20110101

  - Finally update for OpenSSH 5.6p1

  - Add GSSAPIServerIdentity option from Jim Basney

20100308

  - [ Makefile.in, key.c, key.h ]

    Updates for OpenSSH 5.4p1

  - [ servconf.c ]

    Include GSSAPI options in the sshd -T configuration dump, and flag

    some older configuration options as being unsupported. Thanks to Colin 

    Watson.

  -

20100124

  - [ sshconnect2.c ]

    Adapt to deal with additional element in Authmethod structure. Thanks to

    Colin Watson

20090615

  - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c

      sshd.c ]

    Fix issues identified by Greg Hudson following a code review

	Check return value of gss_indicate_mechs

	Protect GSSAPI calls in monitor, so they can only be used if enabled

	Check return values of bignum functions in key exchange

	Use BN_clear_free to clear other side's DH value

	Make ssh_gssapi_id_kex more robust

	Only configure kex table pointers if GSSAPI is enabled

	Don't leak mechanism list, or gss mechanism list

	Cast data.length before printing

	If serverkey isn't provided, use an empty string, rather than NULL

20090201

  - [ gss-genr.c gss-serv.c kex.h kexgssc.c readconf.c readconf.h ssh-gss.h

      ssh_config.5 sshconnet2.c ]

    Add support for the GSSAPIClientIdentity option, which allows the user

    to specify which GSSAPI identity to use to contact a given server

20080404

  - [ gss-serv.c ]

    Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow

    been omitted from a previous version of this patch. Reported by Borislav

    Stoichkov

20070317

  - [ gss-serv-krb5.c ]

    Remove C99ism, where new_ccname was being declared in the middle of a 

    function

20061220

  - [ servconf.c ]

    Make default for GSSAPIStrictAcceptorCheck be Yes, to match previous, and 

    documented, behaviour. Reported by Dan Watson.

20060910

  - [ gss-genr.c kexgssc.c kexgsss.c kex.h monitor.c sshconnect2.c sshd.c

      ssh-gss.h ]

    add support for gss-group14-sha1 key exchange mechanisms

  - [ gss-serv.c servconf.c servconf.h sshd_config sshd_config.5 ]

    Add GSSAPIStrictAcceptorCheck option to allow the disabling of

    acceptor principal checking on multi-homed machines.

    <Bugzilla #928>

  - [ sshd_config ssh_config ]

    Add settings for GSSAPIKeyExchange and GSSAPITrustDNS to the sample

    configuration files

  - [ kexgss.c kegsss.c sshconnect2.c sshd.c ]

    Code cleanup. Replace strlen/xmalloc/snprintf sequences with xasprintf()

    Limit length of error messages displayed by client

20060909

  - [ gss-genr.c gss-serv.c ]

    move ssh_gssapi_acquire_cred() and ssh_gssapi_server_ctx to be server

    only, where they belong 

    <Bugzilla #1225>

20060829

  - [ gss-serv-krb5.c ]

    Fix CCAPI credentials cache name when creating KRB5CCNAME environment 

    variable

20060828

  - [ gss-genr.c ]

    Avoid Heimdal context freeing problem

    <Fixed upstream 20060829>

20060818

  - [ gss-genr.c ssh-gss.h sshconnect2.c ]

    Make sure that SPENGO is disabled 

    <Bugzilla #1218 - Fixed upstream 20060818>

20060421

  - [ gssgenr.c, sshconnect2.c ]

    a few type changes (signed versus unsigned, int versus size_t) to

    fix compiler errors/warnings 

    (from jbasney AT ncsa.uiuc.edu)

  - [ kexgssc.c, sshconnect2.c ]

    fix uninitialized variable warnings

    (from jbasney AT ncsa.uiuc.edu)

  - [ gssgenr.c ]

    pass oid to gss_display_status (helpful when using GSSAPI mechglue)

    (from jbasney AT ncsa.uiuc.edu)

    <Bugzilla #1220 >

  - [ gss-serv-krb5.c ]

    #ifdef HAVE_GSSAPI_KRB5 should be #ifdef HAVE_GSSAPI_KRB5_H

    (from jbasney AT ncsa.uiuc.edu)

