274 | --- a/servconf.h | ||
3275 | +++ b/servconf.h | ||
3276 | @@ -137,8 +137,11 @@ typedef struct { | ||
3277 | int kerberos_get_afs_token; /* If true, try to get AFS token if | ||
3278 | * authenticated with Kerberos. */ | ||
3279 | int gss_authentication; /* If true, permit GSSAPI authentication */ | ||
3280 | + int gss_keyex; /* If true, permit GSSAPI key exchange */ | ||
3281 | int gss_cleanup_creds; /* If true, destroy cred cache on logout */ | ||
3282 | int gss_strict_acceptor; /* If true, restrict the GSSAPI acceptor name */ | ||
3283 | + int gss_store_rekey; | ||
3284 | + char *gss_kex_algorithms; /* GSSAPI kex methods to be offered by client. */ | ||
3285 | int password_authentication; /* If true, permit password | ||
3286 | * authentication. */ | ||
3287 | int kbd_interactive_authentication; /* If true, permit */ | ||
3288 | diff --git a/session.c b/session.c | ||
3289 | index 18cdfa8cf..f9c2c866e 100644 | ||
3290 | --- a/session.c | ||
3291 | +++ b/session.c | ||
3292 | @@ -2678,13 +2678,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt) | ||
3293 | |||
3294 | #ifdef KRB5 | ||
3295 | if (options.kerberos_ticket_cleanup && | ||
3296 | - authctxt->krb5_ctx) | ||
3297 | + authctxt->krb5_ctx) { | ||
3298 | + temporarily_use_uid(authctxt->pw); | ||
3299 | krb5_cleanup_proc(authctxt); | ||
3300 | + restore_uid(); | ||
3301 | + } | ||
3302 | #endif | ||
3303 | |||
3304 | #ifdef GSSAPI | ||
3305 | - if (options.gss_cleanup_creds) | ||
3306 | + if (options.gss_cleanup_creds) { | ||
3307 | + temporarily_use_uid(authctxt->pw); | ||
3308 | ssh_gssapi_cleanup_creds(); | ||
3309 | + restore_uid(); | ||
3310 | + } | ||
3311 | #endif | ||
3312 | |||
3313 | /* remove agent socket */ | ||
3314 | diff --git a/ssh-gss.h b/ssh-gss.h | ||
3315 | index 36180d07a..50d80bbca 100644 | ||
3316 | --- a/ssh-gss.h | ||
3317 | +++ b/ssh-gss.h | ||
3318 | @@ -1,6 +1,6 @@ | ||
3319 | /* $OpenBSD: ssh-gss.h,v 1.14 2018/07/10 09:13:30 djm Exp $ */ | ||
3320 | /* | ||
3321 | - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | ||
3322 | + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. | ||
3323 | * | ||
3324 | * Redistribution and use in source and binary forms, with or without | ||
3325 | * modification, are permitted provided that the following conditions | ||
3326 | @@ -61,10 +61,34 @@ | ||
3327 | |||
3328 | #define SSH_GSS_OIDTYPE 0x06 | ||
3329 | |||
3330 | +#define SSH2_MSG_KEXGSS_INIT 30 | ||
3331 | +#define SSH2_MSG_KEXGSS_CONTINUE 31 | ||
3332 | +#define SSH2_MSG_KEXGSS_COMPLETE 32 | ||
3333 | +#define SSH2_MSG_KEXGSS_HOSTKEY 33 | ||
3334 | +#define SSH2_MSG_KEXGSS_ERROR 34 | ||
3335 | +#define SSH2_MSG_KEXGSS_GROUPREQ 40 | ||
3336 | +#define SSH2_MSG_KEXGSS_GROUP 41 | ||
3337 | +#define KEX_GSS_GRP1_SHA1_ID "gss-group1-sha1-" | ||
3338 | +#define KEX_GSS_GRP14_SHA1_ID "gss-group14-sha1-" | ||
3339 | +#define KEX_GSS_GRP14_SHA256_ID "gss-group14-sha256-" | ||
3340 | +#define KEX_GSS_GRP16_SHA512_ID "gss-group16-sha512-" | ||
3341 | +#define KEX_GSS_GEX_SHA1_ID "gss-gex-sha1-" | ||
3342 | +#define KEX_GSS_NISTP256_SHA256_ID "gss-nistp256-sha256-" | ||
3343 | +#define KEX_GSS_C25519_SHA256_ID "gss-curve25519-sha256-" | ||
3344 | + | ||
3345 | +#define GSS_KEX_DEFAULT_KEX \ | ||
3346 | + KEX_GSS_GRP14_SHA256_ID "," \ | ||
3347 | + KEX_GSS_GRP16_SHA512_ID "," \ | ||
3348 | + KEX_GSS_NISTP256_SHA256_ID "," \ | ||
3349 | + KEX_GSS_C25519_SHA256_ID "," \ | ||
3350 | + KEX_GSS_GRP14_SHA1_ID "," \ | ||
3351 | + KEX_GSS_GEX_SHA1_ID | ||
3352 | + | ||
3353 | typedef struct { | ||
3354 | char *filename; | ||
3355 | char *envvar; | ||
3356 | char *envval; | ||
3357 | + struct passwd *owner; | ||
3358 | void *data; | ||
3359 | } ssh_gssapi_ccache; | ||
3360 | |||
3361 | @@ -72,8 +96,11 @@ typedef struct { | ||
3362 | gss_buffer_desc displayname; | ||
3363 | gss_buffer_desc exportedname; | ||
3364 | gss_cred_id_t creds; | ||
