summaryrefslogtreecommitdiff
path: root/monitor.c
diff options
context:
space:
mode:
Diffstat (limited to 'monitor.c')
-rw-r--r--monitor.c108
1 files changed, 107 insertions, 1 deletions
diff --git a/monitor.c b/monitor.c
index 334aedde5..454767587 100644
--- a/monitor.c
+++ b/monitor.c
@@ -172,6 +172,8 @@ int mm_answer_gss_setup_ctx(int, Buffer *);
172int mm_answer_gss_accept_ctx(int, Buffer *); 172int mm_answer_gss_accept_ctx(int, Buffer *);
173int mm_answer_gss_userok(int, Buffer *); 173int mm_answer_gss_userok(int, Buffer *);
174int mm_answer_gss_checkmic(int, Buffer *); 174int mm_answer_gss_checkmic(int, Buffer *);
175int mm_answer_gss_sign(int, Buffer *);
176int mm_answer_gss_updatecreds(int, Buffer *);
175#endif 177#endif
176 178
177#ifdef SSH_AUDIT_EVENTS 179#ifdef SSH_AUDIT_EVENTS
@@ -241,6 +243,7 @@ struct mon_table mon_dispatch_proto20[] = {
241 {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx}, 243 {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
242 {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok}, 244 {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
243 {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic}, 245 {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
246 {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign},
244#endif 247#endif
245#ifdef JPAKE 248#ifdef JPAKE
246 {MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata}, 249 {MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata},
@@ -253,6 +256,12 @@ struct mon_table mon_dispatch_proto20[] = {
253}; 256};
254 257
255struct mon_table mon_dispatch_postauth20[] = { 258struct mon_table mon_dispatch_postauth20[] = {
259#ifdef GSSAPI
260 {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx},
261 {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
262 {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign},
263 {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds},
264#endif
256 {MONITOR_REQ_MODULI, 0, mm_answer_moduli}, 265 {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
257 {MONITOR_REQ_SIGN, 0, mm_answer_sign}, 266 {MONITOR_REQ_SIGN, 0, mm_answer_sign},
258 {MONITOR_REQ_PTY, 0, mm_answer_pty}, 267 {MONITOR_REQ_PTY, 0, mm_answer_pty},
@@ -357,6 +366,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
357 /* Permit requests for moduli and signatures */ 366 /* Permit requests for moduli and signatures */
358 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); 367 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
359 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); 368 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
369#ifdef GSSAPI
370 /* and for the GSSAPI key exchange */
371 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
372#endif
360 } else { 373 } else {
361 mon_dispatch = mon_dispatch_proto15; 374 mon_dispatch = mon_dispatch_proto15;
362 375
@@ -443,6 +456,10 @@ monitor_child_postauth(struct monitor *pmonitor)
443 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); 456 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
444 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); 457 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
445 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); 458 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
459#ifdef GSSAPI
460 /* and for the GSSAPI key exchange */
461 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
462#endif
446 } else { 463 } else {
447 mon_dispatch = mon_dispatch_postauth15; 464 mon_dispatch = mon_dispatch_postauth15;
448 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); 465 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -1691,6 +1708,13 @@ mm_get_kex(Buffer *m)
1691 kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; 1708 kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
1692 kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; 1709 kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
1693 kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; 1710 kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
1711#ifdef GSSAPI
1712 if (options.gss_keyex) {
1713 kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
1714 kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
1715 kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
1716 }
1717#endif
1694 kex->server = 1; 1718 kex->server = 1;
1695 kex->hostkey_type = buffer_get_int(m); 1719 kex->hostkey_type = buffer_get_int(m);
1696 kex->kex_type = buffer_get_int(m); 1720 kex->kex_type = buffer_get_int(m);
@@ -1897,6 +1921,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
1897 OM_uint32 major; 1921 OM_uint32 major;
1898 u_int len; 1922 u_int len;
1899 1923