    <Fixed upstream 20060304>

  - [ readconf.c, readconf.h, ssh_config.5, sshconnect2.c 

    add client-side GssapiKeyExchange option

    (from jbasney AT ncsa.uiuc.edu)

  - [ sshconnect2.c ]

    add support for GssapiTrustDns option for gssapi-with-mic

    (from jbasney AT ncsa.uiuc.edu)

    <gssapi-with-mic support is Bugzilla #1008>

#ifdef USE_CCAPI

	snprintf(authctxt->krb5_ccname, len, "API:%s",

	    authctxt->krb5_ticket_file);

#else

#endif

#ifdef USE_CCAPI

	char cctemplate[] = "API:krb5cc_%d";

#else

	char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";

	int tmpfd;

#endif

#ifndef USE_CCAPI

#endif

/* 

 * The 'gssapi_keyex' userauth mechanism.

 */

static int

userauth_gsskeyex(Authctxt *authctxt)

{

	int authenticated = 0;

	Buffer b;

	gss_buffer_desc mic, gssbuf;

	u_int len;

	mic.value = packet_get_string(&len);

	mic.length = len;

	packet_check_eom();

	ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,

	    "gssapi-keyex");

	gssbuf.value = buffer_ptr(&b);

	gssbuf.length = buffer_len(&b);

	/* gss_kex_context is NULL with privsep, so we can't check it here */

	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 

	    &gssbuf, &mic))))

		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,

		    authctxt->pw));

	buffer_free(&b);

	free(mic.value);

	return (authenticated);

}

Authmethod method_gsskeyex = {

	"gssapi-keyex",

	userauth_gsskeyex,

	&options.gss_authentication

};

extern Authmethod method_gsskeyex;

	&method_gsskeyex,

#ifdef GSSAPI

#include "ssh-gss.h"

#endif

#ifdef GSSAPI

			if (options.gss_renewal_rekey &&

			    ssh_gssapi_credentials_updated(NULL)) {

				debug("credentials updated - forcing rekey");

				need_rekeying = 1;

			}

#endif

/* platform uses an in-memory credentials cache */

#undef USE_CCAPI

/* platform has the Security Authorization Session API */

#undef USE_SECURITY_SESSION_API

	AC_MSG_CHECKING([if we have the Security Authorization Session API])

	AC_TRY_COMPILE([#include <Security/AuthSession.h>],

		[SessionCreate(0, 0);],

		[ac_cv_use_security_session_api="yes"

		 AC_DEFINE([USE_SECURITY_SESSION_API], [1], 

			[platform has the Security Authorization Session API])

		 LIBS="$LIBS -framework Security"

		 AC_MSG_RESULT([yes])],

		[ac_cv_use_security_session_api="no"

		 AC_MSG_RESULT([no])])

	AC_MSG_CHECKING([if we have an in-memory credentials cache])

	AC_TRY_COMPILE(

		[#include <Kerberos/Kerberos.h>],

		[cc_context_t c;

		 (void) cc_initialize (&c, 0, NULL, NULL);],

		[AC_DEFINE([USE_CCAPI], [1], 

			[platform uses an in-memory credentials cache])

		 LIBS="$LIBS -framework Security"

		 AC_MSG_RESULT([yes])

		 if test "x$ac_cv_use_security_session_api" = "xno"; then

			AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***])

		fi],

		[AC_MSG_RESULT([no])]

	)

#include "cipher.h"

#include "key.h"

#include "kex.h"

#include <openssl/evp.h>

typedef struct {

	char *encoded;

	gss_OID oid;

} ssh_gss_kex_mapping;

/*

 * XXX - It would be nice to find a more elegant way of handling the

 * XXX   passing of the key exchange context to the userauth routines

 */

Gssctxt *gss_kex_context = NULL;

static ssh_gss_kex_mapping *gss_enc2oid = NULL;

int 

ssh_gssapi_oid_table_ok(void) {

	return (gss_enc2oid != NULL);

}

/*

 * Return a list of the gss-group1-sha1 mechanisms supported by this program

 *

 * We test mechanisms to ensure that we can use them, to avoid starting

 * a key exchange with a bad mechanism

 */

char *

ssh_gssapi_client_mechanisms(const char *host, const char *client) {

	gss_OID_set gss_supported;