3365 | + gss_name_t name; | ||
3366 | struct ssh_gssapi_mech_struct *mech; | ||
3367 | ssh_gssapi_ccache store; | ||
3368 | + int used; | ||
3369 | + int updated; | ||
3370 | } ssh_gssapi_client; | ||
3371 | |||
3372 | typedef struct ssh_gssapi_mech_struct { | ||
3373 | @@ -84,6 +111,7 @@ typedef struct ssh_gssapi_mech_struct { | ||
3374 | int (*userok) (ssh_gssapi_client *, char *); | ||
3375 | int (*localname) (ssh_gssapi_client *, char **); | ||
3376 | void (*storecreds) (ssh_gssapi_client *); | ||
3377 | + int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *); | ||
3378 | } ssh_gssapi_mech; | ||
3379 | |||
3380 | typedef struct { | ||
3381 | @@ -94,10 +122,11 @@ typedef struct { | ||
3382 | gss_OID oid; /* client */ | ||
3383 | gss_cred_id_t creds; /* server */ | ||
3384 | gss_name_t client; /* server */ | ||
3385 | - gss_cred_id_t client_creds; /* server */ | ||
3386 | + gss_cred_id_t client_creds; /* both */ | ||
3387 | } Gssctxt; | ||
3388 | |||
3389 | extern ssh_gssapi_mech *supported_mechs[]; | ||
3390 | +extern Gssctxt *gss_kex_context; | ||
3391 | |||
3392 | int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); | ||
3393 | void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); | ||
3394 | @@ -109,6 +138,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *); | ||
3395 | |||
3396 | struct sshbuf; | ||
3397 | int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *); | ||
3398 | +int ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *, gss_buffer_desc *); | ||
3399 | |||
3400 | OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *); | ||
3401 | OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int, | ||
3402 | @@ -123,17 +153,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **); | ||
3403 | OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
3404 | void ssh_gssapi_buildmic(struct sshbuf *, const char *, | ||
3405 | const char *, const char *); | ||
3406 | -int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *); | ||
3407 | +int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *); | ||
3408 | +OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *); | ||
3409 | +int ssh_gssapi_credentials_updated(Gssctxt *); | ||
3410 | |||
3411 | /* In the server */ | ||
3412 | +typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, | ||
3413 | + const char *); | ||
3414 | +char *ssh_gssapi_client_mechanisms(const char *, const char *, const char *); | ||
3415 | +char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *, | ||
3416 | + const char *, const char *); | ||
3417 | +gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int); | ||
3418 | +int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, | ||
3419 | + const char *); | ||
3420 | OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID); | ||
3421 | -int ssh_gssapi_userok(char *name); | ||
3422 | +int ssh_gssapi_userok(char *name, struct passwd *, int kex); | ||
3423 | OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); | ||
3424 | void ssh_gssapi_do_child(char ***, u_int *); | ||
3425 | void ssh_gssapi_cleanup_creds(void); | ||
3426 | void ssh_gssapi_storecreds(void); | ||
3427 | const char *ssh_gssapi_displayname(void); | ||
3428 | |||
3429 | +char *ssh_gssapi_server_mechanisms(void); | ||
3430 | +int ssh_gssapi_oid_table_ok(void); | ||
3431 | + | ||
3432 | +int ssh_gssapi_update_creds(ssh_gssapi_ccache *store); | ||
3433 | +void ssh_gssapi_rekey_creds(void); | ||
3434 | + | ||
3435 | #endif /* GSSAPI */ | ||
3436 | |||
3437 | #endif /* _SSH_GSS_H */ | ||
3438 | diff --git a/ssh.1 b/ssh.1 | ||
3439 | index dce5f404b..7a3ba31ab 100644 | ||
3440 | --- a/ssh.1 | ||
3441 | +++ b/ssh.1 | ||
3442 | @@ -506,7 +506,13 @@ For full details of the options listed below, and their possible values, see | ||
3443 | .It GatewayPorts | ||
3444 | .It GlobalKnownHostsFile | ||
3445 | .It GSSAPIAuthentication | ||
3446 | +.It GSSAPIKeyExchange | ||
