diff options
Diffstat (limited to 'kexgssc.c')
-rw-r--r-- | kexgssc.c | 302 |
1 files changed, 302 insertions, 0 deletions
diff --git a/kexgssc.c b/kexgssc.c new file mode 100644 index 000000000..1843403b6 --- /dev/null +++ b/kexgssc.c | |||
@@ -0,0 +1,302 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2001-2005 Simon Wilkinson. All rights reserved. | ||
3 | * | ||
4 | * Redistribution and use in source and binary forms, with or without | ||
5 | * modification, are permitted provided that the following conditions | ||
6 | * are met: | ||
7 | * 1. Redistributions of source code must retain the above copyright | ||
8 | * notice, this list of conditions and the following disclaimer. | ||
9 | * 2. Redistributions in binary form must reproduce the above copyright | ||
10 | * notice, this list of conditions and the following disclaimer in the | ||
11 | * documentation and/or other materials provided with the distribution. | ||
12 | * | ||
13 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR | ||
14 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
15 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
16 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
17 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
18 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
19 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
20 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
21 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
22 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
23 | */ | ||
24 | |||
25 | #include "includes.h" | ||
26 | |||
27 | #ifdef GSSAPI | ||
28 | |||
29 | #include <openssl/crypto.h> | ||
30 | #include <openssl/bn.h> | ||
31 | |||
32 | #include "xmalloc.h" | ||
33 | #include "buffer.h" | ||
34 | #include "bufaux.h" | ||
35 | #include "kex.h" | ||
36 | #include "log.h" | ||
37 | #include "packet.h" | ||
38 | #include "dh.h" | ||
39 | #include "canohost.h" | ||
40 | #include "ssh2.h" | ||
41 | #include "ssh-gss.h" | ||
42 | |||
43 | void | ||
44 | kexgss_client(Kex *kex) { | ||
45 | gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; | ||
46 | gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr; | ||
47 | Gssctxt *ctxt; | ||
48 | OM_uint32 maj_status, min_status, ret_flags; | ||
49 | unsigned int klen, kout; | ||
50 | DH *dh; | ||
51 | BIGNUM *dh_server_pub = NULL; | ||
52 | BIGNUM *shared_secret = NULL; | ||
53 | BIGNUM *p = NULL; | ||
54 | BIGNUM *g = NULL; | ||
55 | unsigned char *kbuf; | ||
56 | unsigned char *hash; | ||
57 | unsigned char *serverhostkey = NULL; | ||
58 | char *msg; | ||
59 | char *lang; | ||
60 | int type = 0; | ||
61 | int first = 1; | ||
62 | int slen = 0; | ||
63 | int gex = 0; | ||
64 | int nbits, min, max; | ||
65 | u_int strlen; | ||
66 | |||
67 | /* Initialise our GSSAPI world */ | ||
68 | ssh_gssapi_build_ctx(&ctxt); | ||
69 | if (ssh_gssapi_id_kex(ctxt, kex->name, &gex) == NULL) | ||
70 | fatal("Couldn't identify host exchange"); | ||
71 | |||
72 | if (ssh_gssapi_import_name(ctxt, kex->gss_host)) | ||
73 | fatal("Couldn't import hostname"); | ||
74 | |||
75 | if (gex) { | ||
76 | debug("Doing group exchange\n"); | ||
77 | nbits = dh_estimate(kex->we_need * 8); | ||
78 | min = DH_GRP_MIN; | ||
79 | max = DH_GRP_MAX; | ||
80 | packet_start(SSH2_MSG_KEXGSS_GROUPREQ); | ||
81 | packet_put_int(min); | ||
82 | packet_put_int(nbits); | ||
83 | packet_put_int(max); | ||
84 | |||
85 | packet_send(); | ||
86 | |||
87 | packet_read_expect(SSH2_MSG_KEXGSS_GROUP); | ||
88 | |||
89 | if ((p = BN_new()) == NULL) | ||
90 | fatal("BN_new() failed"); | ||
91 | packet_get_bignum2(p); | ||
92 | if ((g = BN_new()) == NULL) | ||
93 | fatal("BN_new() failed"); | ||