	OM_uint32 min_status;

	if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))

		return NULL;

	return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,

	    host, client));

}

char *

ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,

    const char *host, const char *client) {

	Buffer buf;

	size_t i;

	int oidpos, enclen;

	char *mechs, *encoded;

	u_char digest[EVP_MAX_MD_SIZE];

	char deroid[2];

	const EVP_MD *evp_md = EVP_md5();

	EVP_MD_CTX md;

	if (gss_enc2oid != NULL) {

		for (i = 0; gss_enc2oid[i].encoded != NULL; i++)

			free(gss_enc2oid[i].encoded);

		free(gss_enc2oid);

	}

	gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) *

	    (gss_supported->count + 1));

	buffer_init(&buf);

	oidpos = 0;

	for (i = 0; i < gss_supported->count; i++) {

		if (gss_supported->elements[i].length < 128 &&

		    (*check)(NULL, &(gss_supported->elements[i]), host, client)) {

			deroid[0] = SSH_GSS_OIDTYPE;

			deroid[1] = gss_supported->elements[i].length;

			EVP_DigestInit(&md, evp_md);

			EVP_DigestUpdate(&md, deroid, 2);

			EVP_DigestUpdate(&md,

			    gss_supported->elements[i].elements,

			    gss_supported->elements[i].length);

			EVP_DigestFinal(&md, digest, NULL);

			encoded = xmalloc(EVP_MD_size(evp_md) * 2);

			enclen = __b64_ntop(digest, EVP_MD_size(evp_md),

			    encoded, EVP_MD_size(evp_md) * 2);

			if (oidpos != 0)

				buffer_put_char(&buf, ',');

			buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,

			    sizeof(KEX_GSS_GEX_SHA1_ID) - 1);

			buffer_append(&buf, encoded, enclen);

			buffer_put_char(&buf, ',');

			buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 

			    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1);

			buffer_append(&buf, encoded, enclen);

			buffer_put_char(&buf, ',');

			buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID,

			    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1);

			buffer_append(&buf, encoded, enclen);

			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);

			gss_enc2oid[oidpos].encoded = encoded;

			oidpos++;

		}

	}

	gss_enc2oid[oidpos].oid = NULL;

	gss_enc2oid[oidpos].encoded = NULL;

	buffer_put_char(&buf, '\0');

	mechs = xmalloc(buffer_len(&buf));

	buffer_get(&buf, mechs, buffer_len(&buf));

	buffer_free(&buf);

	if (strlen(mechs) == 0) {

		free(mechs);

		mechs = NULL;

	}

	return (mechs);

}

gss_OID

ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {

	int i = 0;

	switch (kex_type) {

	case KEX_GSS_GRP1_SHA1:

		if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID))

			return GSS_C_NO_OID;

		name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1;

		break;

	case KEX_GSS_GRP14_SHA1:

		if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID))

			return GSS_C_NO_OID;

		name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;

		break;

	case KEX_GSS_GEX_SHA1:

		if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))

			return GSS_C_NO_OID;

		name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;

		break;

	default:

		return GSS_C_NO_OID;

	}

	while (gss_enc2oid[i].encoded != NULL &&

	    strcmp(name, gss_enc2oid[i].encoded) != 0)

		i++;

	if (gss_enc2oid[i].oid != NULL && ctx != NULL)

		ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);

	return gss_enc2oid[i].oid;

}

ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)

{

	gss_buffer_desc gssbuf;

	gss_name_t gssname;

	OM_uint32 status;

	gss_OID_set oidset;

	gssbuf.value = (void *) name;

	gssbuf.length = strlen(gssbuf.value);

	gss_create_empty_oid_set(&status, &oidset);

	gss_add_oid_set_member(&status, ctx->oid, &oidset);

	ctx->major = gss_import_name(&ctx->minor, &gssbuf,

	    GSS_C_NT_USER_NAME, &gssname);

	if (!ctx->major)

		ctx->major = gss_acquire_cred(&ctx->minor, 

		    gssname, 0, oidset, GSS_C_INITIATE, 

		    &ctx->client_creds, NULL, NULL);

	gss_release_name(&status, &gssname);

	gss_release_oid_set(&status, &oidset);

	if (ctx->major)

		ssh_gssapi_error(ctx);

	return(ctx->major);