3447 | +.It GSSAPIClientIdentity | ||
3448 | .It GSSAPIDelegateCredentials | ||
3449 | +.It GSSAPIKexAlgorithms | ||
3450 | +.It GSSAPIRenewalForcesRekey | ||
3451 | +.It GSSAPIServerIdentity | ||
3452 | +.It GSSAPITrustDns | ||
3453 | .It HashKnownHosts | ||
3454 | .It Host | ||
3455 | .It HostbasedAuthentication | ||
3456 | @@ -582,6 +588,8 @@ flag), | ||
3457 | (supported message integrity codes), | ||
3458 | .Ar kex | ||
3459 | (key exchange algorithms), | ||
3460 | +.Ar kex-gss | ||
3461 | +(GSSAPI key exchange algorithms), | ||
3462 | .Ar key | ||
3463 | (key types), | ||
3464 | .Ar key-cert | ||
3465 | diff --git a/ssh.c b/ssh.c | ||
3466 | index 98b6ce788..4a81ef810 100644 | ||
3467 | --- a/ssh.c | ||
3468 | +++ b/ssh.c | ||
3469 | @@ -773,6 +773,8 @@ main(int ac, char **av) | ||
3470 | else if (strcmp(optarg, "kex") == 0 || | ||
3471 | strcasecmp(optarg, "KexAlgorithms") == 0) | ||
3472 | cp = kex_alg_list('\n'); | ||
3473 | + else if (strcmp(optarg, "kex-gss") == 0) | ||
3474 | + cp = kex_gss_alg_list('\n'); | ||
3475 | else if (strcmp(optarg, "key") == 0) | ||
3476 | cp = sshkey_alg_list(0, 0, 0, '\n'); | ||
3477 | else if (strcmp(optarg, "key-cert") == 0) | ||
3478 | @@ -798,8 +800,8 @@ main(int ac, char **av) | ||
3479 | } else if (strcmp(optarg, "help") == 0) { | ||
3480 | cp = xstrdup( | ||
3481 | "cipher\ncipher-auth\ncompression\nkex\n" | ||
3482 | - "key\nkey-cert\nkey-plain\nkey-sig\nmac\n" | ||
3483 | - "protocol-version\nsig"); | ||
3484 | + "kex-gss\nkey\nkey-cert\nkey-plain\n" | ||
3485 | + "key-sig\nmac\nprotocol-version\nsig"); | ||
3486 | } | ||
3487 | if (cp == NULL) | ||
3488 | fatal("Unsupported query \"%s\"", optarg); | ||
3489 | diff --git a/ssh_config b/ssh_config | ||
3490 | index 5e8ef548b..1ff999b68 100644 | ||
3491 | --- a/ssh_config | ||
3492 | +++ b/ssh_config | ||
3493 | @@ -24,6 +24,8 @@ | ||
3494 | # HostbasedAuthentication no | ||
3495 | # GSSAPIAuthentication no | ||
3496 | # GSSAPIDelegateCredentials no | ||
3497 | +# GSSAPIKeyExchange no | ||
3498 | +# GSSAPITrustDNS no | ||
3499 | # BatchMode no | ||
3500 | # CheckHostIP yes | ||
3501 | # AddressFamily any | ||
3502 | diff --git a/ssh_config.5 b/ssh_config.5 | ||
3503 | index dc010ccbd..e2a2359f9 100644 | ||
3504 | --- a/ssh_config.5 | ||
3505 | +++ b/ssh_config.5 | ||
3506 | @@ -766,10 +766,67 @@ The default is | ||
3507 | Specifies whether user authentication based on GSSAPI is allowed. | ||
3508 | The default is | ||
3509 | .Cm no . | ||
3510 | +.It Cm GSSAPIClientIdentity | ||
3511 | +If set, specifies the GSSAPI client identity that ssh should use when | ||
3512 | +connecting to the server. The default is unset, which means that the default | ||
3513 | +identity will be used. | ||
3514 | .It Cm GSSAPIDelegateCredentials | ||
3515 | Forward (delegate) credentials to the server. | ||
3516 | The default is | ||
3517 | .Cm no . | ||
3518 | +.It Cm GSSAPIKeyExchange | ||
3519 | +Specifies whether key exchange based on GSSAPI may be used. When using | ||
3520 | +GSSAPI key exchange the server need not have a host key. | ||
3521 | +The default is | ||
3522 | +.Dq no . | ||
3523 | +.It Cm GSSAPIRenewalForcesRekey | ||
3524 | +If set to | ||
3525 | +.Dq yes | ||
3526 | +then renewal of the client's GSSAPI credentials will force the rekeying of the | ||
3527 | +ssh connection. With a compatible server, this will delegate the renewed | ||
3528 | +credentials to a session on the server. | ||
3529 | +.Pp | ||
3530 | +Checks are made to ensure that credentials are only propagated when the new | ||
3531 | +credentials match the old ones on the originating client and where the | ||
3532 | +receiving server still has the old set in its cache. | ||
3533 | +.Pp | ||
3534 | +The default is | ||
3535 | +.Dq no . | ||
3536 | +.Pp | ||
3537 | +For this to work | ||
3538 | +.Cm GSSAPIKeyExchange | ||