94 | packet_get_bignum2(g); | ||
95 | packet_check_eom(); | ||
96 | |||
97 | if (BN_num_bits(p) < min || BN_num_bits(p) > max) | ||
98 | fatal("GSSGRP_GEX group out of range: %d !< %d !< %d", | ||
99 | min, BN_num_bits(p), max); | ||
100 | |||
101 | dh = dh_new_group(g, p); | ||
102 | } else { | ||
103 | dh = dh_new_group1(); | ||
104 | } | ||
105 | |||
106 | /* Step 1 - e is dh->pub_key */ | ||
107 | dh_gen_key(dh, kex->we_need * 8); | ||
108 | |||
109 | /* This is f, we initialise it now to make life easier */ | ||
110 | dh_server_pub = BN_new(); | ||
111 | if (dh_server_pub == NULL) | ||
112 | fatal("dh_server_pub == NULL"); | ||
113 | |||
114 | token_ptr = GSS_C_NO_BUFFER; | ||
115 | |||
116 | do { | ||
117 | debug("Calling gss_init_sec_context"); | ||
118 | |||
119 | maj_status = ssh_gssapi_init_ctx(ctxt, | ||
120 | kex->gss_deleg_creds, token_ptr, &send_tok, | ||
121 | &ret_flags); | ||
122 | |||
123 | if (GSS_ERROR(maj_status)) { | ||
124 | if (send_tok.length != 0) { | ||
125 | packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
126 | packet_put_string(send_tok.value, | ||
127 | send_tok.length); | ||
128 | } | ||
129 | fatal("gss_init_context failed"); | ||
130 | } | ||
131 | |||
132 | /* If we've got an old receive buffer get rid of it */ | ||
133 | if (token_ptr != GSS_C_NO_BUFFER) | ||
134 | xfree(recv_tok.value); | ||
135 | |||
136 | if (maj_status == GSS_S_COMPLETE) { | ||
137 | /* If mutual state flag is not true, kex fails */ | ||
138 | if (!(ret_flags & GSS_C_MUTUAL_FLAG)) | ||
139 | fatal("Mutual authentication failed"); | ||
140 | |||
141 | /* If integ avail flag is not true kex fails */ | ||
142 | if (!(ret_flags & GSS_C_INTEG_FLAG)) | ||
143 | fatal("Integrity check failed"); | ||
144 | } | ||
145 | |||
146 | /* | ||
147 | * If we have data to send, then the last message that we | ||
148 | * received cannot have been a 'complete'. | ||
149 | */ | ||
150 | if (send_tok.length != 0) { | ||
151 | if (first) { | ||
152 | packet_start(SSH2_MSG_KEXGSS_INIT); | ||
153 | packet_put_string(send_tok.value, | ||
154 | send_tok.length); | ||
155 | packet_put_bignum2(dh->pub_key); | ||
156 | first = 0; | ||
157 | } else { | ||
158 | packet_start(SSH2_MSG_KEXGSS_CONTINUE); | ||
159 | packet_put_string(send_tok.value, | ||
160 | send_tok.length); | ||
161 | } | ||
162 | packet_send(); | ||
163 | gss_release_buffer(&min_status, &send_tok); | ||
164 | |||
165 | /* If we've sent them data, they should reply */ | ||
166 | do { | ||
167 | type = packet_read(); | ||
168 | if (type == SSH2_MSG_KEXGSS_HOSTKEY) { | ||
169 | debug("Received KEXGSS_HOSTKEY"); | ||
170 | if (serverhostkey) | ||
171 | fatal("Server host key received more than once"); | ||
172 | serverhostkey = | ||
173 | packet_get_string(&slen); | ||
174 | } | ||
175 | } while (type == SSH2_MSG_KEXGSS_HOSTKEY); | ||
176 | |||
177 | switch (type) { | ||
178 | case SSH2_MSG_KEXGSS_CONTINUE: | ||
179 | debug("Received GSSAPI_CONTINUE"); | ||
180 | if (maj_status == GSS_S_COMPLETE) | ||
181 | fatal("GSSAPI Continue received from server when complete"); | ||
182 | recv_tok.value = packet_get_string(&strlen); | ||
183 | recv_tok.length = strlen; | ||
184 | break; | ||
185 | case SSH2_MSG_KEXGSS_COMPLETE: | ||
186 | debug("Received GSSAPI_COMPLETE"); | ||
187 | packet_get_bignum2(dh_server_pub); | ||
188 | msg_tok.value = packet_get_string(&strlen); | ||
189 | msg_tok.length = strlen; | ||
190 | |||
191 | /* Is there a token included? */ | ||
192 | if (packet_get_char()) { | ||
193 | recv_tok.value= | ||
194 | packet_get_string(&strlen); | ||
195 | recv_tok.length = strlen; | ||
196 | /* If we're already complete - protocol error */ | ||
197 | if (maj_status == GSS_S_COMPLETE) | ||