}

OM_uint32

	if (ctx == NULL) 

		return -1;

/* Priviledged when used by server */

OM_uint32

ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)

{

	if (ctx == NULL)

		return -1;

	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,

	    gssbuf, gssmic, NULL);

	return (ctx->major);

}

	Gssctxt *intctx = NULL;

	if (ctx == NULL)

		ctx = &intctx;

	if (!GSS_ERROR(major) && client)

		major = ssh_gssapi_client_identity(*ctx, client);

int

ssh_gssapi_credentials_updated(Gssctxt *ctxt) {

	static gss_name_t saved_name = GSS_C_NO_NAME;

	static OM_uint32 saved_lifetime = 0;

	static gss_OID saved_mech = GSS_C_NO_OID;

	static gss_name_t name;

	static OM_uint32 last_call = 0;

	OM_uint32 lifetime, now, major, minor;

	int equal;

	now = time(NULL);

	if (ctxt) {

		debug("Rekey has happened - updating saved versions");

		if (saved_name != GSS_C_NO_NAME)

			gss_release_name(&minor, &saved_name);

		major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,

		    &saved_name, &saved_lifetime, NULL, NULL);

		if (!GSS_ERROR(major)) {

			saved_mech = ctxt->oid;

		        saved_lifetime+= now;

		} else {

			/* Handle the error */

		}

		return 0;

	}

	if (now - last_call < 10)

		return 0;

	last_call = now;

	if (saved_mech == GSS_C_NO_OID)

		return 0;

	major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, 

	    &name, &lifetime, NULL, NULL);

	if (major == GSS_S_CREDENTIALS_EXPIRED)

		return 0;

	else if (GSS_ERROR(major))

		return 0;

	major = gss_compare_name(&minor, saved_name, name, &equal);

	gss_release_name(&minor, &name);

	if (GSS_ERROR(major))

		return 0;

	if (equal && (saved_lifetime < lifetime + now - 10))

		return 1;

	return 0;

}

	const char *new_ccname;

int

ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, 

    ssh_gssapi_client *client)

{

	krb5_ccache ccache = NULL;

	krb5_principal principal = NULL;

	char *name = NULL;

	krb5_error_code problem;

	OM_uint32 maj_status, min_status;

   	if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {

                logit("krb5_cc_resolve(): %.100s",

                    krb5_get_err_text(krb_context, problem));

                return 0;

       	}

	/* Find out who the principal in this cache is */

	if ((problem = krb5_cc_get_principal(krb_context, ccache, 

	    &principal))) {

		logit("krb5_cc_get_principal(): %.100s",

		    krb5_get_err_text(krb_context, problem));

		krb5_cc_close(krb_context, ccache);

		return 0;

	}

	if ((problem = krb5_unparse_name(krb_context, principal, &name))) {

		logit("krb5_unparse_name(): %.100s",

		    krb5_get_err_text(krb_context, problem));

		krb5_free_principal(krb_context, principal);

		krb5_cc_close(krb_context, ccache);

		return 0;

	}

	if (strcmp(name,client->exportedname.value)!=0) {

		debug("Name in local credentials cache differs. Not storing");

		krb5_free_principal(krb_context, principal);

		krb5_cc_close(krb_context, ccache);

		krb5_free_unparsed_name(krb_context, name);

		return 0;

	}

	krb5_free_unparsed_name(krb_context, name);

	/* Name matches, so lets get on with it! */

	if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) {

		logit("krb5_cc_initialize(): %.100s",

		    krb5_get_err_text(krb_context, problem));

		krb5_free_principal(krb_context, principal);

		krb5_cc_close(krb_context, ccache);

		return 0;

	}

	krb5_free_principal(krb_context, principal);

	if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds,

	    ccache))) {

		logit("gss_krb5_copy_ccache() failed. Sorry!");

		krb5_cc_close(krb_context, ccache);

		return 0;