3539 | +needs to be enabled in the server and also used by the client. | ||
3540 | +.It Cm GSSAPIServerIdentity | ||
3541 | +If set, specifies the GSSAPI server identity that ssh should expect when | ||
3542 | +connecting to the server. The default is unset, which means that the | ||
3543 | +expected GSSAPI server identity will be determined from the target | ||
3544 | +hostname. | ||
3545 | +.It Cm GSSAPITrustDns | ||
3546 | +Set to | ||
3547 | +.Dq yes | ||
3548 | +to indicate that the DNS is trusted to securely canonicalize | ||
3549 | +the name of the host being connected to. If | ||
3550 | +.Dq no , | ||
3551 | +the hostname entered on the | ||
3552 | +command line will be passed untouched to the GSSAPI library. | ||
3553 | +The default is | ||
3554 | +.Dq no . | ||
3555 | +.It Cm GSSAPIKexAlgorithms | ||
3556 | +The list of key exchange algorithms that are offered for GSSAPI | ||
3557 | +key exchange. Possible values are | ||
3558 | +.Bd -literal -offset 3n | ||
3559 | +gss-gex-sha1-, | ||
3560 | +gss-group1-sha1-, | ||
3561 | +gss-group14-sha1-, | ||
3562 | +gss-group14-sha256-, | ||
3563 | +gss-group16-sha512-, | ||
3564 | +gss-nistp256-sha256-, | ||
3565 | +gss-curve25519-sha256- | ||
3566 | +.Ed | ||
3567 | +.Pp | ||
3568 | +The default is | ||
3569 | +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,gss-curve25519-sha256-,gss-gex-sha1-,gss-group14-sha1- . | ||
3570 | +This option only applies to connections using GSSAPI. | ||
3571 | .It Cm HashKnownHosts | ||
3572 | Indicates that | ||
3573 | .Xr ssh 1 | ||
3574 | diff --git a/sshconnect2.c b/sshconnect2.c | ||
3575 | index 1a6545edf..79a22e600 100644 | ||
3576 | --- a/sshconnect2.c | ||
3577 | +++ b/sshconnect2.c | ||
3578 | @@ -80,8 +80,6 @@ | ||
3579 | #endif | ||
3580 | |||
3581 | /* import */ | ||
3582 | -extern char *client_version_string; | ||
3583 | -extern char *server_version_string; | ||
3584 | extern Options options; | ||
3585 | |||
3586 | /* | ||
3587 | @@ -163,6 +161,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port) | ||
3588 | char *s, *all_key; | ||
3589 | int r, use_known_hosts_order = 0; | ||
3590 | |||
3591 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
3592 | + char *orig = NULL, *gss = NULL; | ||
3593 | + char *gss_host = NULL; | ||
3594 | +#endif | ||
3595 | + | ||
3596 | xxx_host = host; | ||
3597 | xxx_hostaddr = hostaddr; | ||
3598 | |||
3599 | @@ -206,6 +209,41 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port) | ||
3600 | compat_pkalg_proposal(options.hostkeyalgorithms); | ||
3601 | } | ||
3602 | |||
3603 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
3604 | + if (options.gss_keyex) { | ||
3605 | + /* Add the GSSAPI mechanisms currently supported on this | ||
3606 | + * client to the key exchange algorithm proposal */ | ||
3607 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
3608 | + | ||
3609 | + if (options.gss_server_identity) { | ||
3610 | + gss_host = xstrdup(options.gss_server_identity); | ||
3611 | + } else if (options.gss_trust_dns) { | ||
3612 | + gss_host = remote_hostname(ssh); | ||
3613 | + /* Fall back to specified host if we are using proxy command | ||
3614 | + * and can not use DNS on that socket */ | ||
3615 | + if (strcmp(gss_host, "UNKNOWN") == 0) { | ||
3616 | + gss_host = xstrdup(host); | ||
3617 | + } | ||
3618 | + } else { | ||
3619 | + gss_host = xstrdup(host); | ||
3620 | + } | ||
3621 | + | ||
3622 | + gss = ssh_gssapi_client_mechanisms(gss_host, | ||
3623 | + options.gss_client_identity, options.gss_kex_algorithms); | ||
3624 | + if (gss) { | ||
3625 | + debug("Offering GSSAPI proposal: %s", gss); | ||
3626 | + xasprintf(&myproposal[PROPOSAL_KEX_ALGS], | ||
3627 | + "%s,%s", gss, orig); | ||
3628 | + | ||
3629 | + /* If we've got GSSAPI algorithms, then we also support the | ||
3630 | + * 'null' hostkey, as a last resort */ | ||
3631 | + orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]; | ||
