From d759e6c50b8bab860dae48501cd0d7fe48ee45e7 Mon Sep 17 00:00:00 2001 From: Luke Howard Date: Mon, 21 Mar 2011 19:18:52 +1100 Subject: [PATCH] initial port of GSS generic fixes --- Makefile.in | 2 +- gss-serv-krb5.c | 199 -------------------------------------------------------- gss-serv.c | 92 ++++++++------------------ ssh-gss.h | 19 ++---- 4 files changed, 32 insertions(+), 280 deletions(-) delete mode 100644 gss-serv-krb5.c diff --git a/Makefile.in b/Makefile.in index 870a7f1..fd6cd4f 100644 --- a/Makefile.in +++ b/Makefile.in @@ -91,7 +91,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \ monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \ auth-krb5.o \ - auth2-gss.o gss-serv.o gss-serv-krb5.o \ + auth2-gss.o gss-serv.o \ loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ sftp-server.o sftp-common.o \ roaming_common.o roaming_serv.o diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c deleted file mode 100644 index 5a625ac..0000000 --- a/gss-serv-krb5.c +++ /dev/null @@ -1,199 +0,0 @@ -/* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */ - -/* - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -#include "includes.h" - -#ifdef GSSAPI -#ifdef KRB5 - -#include - -#include -#include - -#include "xmalloc.h" -#include "key.h" -#include "hostfile.h" -#include "auth.h" -#include "log.h" -#include "servconf.h" - -#include "buffer.h" -#include "ssh-gss.h" - -extern ServerOptions options; - -#ifdef HEIMDAL -# include -#else -# ifdef HAVE_GSSAPI_KRB5_H -# include -# elif HAVE_GSSAPI_GSSAPI_KRB5_H -# include -# endif -#endif - -static krb5_context krb_context = NULL; - -/* Initialise the krb5 library, for the stuff that GSSAPI won't do */ - -static int -ssh_gssapi_krb5_init(void) -{ - krb5_error_code problem; - - if (krb_context != NULL) - return 1; - - problem = krb5_init_context(&krb_context); - if (problem) { - logit("Cannot initialize krb5 context"); - return 0; - } - - return 1; -} - -/* Check if this user is OK to login. This only works with krb5 - other - * GSSAPI mechanisms will need their own. - * Returns true if the user is OK to log in, otherwise returns 0 - */ - -static int -ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name) -{ - krb5_principal princ; - int retval; - - if (ssh_gssapi_krb5_init() == 0) - return 0; - - if ((retval = krb5_parse_name(krb_context, client->exportedname.value, - &princ))) { - logit("krb5_parse_name(): %.100s", - krb5_get_err_text(krb_context, retval)); - return 0; - } - if (krb5_kuserok(krb_context, princ, name)) { - retval = 1; - logit("Authorized to %s, krb5 principal %s (krb5_kuserok)", - name, (char *)client->displayname.value); - } else - retval = 0; - - krb5_free_principal(krb_context, princ); - return retval; -} - - -/* This writes out any forwarded credentials from the structure populated - * during userauth. Called after we have setuid to the user */ - -static void -ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client) -{ - krb5_ccache ccache; - krb5_error_code problem; - krb5_principal princ; - OM_uint32 maj_status, min_status; - int len; - - if (client->creds == NULL) { - debug("No credentials stored"); - return; - } - - if (ssh_gssapi_krb5_init() == 0) - return; - -#ifdef HEIMDAL - if ((problem = krb5_cc_gen_new(krb_context, &krb5_fcc_ops, &ccache))) { - logit("krb5_cc_gen_new(): %.100s", - krb5_get_err_text(krb_context, problem)); - return; - } -#else - if ((problem = ssh_krb5_cc_gen(krb_context, &ccache))) { - logit("ssh_krb5_cc_gen(): %.100s", - krb5_get_err_text(krb_context, problem)); - return; - } -#endif /* #ifdef HEIMDAL */ - - if ((problem = krb5_parse_name(krb_context, - client->exportedname.value, &princ))) { - logit("krb5_parse_name(): %.100s", - krb5_get_err_text(krb_context, problem)); - krb5_cc_destroy(krb_context, ccache); - return; - } - - if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) { - logit("krb5_cc_initialize(): %.100s", - krb5_get_err_text(krb_context, problem)); - krb5_free_principal(krb_context, princ); - krb5_cc_destroy(krb_context, ccache); - return; - } - - krb5_free_principal(krb_context, princ); - - if ((maj_status = gss_krb5_copy_ccache(&min_status, - client->creds, ccache))) { - logit("gss_krb5_copy_ccache() failed"); - krb5_cc_destroy(krb_context, ccache); - return; - } - - client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache)); - client->store.envvar = "KRB5CCNAME"; - len = strlen(client->store.filename) + 6; - client->store.envval = xmalloc(len); - snprintf(client->store.envval, len, "FILE:%s", client->store.filename); - -#ifdef USE_PAM - if (options.use_pam) - do_pam_putenv(client->store.envvar, client->store.envval); -#endif - - krb5_cc_close(krb_context, ccache); - - return; -} - -ssh_gssapi_mech gssapi_kerberos_mech = { - "toWM5Slw5Ew8Mqkay+al2g==", - "Kerberos", - {9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"}, - NULL, - &ssh_gssapi_krb5_userok, - NULL, - &ssh_gssapi_krb5_storecreds -}; - -#endif /* KRB5 */ - -#endif /* GSSAPI */ diff --git a/gss-serv.c b/gss-serv.c index 2ec7ea1..0680ac8 100644 --- a/gss-serv.c +++ b/gss-serv.c @@ -50,22 +50,7 @@ static