198 | packet_disconnect("Protocol error: received token when complete"); | ||
199 | } else { | ||
200 | /* No token included */ | ||
201 | if (maj_status != GSS_S_COMPLETE) | ||
202 | packet_disconnect("Protocol error: did not receive final token"); | ||
203 | } | ||
204 | break; | ||
205 | case SSH2_MSG_KEXGSS_ERROR: | ||
206 | debug("Received Error"); | ||
207 | maj_status = packet_get_int(); | ||
208 | min_status = packet_get_int(); | ||
209 | msg = packet_get_string(NULL); | ||
210 | lang = packet_get_string(NULL); | ||
211 | fatal("GSSAPI Error: \n%s",msg); | ||
212 | default: | ||
213 | packet_disconnect("Protocol error: didn't expect packet type %d", | ||
214 | type); | ||
215 | } | ||
216 | token_ptr = &recv_tok; | ||
217 | } else { | ||
218 | /* No data, and not complete */ | ||
219 | if (maj_status != GSS_S_COMPLETE) | ||
220 | fatal("Not complete, and no token output"); | ||
221 | } | ||
222 | } while (maj_status & GSS_S_CONTINUE_NEEDED); | ||
223 | |||
224 | /* | ||
225 | * We _must_ have received a COMPLETE message in reply from the | ||
226 | * server, which will have set dh_server_pub and msg_tok | ||
227 | */ | ||
228 | |||
229 | if (type != SSH2_MSG_KEXGSS_COMPLETE) | ||
230 | fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it"); | ||
231 | |||
232 | /* Check f in range [1, p-1] */ | ||
233 | if (!dh_pub_is_valid(dh, dh_server_pub)) | ||
234 | packet_disconnect("bad server public DH value"); | ||
235 | |||
236 | /* compute K=f^x mod p */ | ||
237 | klen = DH_size(dh); | ||
238 | kbuf = xmalloc(klen); | ||
239 | kout = DH_compute_key(kbuf, dh_server_pub, dh); | ||
240 | |||
241 | shared_secret = BN_new(); | ||
242 | BN_bin2bn(kbuf,kout, shared_secret); | ||
243 | memset(kbuf, 0, klen); | ||
244 | xfree(kbuf); | ||
245 | |||
246 | if (gex) { | ||
247 | hash = kexgex_hash( kex->client_version_string, | ||
248 | kex->server_version_string, | ||
249 | buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
250 | buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
251 | serverhostkey, slen, | ||
252 | min, nbits, max, | ||
253 | dh->p, dh->g, | ||
254 | dh->pub_key, | ||
255 | dh_server_pub, | ||
256 | shared_secret | ||
257 | ); | ||
258 | } else { | ||
259 | /* The GSS hash is identical to the DH one */ | ||
260 | hash = kex_dh_hash( kex->client_version_string, | ||
261 | kex->server_version_string, | ||
262 | buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
263 | buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
264 | serverhostkey, slen, /* server host key */ | ||
265 | dh->pub_key, /* e */ | ||
266 | dh_server_pub, /* f */ | ||
267 | shared_secret /* K */ | ||
268 | ); | ||
269 | } | ||
270 | |||
271 | gssbuf.value = hash; | ||
272 | gssbuf.length = 20; | ||
273 | |||
274 | /* Verify that the hash matches the MIC we just got. */ | ||
275 | if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok))) | ||
276 | packet_disconnect("Hash's MIC didn't verify"); | ||
277 | |||
278 | xfree(msg_tok.value); | ||
279 | |||
280 | DH_free(dh); | ||
281 | if (serverhostkey) | ||
282 | xfree(serverhostkey); | ||
283 | BN_clear_free(dh_server_pub); | ||
284 | |||
285 | /* save session id */ | ||
286 | if (kex->session_id == NULL) { | ||
287 | kex->session_id_len = 20; | ||
288 | kex->session_id = xmalloc(kex->session_id_len); | ||
289 | memcpy(kex->session_id, hash, kex->session_id_len); | ||
290 | } | ||
291 | |||
292 | if (gss_kex_context == NULL) | ||
293 | gss_kex_context = ctxt; | ||
294 | else | ||
295 | ssh_gssapi_delete_ctx(&ctxt); | ||
296 | |||
297 | kex_derive_keys(kex, hash, shared_secret); | ||
298 | BN_clear_free(shared_secret); | ||
299 | kex_finish(kex); | ||
300 | } | ||
301 | |||
302 | #endif /* GSSAPI */ | ||