3632 | + xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS], | ||
3633 | + "%s,null", orig); | ||
3634 | + } | ||
3635 | + } | ||
3636 | +#endif | ||
3637 | + | ||
3638 | if (options.rekey_limit || options.rekey_interval) | ||
3639 | ssh_packet_set_rekey_limits(ssh, options.rekey_limit, | ||
3640 | options.rekey_interval); | ||
3641 | @@ -224,16 +262,46 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port) | ||
3642 | # ifdef OPENSSL_HAS_ECC | ||
3643 | ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; | ||
3644 | # endif | ||
3645 | -#endif | ||
3646 | +# ifdef GSSAPI | ||
3647 | + if (options.gss_keyex) { | ||
3648 | + ssh->kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client; | ||
3649 | + ssh->kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client; | ||
3650 | + ssh->kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_client; | ||
3651 | + ssh->kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_client; | ||
3652 | + ssh->kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_client; | ||
3653 | + ssh->kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_client; | ||
3654 | + ssh->kex->kex[KEX_GSS_C25519_SHA256] = kexgss_client; | ||
3655 | + } | ||
3656 | +# endif | ||
3657 | +#endif /* WITH_OPENSSL */ | ||
3658 | ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; | ||
3659 | ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_client; | ||
3660 | ssh->kex->verify_host_key=&verify_host_key_callback; | ||
3661 | |||
3662 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
3663 | + if (options.gss_keyex) { | ||
3664 | + ssh->kex->gss_deleg_creds = options.gss_deleg_creds; | ||
3665 | + ssh->kex->gss_trust_dns = options.gss_trust_dns; | ||
3666 | + ssh->kex->gss_client = options.gss_client_identity; | ||
3667 | + ssh->kex->gss_host = gss_host; | ||
3668 | + } | ||
3669 | +#endif | ||
3670 | + | ||
3671 | ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done); | ||
3672 | |||
3673 | /* remove ext-info from the KEX proposals for rekeying */ | ||
3674 | myproposal[PROPOSAL_KEX_ALGS] = | ||
3675 | compat_kex_proposal(options.kex_algorithms); | ||
3676 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
3677 | + /* repair myproposal after it was crumpled by the */ | ||
3678 | + /* ext-info removal above */ | ||
3679 | + if (gss) { | ||
3680 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
3681 | + xasprintf(&myproposal[PROPOSAL_KEX_ALGS], | ||
3682 | + "%s,%s", gss, orig); | ||
3683 | + free(gss); | ||
3684 | + } | ||
3685 | +#endif | ||
3686 | if ((r = kex_prop2buf(ssh->kex->my, myproposal)) != 0) | ||
3687 | fatal("kex_prop2buf: %s", ssh_err(r)); | ||
3688 | |||
3689 | @@ -330,6 +398,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *); | ||
3690 | static int input_gssapi_token(int type, u_int32_t, struct ssh *); | ||
3691 | static int input_gssapi_error(int, u_int32_t, struct ssh *); | ||
3692 | static int input_gssapi_errtok(int, u_int32_t, struct ssh *); | ||
3693 | +static int userauth_gsskeyex(struct ssh *); | ||
3694 | #endif | ||
3695 | |||
3696 | void userauth(struct ssh *, char *); | ||
3697 | @@ -346,6 +415,11 @@ static char *authmethods_get(void); | ||
3698 | |||
3699 | Authmethod authmethods[] = { | ||
3700 | #ifdef GSSAPI | ||
3701 | + {"gssapi-keyex", | ||
3702 | + userauth_gsskeyex, | ||
3703 | + NULL, | ||
3704 | + &options.gss_keyex, | ||
3705 | + NULL}, | ||
3706 | {"gssapi-with-mic", | ||
3707 | userauth_gssapi, | ||
3708 | userauth_gssapi_cleanup, | ||
3709 | @@ -716,12 +790,31 @@ userauth_gssapi(struct ssh *ssh) | ||
3710 | OM_uint32 min; | ||
3711 | int r, ok = 0; | ||
3712 | gss_OID mech = NULL; | ||
3713 | + char *gss_host; | ||
3714 | + | ||
3715 | + if (options.gss_server_identity) { | ||
3716 | + gss_host = xstrdup(options.gss_server_identity); | ||
3717 | + } else if (options.gss_trust_dns) { | ||
3718 | + gss_host = remote_hostname(ssh); | ||