	}

	return 1;

}

#include "uidswap.h"

#include "monitor_wrap.h"

extern ServerOptions options;

char *

ssh_gssapi_server_mechanisms(void) {

	gss_OID_set	supported;

	ssh_gssapi_supported_oids(&supported);

	return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech,

	    NULL, NULL));

}

/* Unprivileged */

int

ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data,

    const char *dummy) {

	Gssctxt *ctx = NULL;

	int res;

	res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));

	ssh_gssapi_delete_ctx(&ctx);

	return (res);

}

/* Unprivileged */

	int equal = 0;

	gss_name_t new_name = GSS_C_NO_NAME;

	gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;

	if (options.gss_store_rekey && client->used && ctx->client_creds) {

		if (client->mech->oid.length != ctx->oid->length ||

		    (memcmp(client->mech->oid.elements,

		     ctx->oid->elements, ctx->oid->length) !=0)) {

			debug("Rekeyed credentials have different mechanism");

			return GSS_S_COMPLETE;

		}

		if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, 

		    ctx->client_creds, ctx->oid, &new_name, 

		    NULL, NULL, NULL))) {

			ssh_gssapi_error(ctx);

			return (ctx->major);

		}

		ctx->major = gss_compare_name(&ctx->minor, client->name, 

		    new_name, &equal);

		if (GSS_ERROR(ctx->major)) {

			ssh_gssapi_error(ctx);

			return (ctx->major);

		}

		if (!equal) {

			debug("Rekeyed credentials have different name");

			return GSS_S_COMPLETE;

		}

	if (ctx->client_creds &&

	    (ctx->major = gss_inquire_cred_by_mech(&ctx->minor,

	     ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) {

		ssh_gssapi_error(ctx);

		return (ctx->major);

	}

	gss_release_buffer(&ctx->minor, &ename);

#ifdef GSSAPI

#include "ssh-gss.h"

#endif

static const struct kexalg kexalg_prefixes[] = {

#ifdef GSSAPI

	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },

	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },

	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },

#endif

	{ NULL, -1, -1, -1 },

};

	for (k = kexalg_prefixes; k->name != NULL; k++) {

		if (strncmp(k->name, name, strlen(k->name)) == 0)

			return k;

	}

	KEX_GSS_GRP1_SHA1,

	KEX_GSS_GRP14_SHA1,

	KEX_GSS_GEX_SHA1,

#ifdef GSSAPI

	int	gss_deleg_creds;

	int	gss_trust_dns;

	char    *gss_host;

	char	*gss_client;

#endif

#ifdef GSSAPI

int	 kexgss_client(struct ssh *);

int	 kexgss_server(struct ssh *);

#endif

/*

 * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#include "includes.h"

#ifdef GSSAPI

#include "includes.h"

#include <openssl/crypto.h>

#include <openssl/bn.h>

#include <string.h>

#include "xmalloc.h"

#include "buffer.h"

#include "ssh2.h"

#include "key.h"

#include "cipher.h"

#include "kex.h"

#include "log.h"

#include "packet.h"

#include "dh.h"

#include "digest.h"

#include "ssh-gss.h"

int

kexgss_client(struct ssh *ssh) {

	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;

	gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;

	Gssctxt *ctxt;

	OM_uint32 maj_status, min_status, ret_flags;

	u_int klen, kout, slen = 0, strlen;

	DH *dh; 

	BIGNUM *dh_server_pub = NULL;

	BIGNUM *shared_secret = NULL;

	BIGNUM *p = NULL;

	BIGNUM *g = NULL;	

	u_char *kbuf;

	u_char *serverhostkey = NULL;

	u_char *empty = "";

	char *msg;

	int type = 0;

	int first = 1;

	int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;

	u_char hash[SSH_DIGEST_MAX_LENGTH];

	size_t hashlen;

	/* Initialise our GSSAPI world */	

	ssh_gssapi_build_ctx(&ctxt);

	if (ssh_gssapi_id_kex(ctxt, ssh->kex->name, ssh->kex->kex_type) 