ssh_gssapi_client gssapi_client = { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, - GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL}}; - -ssh_gssapi_mech gssapi_null_mech = - { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL}; - -#ifdef KRB5 -extern ssh_gssapi_mech gssapi_kerberos_mech; -#endif - -ssh_gssapi_mech* supported_mechs[]= { -#ifdef KRB5 - &gssapi_kerberos_mech, -#endif - &gssapi_null_mech, -}; - + GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, {NULL, NULL, NULL}}; /* * Acquire credentials for a server running on the current host. @@ -117,25 +102,9 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) void ssh_gssapi_supported_oids(gss_OID_set *oidset) { - int i = 0; OM_uint32 min_status; - int present; - gss_OID_set supported; - - gss_create_empty_oid_set(&min_status, oidset); - gss_indicate_mechs(&min_status, &supported); - - while (supported_mechs[i]->name != NULL) { - if (GSS_ERROR(gss_test_oid_set_member(&min_status, - &supported_mechs[i]->oid, supported, &present))) - present = 0; - if (present) - gss_add_oid_set_member(&min_status, - &supported_mechs[i]->oid, oidset); - i++; - } - gss_release_oid_set(&min_status, &supported); + gss_indicate_mechs(&min_status, oidset); } @@ -246,29 +215,20 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name) OM_uint32 ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) { - int i = 0; - gss_buffer_desc ename; - client->mech = NULL; - - while (supported_mechs[i]->name != NULL) { - if (supported_mechs[i]->oid.length == ctx->oid->length && - (memcmp(supported_mechs[i]->oid.elements, - ctx->oid->elements, ctx->oid->length) == 0)) - client->mech = supported_mechs[i]; - i++; - } - - if (client->mech == NULL) - return GSS_S_FAILURE; - if ((ctx->major = gss_display_name(&ctx->minor, ctx->client, &client->displayname, NULL))) { ssh_gssapi_error(ctx); return (ctx->major); } + if ((ctx->major = gss_duplicate_name(&ctx->minor, ctx->client, + &client->name))) { + ssh_gssapi_error(ctx); + return (ctx->major); + } + if ((ctx->major = gss_export_name(&ctx->minor, ctx->client, &ename))) { ssh_gssapi_error(ctx); @@ -302,10 +262,11 @@ ssh_gssapi_cleanup_creds(void) void ssh_gssapi_storecreds(void) { - if (gssapi_client.mech && gssapi_client.mech->storecreds) { - (*gssapi_client.mech->storecreds)(&gssapi_client); - } else - debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism"); + OM_uint32 lmin; + + gss_store_cred(&lmin, gssapi_client.creds, + GSS_C_INITIATE, GSS_C_NO_OID, + 1, 1, NULL, NULL); } /* This allows GSSAPI methods to do things to the childs environment based @@ -330,26 +291,25 @@ int ssh_gssapi_userok(char *user) { OM_uint32 lmin; + int userok = 0; if (gssapi_client.exportedname.length == 0 || gssapi_client.exportedname.value == NULL) { debug("No suitable client data"); return 0; } - if (gssapi_client.mech && gssapi_client.mech->userok) - if ((*gssapi_client.mech->userok)(&gssapi_client, user)) - return 1; - else { - /* Destroy delegated credentials if userok fails */ - gss_release_buffer(&lmin, &gssapi_client.displayname); - gss_release_buffer(&lmin, &gssapi_client.exportedname); - gss_release_cred(&lmin, &gssapi_client.creds); - memset(&gssapi_client, 0, sizeof(ssh_gssapi_client)); - return 0; - } - else - debug("ssh_gssapi_userok: Unknown GSSAPI mechanism"); - return (0); + if (GSS_ERROR(gss_userok(&lmin, gssapi_client.name, user, &userok)) || + userok == 0) { + /* Destroy delegated credentials if userok fails */ + gss_release_buffer(&lmin, &gssapi_client.displayname); + gss_release_buffer(&lmin, &gssapi_client.exportedname); + gss_release_name(&lmin, &gssapi_client.name); + gss_release_cred(&lmin, &gssapi_client.creds); + memset(&gssapi_client, 0, sizeof(ssh_gssapi_client)); + return 0; + } + + return (userok); } /* Privileged */ diff --git a/ssh-gss.h b/ssh-gss.h index c29a1b7..55eabc7 100644 --- a/ssh-gss.h +++ b/ssh-gss.h @@ -42,6 +42,10 @@ # include # endif +#ifndef HEIMDAL +#include +#endif + /* MIT Kerberos doesn't seem to define GSS_NT_HOSTBASED_SERVICE */ #ifndef GSS_C_NT_HOSTBASED_SERVICE @@ -71,20 +75,10 @@ typedef struct { gss_buffer_desc displayname; gss_buffer_desc exportedname; gss_cred_id_t creds; - struct ssh_gssapi_mech_struct *mech; + gss_name_t name; ssh_gssapi_ccache store; } ssh_gssapi_client; -typedef struct ssh_gssapi_mech_struct { - char *enc_name; - char *name; - gss_OID_desc oid; - int (*dochild) (ssh_gssapi_client *); - int (*userok) (ssh_gssapi_client *, char *); - int (*localname) (ssh_gssapi_client *, char **); - void (*storecreds) (ssh_gssapi_client *); -} ssh_gssapi_mech; - typedef struct { OM_uint32 major; /* both */ OM_uint32 minor; /* both */ @@ -96,13 +90,10 @@ typedef struct { gss_cred_id_t client_creds; /* server */ } Gssctxt; -extern ssh_gssapi_mech *supported_mechs[]; - int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); void ssh_gssapi_set_oid(Gssctxt *, gss_OID); void ssh_gssapi_supported_oids(gss_OID_set *); -ssh_gssapi_mech *ssh_gssapi_get_ctype(Gssctxt *); OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *); OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int, -- 2.1.4