1 /* $OpenBSD: gss-genr.c,v 1.23 2015/01/20 23:14:00 deraadt Exp $ */ 2 3 /* 4 * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25 */ 26 27 #include "includes.h" 28 29 #ifdef GSSAPI 30 31 #include <sys/types.h> 32 #include <sys/param.h> 33 34 #include <limits.h> 35 #include <stdarg.h> 36 #include <string.h> 37 #include <signal.h> 38 #include <unistd.h> 39 40 #include "xmalloc.h" 41 #include "buffer.h" 42 #include "log.h" 43 #include "ssh2.h" 44 45 #include "ssh-gss.h" 46 47 extern u_char *session_id2; 48 extern u_int session_id2_len; 49 50 /* Check that the OID in a data stream matches that in the context */ 51 int 52 ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len) 53 { 54 return (ctx != NULL && ctx->oid != GSS_C_NO_OID && 55 ctx->oid->length == len && 56 memcmp(ctx->oid->elements, data, len) == 0); 57 } 58 59 /* Set the contexts OID from a data stream */ 60 void 61 ssh_gssapi_set_oid_data(Gssctxt *ctx, void *data, size_t len) 62 { 63 if (ctx->oid != GSS_C_NO_OID) { 64 free(ctx->oid->elements); 65 free(ctx->oid); 66 } 67 ctx->oid = xcalloc(1, sizeof(gss_OID_desc)); 68 ctx->oid->length = len; 69 ctx->oid->elements = xmalloc(len); 70 memcpy(ctx->oid->elements, data, len); 71 } 72 73 /* Set the contexts OID */ 74 void 75 ssh_gssapi_set_oid(Gssctxt *ctx, gss_OID oid) 76 { 77 ssh_gssapi_set_oid_data(ctx, oid->elements, oid->length); 78 } 79 80 /* All this effort to report an error ... */ 81 void 82 ssh_gssapi_error(Gssctxt *ctxt) 83 { 84 char *s; 85 86 s = ssh_gssapi_last_error(ctxt, NULL, NULL); 87 debug("%s", s); 88 free(s); 89 } 90 91 char * 92 ssh_gssapi_last_error(Gssctxt *ctxt, OM_uint32 *major_status, 93 OM_uint32 *minor_status) 94 { 95 OM_uint32 lmin; 96 gss_buffer_desc msg = GSS_C_EMPTY_BUFFER; 97 OM_uint32 ctx; 98 Buffer b; 99 char *ret; 100 101 buffer_init(&b); 102 103 if (major_status != NULL) 104 *major_status = ctxt->major; 105 if (minor_status != NULL) 106 *minor_status = ctxt->minor; 107 108 ctx = 0; 109 /* The GSSAPI error */ 110 do { 111 gss_display_status(&lmin, ctxt->major, 112 GSS_C_GSS_CODE, ctxt->oid, &ctx, &msg); 113 114 buffer_append(&b, msg.value, msg.length); 115 buffer_put_char(&b, '\n'); 116 117 gss_release_buffer(&lmin, &msg); 118 } while (ctx != 0); 119 120 /* The mechanism specific error */ 121 do { 122 gss_display_status(&lmin, ctxt->minor, 123 GSS_C_MECH_CODE, ctxt->oid, &ctx, &msg); 124 125 buffer_append(&b, msg.value, msg.length); 126 buffer_put_char(&b, '\n'); 127 128 gss_release_buffer(&lmin, &msg); 129 } while (ctx != 0); 130 131 buffer_put_char(&b, '\0'); 132 ret = xmalloc(buffer_len(&b)); 133 buffer_get(&b, ret, buffer_len(&b)); 134 buffer_free(&b); 135 return (ret); 136 } 137 138 /* 139 * Initialise our GSSAPI context. We use this opaque structure to contain all 140 * of the data which both the client and server need to persist across 141 * {accept,init}_sec_context calls, so that when we do it from the userauth 142 * stuff life is a little easier 143 */ 144 void 145 ssh_gssapi_build_ctx(Gssctxt **ctx) 146 { 147 *ctx = xcalloc(1, sizeof (Gssctxt)); 148 (*ctx)->context = GSS_C_NO_CONTEXT; 149 (*ctx)->name = GSS_C_NO_NAME; 150 (*ctx)->oid = GSS_C_NO_OID; 151 (*ctx)->creds = GSS_C_NO_CREDENTIAL; 152 (*ctx)->client = GSS_C_NO_NAME; 153 (*ctx)->client_creds = GSS_C_NO_CREDENTIAL; 154 } 155 156 /* Delete our context, providing it has been built correctly */ 157 void 158 ssh_gssapi_delete_ctx(Gssctxt **ctx) 159 { 160 OM_uint32 ms; 