	    == GSS_C_NO_OID)

		fatal("Couldn't identify host exchange");

	if (ssh_gssapi_import_name(ctxt, ssh->kex->gss_host))

		fatal("Couldn't import hostname");

	if (ssh->kex->gss_client && 

	    ssh_gssapi_client_identity(ctxt, ssh->kex->gss_client))

		fatal("Couldn't acquire client credentials");

	switch (ssh->kex->kex_type) {

	case KEX_GSS_GRP1_SHA1:

		dh = dh_new_group1();

		break;

	case KEX_GSS_GRP14_SHA1:

		dh = dh_new_group14();

		break;

	case KEX_GSS_GEX_SHA1:

		debug("Doing group exchange\n");

		nbits = dh_estimate(ssh->kex->we_need * 8);

		packet_start(SSH2_MSG_KEXGSS_GROUPREQ);

		packet_put_int(min);

		packet_put_int(nbits);

		packet_put_int(max);

		packet_send();

		packet_read_expect(SSH2_MSG_KEXGSS_GROUP);

		if ((p = BN_new()) == NULL)

			fatal("BN_new() failed");

		packet_get_bignum2(p);

		if ((g = BN_new()) == NULL)

			fatal("BN_new() failed");

		packet_get_bignum2(g);

		packet_check_eom();

		if (BN_num_bits(p) < min || BN_num_bits(p) > max)

			fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",

			    min, BN_num_bits(p), max);

		dh = dh_new_group(g, p);

		break;

	default:

		fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);

	}

	/* Step 1 - e is dh->pub_key */

	dh_gen_key(dh, ssh->kex->we_need * 8);

	/* This is f, we initialise it now to make life easier */

	dh_server_pub = BN_new();

	if (dh_server_pub == NULL)

		fatal("dh_server_pub == NULL");

	token_ptr = GSS_C_NO_BUFFER;

	do {

		debug("Calling gss_init_sec_context");

		maj_status = ssh_gssapi_init_ctx(ctxt,

		    ssh->kex->gss_deleg_creds, token_ptr, &send_tok,

		    &ret_flags);

		if (GSS_ERROR(maj_status)) {

			if (send_tok.length != 0) {

				packet_start(SSH2_MSG_KEXGSS_CONTINUE);

				packet_put_string(send_tok.value,

				    send_tok.length);

			}

			fatal("gss_init_context failed");

		}

		/* If we've got an old receive buffer get rid of it */

		if (token_ptr != GSS_C_NO_BUFFER)

			free(recv_tok.value);

		if (maj_status == GSS_S_COMPLETE) {

			/* If mutual state flag is not true, kex fails */

			if (!(ret_flags & GSS_C_MUTUAL_FLAG))

				fatal("Mutual authentication failed");

			/* If integ avail flag is not true kex fails */

			if (!(ret_flags & GSS_C_INTEG_FLAG))

				fatal("Integrity check failed");

		}

		/* 

		 * If we have data to send, then the last message that we

		 * received cannot have been a 'complete'. 

		 */

		if (send_tok.length != 0) {

			if (first) {

				packet_start(SSH2_MSG_KEXGSS_INIT);

				packet_put_string(send_tok.value,

				    send_tok.length);

				packet_put_bignum2(dh->pub_key);

				first = 0;

			} else {

				packet_start(SSH2_MSG_KEXGSS_CONTINUE);

				packet_put_string(send_tok.value,

				    send_tok.length);

			}

			packet_send();

			gss_release_buffer(&min_status, &send_tok);

			/* If we've sent them data, they should reply */

			do {	

				type = packet_read();

				if (type == SSH2_MSG_KEXGSS_HOSTKEY) {

					debug("Received KEXGSS_HOSTKEY");

					if (serverhostkey)

						fatal("Server host key received more than once");

					serverhostkey = 

					    packet_get_string(&slen);

				}

			} while (type == SSH2_MSG_KEXGSS_HOSTKEY);

			switch (type) {

			case SSH2_MSG_KEXGSS_CONTINUE:

				debug("Received GSSAPI_CONTINUE");

				if (maj_status == GSS_S_COMPLETE) 

					fatal("GSSAPI Continue received from server when complete");

				recv_tok.value = packet_get_string(&strlen);

				recv_tok.length = strlen; 

				break;

			case SSH2_MSG_KEXGSS_COMPLETE:

				debug("Received GSSAPI_COMPLETE");

				packet_get_bignum2(dh_server_pub);

				msg_tok.value =  packet_get_string(&strlen);

				msg_tok.length = strlen; 