3719 | + /* Fall back to specified host if we are using proxy command | ||
3720 | + * and can not use DNS on that socket */ | ||
3721 | + if (strcmp(gss_host, "UNKNOWN") == 0) { | ||
3722 | + gss_host = authctxt->host; | ||
3723 | + } | ||
3724 | + } else { | ||
3725 | + gss_host = xstrdup(authctxt->host); | ||
3726 | + } | ||
3727 | |||
3728 | /* Try one GSSAPI method at a time, rather than sending them all at | ||
3729 | * once. */ | ||
3730 | |||
3731 | if (authctxt->gss_supported_mechs == NULL) | ||
3732 | - gss_indicate_mechs(&min, &authctxt->gss_supported_mechs); | ||
3733 | + if (GSS_ERROR(gss_indicate_mechs(&min, | ||
3734 | + &authctxt->gss_supported_mechs))) { | ||
3735 | + authctxt->gss_supported_mechs = NULL; | ||
3736 | + free(gss_host); | ||
3737 | + return 0; | ||
3738 | + } | ||
3739 | |||
3740 | /* Check to see whether the mechanism is usable before we offer it */ | ||
3741 | while (authctxt->mech_tried < authctxt->gss_supported_mechs->count && | ||
3742 | @@ -730,13 +823,15 @@ userauth_gssapi(struct ssh *ssh) | ||
3743 | elements[authctxt->mech_tried]; | ||
3744 | /* My DER encoding requires length<128 */ | ||
3745 | if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt, | ||
3746 | - mech, authctxt->host)) { | ||
3747 | + mech, gss_host, options.gss_client_identity)) { | ||
3748 | ok = 1; /* Mechanism works */ | ||
3749 | } else { | ||
3750 | authctxt->mech_tried++; | ||
3751 | } | ||
3752 | } | ||
3753 | |||
3754 | + free(gss_host); | ||
3755 | + | ||
3756 | if (!ok || mech == NULL) | ||
3757 | return 0; | ||
3758 | |||
3759 | @@ -976,6 +1071,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh) | ||
3760 | free(lang); | ||
3761 | return r; | ||
3762 | } | ||
3763 | + | ||
3764 | +int | ||
3765 | +userauth_gsskeyex(struct ssh *ssh) | ||
3766 | +{ | ||
3767 | + struct sshbuf *b = NULL; | ||
3768 | + Authctxt *authctxt = ssh->authctxt; | ||
3769 | + gss_buffer_desc gssbuf; | ||
3770 | + gss_buffer_desc mic = GSS_C_EMPTY_BUFFER; | ||
3771 | + OM_uint32 ms; | ||
3772 | + int r; | ||
3773 | + | ||
3774 | + static int attempt = 0; | ||
3775 | + if (attempt++ >= 1) | ||
3776 | + return (0); | ||
3777 | + | ||
3778 | + if (gss_kex_context == NULL) { | ||
3779 | + debug("No valid Key exchange context"); | ||
3780 | + return (0); | ||
3781 | + } | ||
3782 | + | ||
3783 | + if ((b = sshbuf_new()) == NULL) | ||
3784 | + fatal("%s: sshbuf_new failed", __func__); | ||
3785 | + | ||
3786 | + ssh_gssapi_buildmic(b, authctxt->server_user, authctxt->service, | ||
3787 | + "gssapi-keyex"); | ||
3788 | + | ||
3789 | + if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL) | ||
3790 | + fatal("%s: sshbuf_mutable_ptr failed", __func__); | ||
3791 | + gssbuf.length = sshbuf_len(b); | ||
3792 | + | ||
3793 | + if (GSS_ERROR(ssh_gssapi_sign(gss_kex_context, &gssbuf, &mic))) { | ||
3794 | + sshbuf_free(b); | ||
3795 | + return (0); | ||
3796 | + } | ||
3797 | + | ||
3798 | + if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_REQUEST)) != 0 || | ||
3799 | + (r = sshpkt_put_cstring(ssh, authctxt->server_user)) != 0 || | ||
3800 | + (r = sshpkt_put_cstring(ssh, authctxt->service)) != 0 || | ||
3801 | + (r = sshpkt_put_cstring(ssh, authctxt->method->name)) != 0 || | ||
3802 | + (r = sshpkt_put_string(ssh, mic.value, mic.length)) != 0 || | ||
3803 | + (r = sshpkt_send(ssh)) != 0) | ||
3804 | + fatal("%s: %s", __func__, ssh_err(r)); | ||
3805 | + | ||
3806 | + sshbuf_free(b); | ||
3807 | + gss_release_buffer(&ms, &mic); | ||
3808 | + | ||
3809 | + return (1); | ||
3810 | +} | ||
3811 | + | ||
3812 | #endif /* GSSAPI */ | ||
3813 | |||
3814 | static int | ||
3815 | diff --git a/sshd.c b/sshd.c | ||
3816 | index 6f8f11a3b..02fca5c28 100644 | ||
3817 | --- a/sshd.c | ||
3818 | +++ b/sshd.c | ||
3819 | @@ -816,8 +816,8 @@ notify_hostkeys(struct ssh *ssh) | ||
3820 | } | ||
3821 | debug3("%s: sent %u hostkeys", __func__, nkeys); | ||