1924 if (!options.gss_authentication && !options.gss_keyex)
1925 fatal("In GSSAPI monitor when GSSAPI is disabled");
1926
1900 goid.elements = buffer_get_string(m, &len); 1927 goid.elements = buffer_get_string(m, &len);
1901 goid.length = len; 1928 goid.length = len;
1902 1929
@@ -1924,6 +1951,9 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
1924 OM_uint32 flags = 0; /* GSI needs this */ 1951 OM_uint32 flags = 0; /* GSI needs this */
1925 u_int len; 1952 u_int len;
1926 1953
1954 if (!options.gss_authentication && !options.gss_keyex)
1955 fatal("In GSSAPI monitor when GSSAPI is disabled");
1956
1927 in.value = buffer_get_string(m, &len); 1957 in.value = buffer_get_string(m, &len);
1928 in.length = len; 1958 in.length = len;
1929 major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags); 1959 major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
@@ -1941,6 +1971,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
1941 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0); 1971 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
1942 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); 1972 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
1943 monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1); 1973 monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
1974 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1);
1944 } 1975 }
1945 return (0); 1976 return (0);
1946} 1977}
@@ -1952,6 +1983,9 @@ mm_answer_gss_checkmic(int sock, Buffer *m)
1952 OM_uint32 ret; 1983 OM_uint32 ret;
1953 u_int len; 1984 u_int len;
1954 1985
1986 if (!options.gss_authentication && !options.gss_keyex)
1987 fatal("In GSSAPI monitor when GSSAPI is disabled");
1988
1955 gssbuf.value = buffer_get_string(m, &len); 1989 gssbuf.value = buffer_get_string(m, &len);
1956 gssbuf.length = len; 1990 gssbuf.length = len;
1957 mic.value = buffer_get_string(m, &len); 1991 mic.value = buffer_get_string(m, &len);
@@ -1978,7 +2012,11 @@ mm_answer_gss_userok(int sock, Buffer *m)
1978{ 2012{
1979 int authenticated; 2013 int authenticated;
1980 2014
1981 authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user); 2015 if (!options.gss_authentication && !options.gss_keyex)
2016 fatal("In GSSAPI monitor when GSSAPI is disabled");
2017
2018 authenticated = authctxt->valid &&
2019 ssh_gssapi_userok(authctxt->user, authctxt->pw);
1982 2020
1983 buffer_clear(m); 2021 buffer_clear(m);
1984 buffer_put_int(m, authenticated); 2022 buffer_put_int(m, authenticated);
@@ -1991,6 +2029,74 @@ mm_answer_gss_userok(int sock, Buffer *m)
1991 /* Monitor loop will terminate if authenticated */ 2029 /* Monitor loop will terminate if authenticated */
1992 return (authenticated); 2030 return (authenticated);
1993} 2031}
2032
2033int
2034mm_answer_gss_sign(int socket, Buffer *m)
2035{
2036 gss_buffer_desc data;
2037 gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
2038 OM_uint32 major, minor;
2039 u_int len;
2040
2041 if (!options.gss_authentication && !options.gss_keyex)
2042 fatal("In GSSAPI monitor when GSSAPI is disabled");
2043
2044 data.value = buffer_get_string(m, &len);
2045 data.length = len;
2046 if (data.length != 20)
2047 fatal("%s: data length incorrect: %d", __func__,
2048 (int) data.length);
2049
2050 /* Save the session ID on the first time around */
2051 if (session_id2_len == 0) {
2052 session_id2_len = data.length;
2053 session_id2 = xmalloc(session_id2_len);
2054 memcpy(session_id2, data.value, session_id2_len);
2055 }
2056 major = ssh_gssapi_sign(gsscontext, &data, &hash);
2057
2058 xfree(data.value);
2059
2060 buffer_clear(m);
2061 buffer_put_int(m, major);
2062 buffer_put_string(m, hash.value, hash.length);
2063
2064 mm_request_send(socket, MONITOR_ANS_GSSSIGN, m);
2065
2066 gss_release_buffer(&minor, &hash);
2067
2068 /* Turn on getpwnam permissions */
2069 monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
2070
2071 /* And credential updating, for when rekeying */
2072 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1);
2073
2074 return (0);
2075}
2076
2077int
2078mm_answer_gss_updatecreds(int socket, Buffer *m) {
2079 ssh_gssapi_ccache store;
2080 int ok;
2081
2082 store.filename = buffer_get_string(m, NULL);
2083 store.envvar = buffer_get_string(m, NULL);
2084 store.envval = buffer_get_string(m, NULL);
2085
2086 ok = ssh_gssapi_update_creds(&store);
2087
2088 xfree(store.filename);
2089 xfree(store.envvar);
2090 xfree(store.envval);
2091
2092 buffer_clear(m);
2093 buffer_put_int(m, ok);
2094
2095 mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m);
2096
2097 return(0);
2098}
2099
1994#endif /* GSSAPI */ 2100#endif /* GSSAPI */
1995 2101
1996#ifdef JPAKE 2102#ifdef JPAKE