				/* Is there a token included? */

				if (packet_get_char()) {

					recv_tok.value=

					    packet_get_string(&strlen);

					recv_tok.length = strlen;

					/* If we're already complete - protocol error */

					if (maj_status == GSS_S_COMPLETE)

						packet_disconnect("Protocol error: received token when complete");

					} else {

						/* No token included */

						if (maj_status != GSS_S_COMPLETE)

							packet_disconnect("Protocol error: did not receive final token");

				}

				break;

			case SSH2_MSG_KEXGSS_ERROR:

				debug("Received Error");

				maj_status = packet_get_int();

				min_status = packet_get_int();

				msg = packet_get_string(NULL);

				(void) packet_get_string_ptr(NULL);

				fatal("GSSAPI Error: \n%.400s",msg);

			default:

				packet_disconnect("Protocol error: didn't expect packet type %d",

		    		type);

			}

			token_ptr = &recv_tok;

		} else {

			/* No data, and not complete */

			if (maj_status != GSS_S_COMPLETE)

				fatal("Not complete, and no token output");

		}

	} while (maj_status & GSS_S_CONTINUE_NEEDED);

	/* 

	 * We _must_ have received a COMPLETE message in reply from the 

	 * server, which will have set dh_server_pub and msg_tok 

	 */

	if (type != SSH2_MSG_KEXGSS_COMPLETE)

		fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");

	/* Check f in range [1, p-1] */

	if (!dh_pub_is_valid(dh, dh_server_pub))

		packet_disconnect("bad server public DH value");

	/* compute K=f^x mod p */

	klen = DH_size(dh);

	kbuf = xmalloc(klen);

	kout = DH_compute_key(kbuf, dh_server_pub, dh);

	if (kout < 0)

		fatal("DH_compute_key: failed");

	shared_secret = BN_new();

	if (shared_secret == NULL)

		fatal("kexgss_client: BN_new failed");

	if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)

		fatal("kexdh_client: BN_bin2bn failed");

	memset(kbuf, 0, klen);

	free(kbuf);

	hashlen = sizeof(hash);

	switch (ssh->kex->kex_type) {

	case KEX_GSS_GRP1_SHA1:

	case KEX_GSS_GRP14_SHA1:

		kex_dh_hash( ssh->kex->client_version_string, 

		    ssh->kex->server_version_string,

		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),

		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),

		    (serverhostkey ? serverhostkey : empty), slen,

		    dh->pub_key,	/* e */

		    dh_server_pub,	/* f */

		    shared_secret,	/* K */

		    hash, &hashlen

		);

		break;

	case KEX_GSS_GEX_SHA1:

		kexgex_hash(

		    ssh->kex->hash_alg,

		    ssh->kex->client_version_string,

		    ssh->kex->server_version_string,

		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),

		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),

		    (serverhostkey ? serverhostkey : empty), slen,

 		    min, nbits, max,

		    dh->p, dh->g,

		    dh->pub_key,

		    dh_server_pub,

		    shared_secret,

		    hash, &hashlen

		);

		break;

	default:

		fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);

	}

	gssbuf.value = hash;

	gssbuf.length = hashlen;

	/* Verify that the hash matches the MIC we just got. */

	if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))

		packet_disconnect("Hash's MIC didn't verify");

	free(msg_tok.value);

	DH_free(dh);

	free(serverhostkey);

	BN_clear_free(dh_server_pub);

	/* save session id */

	if (ssh->kex->session_id == NULL) {

		ssh->kex->session_id_len = hashlen;

		ssh->kex->session_id = xmalloc(ssh->kex->session_id_len);

		memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len);

	}

	if (ssh->kex->gss_deleg_creds)

		ssh_gssapi_credentials_updated(ctxt);

	if (gss_kex_context == NULL)

		gss_kex_context = ctxt;

	else

		ssh_gssapi_delete_ctx(&ctxt);

	kex_derive_keys_bn(ssh, hash, hashlen, shared_secret);