3822 | if (nkeys == 0) | ||
3823 | - fatal("%s: no hostkeys", __func__); | ||
3824 | - if ((r = sshpkt_send(ssh)) != 0) | ||
3825 | + debug3("%s: no hostkeys", __func__); | ||
3826 | + else if ((r = sshpkt_send(ssh)) != 0) | ||
3827 | sshpkt_fatal(ssh, r, "%s: send", __func__); | ||
3828 | sshbuf_free(buf); | ||
3829 | } | ||
3830 | @@ -1851,7 +1851,8 @@ main(int ac, char **av) | ||
3831 | free(fp); | ||
3832 | } | ||
3833 | accumulate_host_timing_secret(cfg, NULL); | ||
3834 | - if (!sensitive_data.have_ssh2_key) { | ||
3835 | + /* The GSSAPI key exchange can run without a host key */ | ||
3836 | + if (!sensitive_data.have_ssh2_key && !options.gss_keyex) { | ||
3837 | logit("sshd: no hostkeys available -- exiting."); | ||
3838 | exit(1); | ||
3839 | } | ||
3840 | @@ -2342,6 +2343,48 @@ do_ssh2_kex(struct ssh *ssh) | ||
3841 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal( | ||
3842 | list_hostkey_types()); | ||
3843 | |||
3844 | +#if defined(GSSAPI) && defined(WITH_OPENSSL) | ||
3845 | + { | ||
3846 | + char *orig; | ||
3847 | + char *gss = NULL; | ||
3848 | + char *newstr = NULL; | ||
3849 | + orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
3850 | + | ||
3851 | + /* | ||
3852 | + * If we don't have a host key, then there's no point advertising | ||
3853 | + * the other key exchange algorithms | ||
3854 | + */ | ||
3855 | + | ||
3856 | + if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0) | ||
3857 | + orig = NULL; | ||
3858 | + | ||
3859 | + if (options.gss_keyex) | ||
3860 | + gss = ssh_gssapi_server_mechanisms(); | ||
3861 | + else | ||
3862 | + gss = NULL; | ||
3863 | + | ||
3864 | + if (gss && orig) | ||
3865 | + xasprintf(&newstr, "%s,%s", gss, orig); | ||
3866 | + else if (gss) | ||
3867 | + newstr = gss; | ||
3868 | + else if (orig) | ||
3869 | + newstr = orig; | ||
3870 | + | ||
3871 | + /* | ||
3872 | + * If we've got GSSAPI mechanisms, then we've got the 'null' host | ||
3873 | + * key alg, but we can't tell people about it unless its the only | ||
3874 | + * host key algorithm we support | ||
3875 | + */ | ||
3876 | + if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0) | ||
3877 | + myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null"; | ||
3878 | + | ||
3879 | + if (newstr) | ||
3880 | + myproposal[PROPOSAL_KEX_ALGS] = newstr; | ||
3881 | + else | ||
3882 | + fatal("No supported key exchange algorithms"); | ||
3883 | + } | ||
3884 | +#endif | ||
3885 | + | ||
3886 | /* start key exchange */ | ||
3887 | if ((r = kex_setup(ssh, myproposal)) != 0) | ||
3888 | fatal("kex_setup: %s", ssh_err(r)); | ||
3889 | @@ -2357,7 +2400,18 @@ do_ssh2_kex(struct ssh *ssh) | ||
3890 | # ifdef OPENSSL_HAS_ECC | ||
3891 | kex->kex[KEX_ECDH_SHA2] = kex_gen_server; | ||
3892 | # endif | ||
3893 | -#endif | ||
3894 | +# ifdef GSSAPI | ||
3895 | + if (options.gss_keyex) { | ||
3896 | + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
3897 | + kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
3898 | + kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server; | ||
3899 | + kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server; | ||
3900 | + kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server; | ||
3901 | + kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server; | ||
3902 | + kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server; | ||
3903 | + } | ||
3904 | +# endif | ||
3905 | +#endif /* WITH_OPENSSL */ | ||
3906 | kex->kex[KEX_C25519_SHA256] = kex_gen_server; | ||
3907 | kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server; | ||
3908 | kex->load_host_public_key=&get_hostkey_public_by_type; | ||
3909 | diff --git a/sshd_config b/sshd_config | ||
3910 | index 19b7c91a1..2c48105f8 100644 | ||
3911 | --- a/sshd_config | ||
3912 | +++ b/sshd_config | ||
3913 | @@ -69,6 +69,8 @@ AuthorizedKeysFile .ssh/authorized_keys | ||