161 162 if ((*ctx) == NULL) 163 return; 164 if ((*ctx)->context != GSS_C_NO_CONTEXT) 165 gss_delete_sec_context(&ms, &(*ctx)->context, GSS_C_NO_BUFFER); 166 if ((*ctx)->name != GSS_C_NO_NAME) 167 gss_release_name(&ms, &(*ctx)->name); 168 if ((*ctx)->oid != GSS_C_NO_OID) { 169 free((*ctx)->oid->elements); 170 free((*ctx)->oid); 171 (*ctx)->oid = GSS_C_NO_OID; 172 } 173 if ((*ctx)->creds != GSS_C_NO_CREDENTIAL) 174 gss_release_cred(&ms, &(*ctx)->creds); 175 if ((*ctx)->client != GSS_C_NO_NAME) 176 gss_release_name(&ms, &(*ctx)->client); 177 if ((*ctx)->client_creds != GSS_C_NO_CREDENTIAL) 178 gss_release_cred(&ms, &(*ctx)->client_creds); 179 180 free(*ctx); 181 *ctx = NULL; 182 } 183 184 /* 185 * Wrapper to init_sec_context 186 * Requires that the context contains: 187 * oid 188 * server name (from ssh_gssapi_import_name) 189 */ 190 OM_uint32 191 ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok, 192 gss_buffer_desc* send_tok, OM_uint32 *flags) 193 { 194 int deleg_flag = 0; 195 196 if (deleg_creds) { 197 deleg_flag = GSS_C_DELEG_FLAG; 198 debug("Delegating credentials"); 199 } 200 201 ctx->major = gss_init_sec_context(&ctx->minor, 202 GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid, 203 GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag, 204 0, NULL, recv_tok, NULL, send_tok, flags, NULL); 205 206 if (GSS_ERROR(ctx->major)) 207 ssh_gssapi_error(ctx); 208 209 return (ctx->major); 210 } 211 212 /* Create a service name for the given host */ 213 OM_uint32 214 ssh_gssapi_import_name(Gssctxt *ctx, const char *host) 215 { 216 gss_buffer_desc gssbuf; 217 char *val; 218 219 xasprintf(&val, "host@%s", host); 220 gssbuf.value = val; 221 gssbuf.length = strlen(gssbuf.value); 222 223 if ((ctx->major = gss_import_name(&ctx->minor, 224 &gssbuf, GSS_C_NT_HOSTBASED_SERVICE, &ctx->name))) 225 ssh_gssapi_error(ctx); 226 227 free(gssbuf.value); 228 return (ctx->major); 229 } 230 231 OM_uint32 232 ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash) 233 { 234 if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context, 235 GSS_C_QOP_DEFAULT, buffer, hash))) 236 ssh_gssapi_error(ctx); 237 238 return (ctx->major); 239 } 240 241 void 242 ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service, 243 const char *context) 244 { 245 buffer_init(b); 246 buffer_put_string(b, session_id2, session_id2_len); 247 buffer_put_char(b, SSH2_MSG_USERAUTH_REQUEST); 248 buffer_put_cstring(b, user); 249 buffer_put_cstring(b, service); 250 buffer_put_cstring(b, context); 251 } 252 253 int 254 ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host) 255 { 256 gss_buffer_desc token = GSS_C_EMPTY_BUFFER; 257 OM_uint32 major, minor; 258 gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"}; 259 260 /* RFC 4462 says we MUST NOT do SPNEGO */ 261 if (oid->length == spnego_oid.length && 262 (memcmp(oid->elements, spnego_oid.elements, oid->length) == 0)) 263 return 0; /* false */ 264 265 ssh_gssapi_build_ctx(ctx); 266 ssh_gssapi_set_oid(*ctx, oid); 267 major = ssh_gssapi_import_name(*ctx, host); 268 if (!GSS_ERROR(major)) { 269 major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 270 NULL); 271 gss_release_buffer(&minor, &token); 272 if ((*ctx)->context != GSS_C_NO_CONTEXT) 273 gss_delete_sec_context(&minor, &(*ctx)->context, 274 GSS_C_NO_BUFFER); 275 } 276 277 if (GSS_ERROR(major)) 278 ssh_gssapi_delete_ctx(ctx); 279 280 return (!GSS_ERROR(major)); 281 } 282 283 #endif /* GSSAPI */ 284