	BN_clear_free(shared_secret);

	return kex_send_newkeys(ssh);

}

#endif /* GSSAPI */

/*

 * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#include "includes.h"

#ifdef GSSAPI

#include <string.h>

#include <openssl/crypto.h>

#include <openssl/bn.h>

#include "xmalloc.h"

#include "buffer.h"

#include "ssh2.h"

#include "key.h"

#include "cipher.h"

#include "kex.h"

#include "log.h"

#include "packet.h"

#include "dh.h"

#include "ssh-gss.h"

#include "monitor_wrap.h"

#include "misc.h"

#include "servconf.h"

#include "digest.h"

extern ServerOptions options;

int

kexgss_server(struct ssh *ssh)

{

	OM_uint32 maj_status, min_status;

	/* 

	 * Some GSSAPI implementations use the input value of ret_flags (an

 	 * output variable) as a means of triggering mechanism specific 

 	 * features. Initializing it to zero avoids inadvertently 

 	 * activating this non-standard behaviour.

	 */

	OM_uint32 ret_flags = 0;

	gss_buffer_desc gssbuf, recv_tok, msg_tok;

	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;

	Gssctxt *ctxt = NULL;

	u_int slen, klen, kout;

	u_char *kbuf;

	DH *dh;

	int min = -1, max = -1, nbits = -1;

	BIGNUM *shared_secret = NULL;

	BIGNUM *dh_client_pub = NULL;

	int type = 0;

	gss_OID oid;

	char *mechs;

	u_char hash[SSH_DIGEST_MAX_LENGTH];

	size_t hashlen;

	/* Initialise GSSAPI */

	/* If we're rekeying, privsep means that some of the private structures

	 * in the GSSAPI code are no longer available. This kludges them back

	 * into life

	 */

	if (!ssh_gssapi_oid_table_ok()) {

		mechs = ssh_gssapi_server_mechanisms();

		free(mechs);

	}

	debug2("%s: Identifying %s", __func__, ssh->kex->name);

	oid = ssh_gssapi_id_kex(NULL, ssh->kex->name, ssh->kex->kex_type);

	if (oid == GSS_C_NO_OID)

	   fatal("Unknown gssapi mechanism");

	debug2("%s: Acquiring credentials", __func__);

	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))

		fatal("Unable to acquire credentials for the server");

	switch (ssh->kex->kex_type) {

	case KEX_GSS_GRP1_SHA1:

		dh = dh_new_group1();

		break;

	case KEX_GSS_GRP14_SHA1:

		dh = dh_new_group14();

		break;

	case KEX_GSS_GEX_SHA1:

		debug("Doing group exchange");

		packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);

		min = packet_get_int();

		nbits = packet_get_int();

		max = packet_get_int();

		min = MAX(DH_GRP_MIN, min);

		max = MIN(DH_GRP_MAX, max);

		packet_check_eom();

		if (max < min || nbits < min || max < nbits)

			fatal("GSS_GEX, bad parameters: %d !< %d !< %d",

			    min, nbits, max);

		dh = PRIVSEP(choose_dh(min, nbits, max));

		if (dh == NULL)

			packet_disconnect("Protocol error: no matching group found");

		packet_start(SSH2_MSG_KEXGSS_GROUP);

		packet_put_bignum2(dh->p);

		packet_put_bignum2(dh->g);

		packet_send();

		packet_write_wait();

		break;

	default:

		fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);

	}

	dh_gen_key(dh, ssh->kex->we_need * 8);

	do {

		debug("Wait SSH2_MSG_GSSAPI_INIT");

		type = packet_read();

		switch(type) {

		case SSH2_MSG_KEXGSS_INIT:

			if (dh_client_pub != NULL) 

				fatal("Received KEXGSS_INIT after initialising");

			recv_tok.value = packet_get_string(&slen);

			recv_tok.length = slen; 

			if ((dh_client_pub = BN_new()) == NULL)

				fatal("dh_client_pub == NULL");

			packet_get_bignum2(dh_client_pub);