3914 | # GSSAPI options | ||
3915 | #GSSAPIAuthentication no | ||
3916 | #GSSAPICleanupCredentials yes | ||
3917 | +#GSSAPIStrictAcceptorCheck yes | ||
3918 | +#GSSAPIKeyExchange no | ||
3919 | |||
3920 | # Set this to 'yes' to enable PAM authentication, account processing, | ||
3921 | # and session processing. If this is enabled, PAM authentication will | ||
3922 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
3923 | index b294efc2d..360e5fb1a 100644 | ||
3924 | --- a/sshd_config.5 | ||
3925 | +++ b/sshd_config.5 | ||
3926 | @@ -644,6 +644,11 @@ Specifies whether to automatically destroy the user's credentials cache | ||
3927 | on logout. | ||
3928 | The default is | ||
3929 | .Cm yes . | ||
3930 | +.It Cm GSSAPIKeyExchange | ||
3931 | +Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange | ||
3932 | +doesn't rely on ssh keys to verify host identity. | ||
3933 | +The default is | ||
3934 | +.Cm no . | ||
3935 | .It Cm GSSAPIStrictAcceptorCheck | ||
3936 | Determines whether to be strict about the identity of the GSSAPI acceptor | ||
3937 | a client authenticates against. | ||
3938 | @@ -658,6 +663,31 @@ machine's default store. | ||
3939 | This facility is provided to assist with operation on multi homed machines. | ||
3940 | The default is | ||
3941 | .Cm yes . | ||
3942 | +.It Cm GSSAPIStoreCredentialsOnRekey | ||
3943 | +Controls whether the user's GSSAPI credentials should be updated following a | ||
3944 | +successful connection rekeying. This option can be used to accepted renewed | ||
3945 | +or updated credentials from a compatible client. The default is | ||
3946 | +.Dq no . | ||
3947 | +.Pp | ||
3948 | +For this to work | ||
3949 | +.Cm GSSAPIKeyExchange | ||
3950 | +needs to be enabled in the server and also used by the client. | ||
3951 | +.It Cm GSSAPIKexAlgorithms | ||
3952 | +The list of key exchange algorithms that are accepted by GSSAPI | ||
3953 | +key exchange. Possible values are | ||
3954 | +.Bd -literal -offset 3n | ||
3955 | +gss-gex-sha1-, | ||
3956 | +gss-group1-sha1-, | ||
3957 | +gss-group14-sha1-, | ||
3958 | +gss-group14-sha256-, | ||
3959 | +gss-group16-sha512-, | ||
3960 | +gss-nistp256-sha256-, | ||
3961 | +gss-curve25519-sha256- | ||
3962 | +.Ed | ||
3963 | +.Pp | ||
3964 | +The default is | ||
3965 | +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,gss-curve25519-sha256-,gss-gex-sha1-,gss-group14-sha1- . | ||
3966 | +This option only applies to connections using GSSAPI. | ||
3967 | .It Cm HostbasedAcceptedKeyTypes | ||
3968 | Specifies the key types that will be accepted for hostbased authentication | ||
3969 | as a list of comma-separated patterns. | ||
3970 | diff --git a/sshkey.c b/sshkey.c | ||
3971 | index 1571e3d93..1ac32a0ec 100644 | ||
3972 | --- a/sshkey.c | ||
3973 | +++ b/sshkey.c | ||
3974 | @@ -154,6 +154,7 @@ static const struct keytype keytypes[] = { | ||
3975 | KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 }, | ||
3976 | # endif /* OPENSSL_HAS_ECC */ | ||
3977 | #endif /* WITH_OPENSSL */ | ||
3978 | + { "null", "null", NULL, KEY_NULL, 0, 0, 0 }, | ||
3979 | { NULL, NULL, NULL, -1, -1, 0, 0 } | ||
3980 | }; | ||
3981 | |||
3982 | @@ -255,7 +256,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep) | ||
3983 | const struct keytype *kt; | ||
3984 | |||
3985 | for (kt = keytypes; kt->type != -1; kt++) { | ||
3986 | - if (kt->name == NULL) | ||
3987 | + if (kt->name == NULL || kt->type == KEY_NULL) | ||
3988 | continue; | ||
3989 | if (!include_sigonly && kt->sigonly) | ||
3990 | continue; | ||
3991 | diff --git a/sshkey.h b/sshkey.h | ||
3992 | index 9c1d4f637..f586e8967 100644 | ||
3993 | --- a/sshkey.h | ||
3994 | +++ b/sshkey.h | ||
3995 | @@ -69,6 +69,7 @@ enum sshkey_types { | ||
3996 | KEY_ECDSA_SK_CERT, | ||
3997 | KEY_ED25519_SK, | ||
3998 | KEY_ED25519_SK_CERT, | ||
3999 | + KEY_NULL, | ||
4000 | KEY_UNSPEC | ||
4001 | }; | ||
4002 | |||