GSSAPI KEX

Makefile.in

@@ -106,14 +106,14 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
 	readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \
 	atomicio.o dispatch.o mac.o misc.o utf8.o \
 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
-	ssh-ed25519-sk.o ssh-rsa.o dh.o \
+	ssh-ed25519-sk.o ssh-rsa.o ssh-null.o dh.o \
 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
 	ssh-pkcs11.o smult_curve25519_ref.o \
 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
 	ssh-ed25519.o digest-openssl.o digest-libc.o \
 	hmac.o ed25519.o hash.o \
 	kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
-	kexgexc.o kexgexs.o \
+	kexgexc.o kexgexs.o kexgssc.o \
 	kexsntrup761x25519.o kexmlkem768x25519.o sntrup761.o kexgen.o \
 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
 	sshbuf-io.o
@@ -137,7 +137,7 @@ SSHD_SESSION_OBJS=sshd-session.o auth-rhosts.o auth-passwd.o \
 	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
 	monitor.o monitor_wrap.o auth-krb5.o \
-	auth2-gss.o gss-serv.o gss-serv-krb5.o \
+	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \
 	sftp-server.o sftp-common.o \
 	uidswap.o platform-listen.o $(SKOBJS)
@@ -148,7 +148,7 @@ SSHD_AUTH_OBJS=sshd-auth.o \
 	serverloop.o auth.o auth2.o auth-options.o session.o auth2-chall.o \
 	groupaccess.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
-	auth2-gss.o gss-serv.o gss-serv-krb5.o \
+	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
 	monitor_wrap.o auth-krb5.o \
 	audit.o audit-bsm.o audit-linux.o platform.o \
 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \

README.md

@@ -1,3 +1,39 @@
+Portable OpenSSH with GSSAPI Key Exchange patches
+=================================================
+
+[![Language grade: C/C++](https://img.shields.io/lgtm/grade/cpp/g/openssh-gsskex/openssh-gsskex.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/openssh-gsskex/openssh-gsskex/context:cpp)
+
+Currently, there are two branches with gssapi key exchange related
+patches:
+
+ * fedora/master: Changes that are shipped in Fedora [![Build Status](https://travis-ci.org/openssh-gsskex/openssh-gsskex.svg?branch=fedora%2Fmaster)](https://travis-ci.org/openssh-gsskex/openssh-gsskex)
+ * debian/master: Changes that are shipped in Debian [![Build Status](https://travis-ci.org/openssh-gsskex/openssh-gsskex.svg?branch=debian%2Fmaster)](https://travis-ci.org/openssh-gsskex/openssh-gsskex)
+
+The target is to converge to a shared repository with single master
+branch from where we could build releases for both OSes.
+
+
+What is in:
+
+ * The original patch implementing missing parts of RFC4462 by Simon Wilkinson
+   adapted to the current OpenSSH versions and with several fixes
+ * New methods for GSSAPI Kex from IETF draft [1] from Jakub Jelen
+
+
+Missing kerberos-related parts:
+
+ * .k5login and .kusers support available in Fedora [2] [3].
+ * Improved handling of kerberos ccache location [4]
+
+
+
+[1] https://tools.ietf.org/html/draft-ietf-curdle-gss-keyex-sha2-08
+[2] https://src.fedoraproject.org/rpms/openssh/blob/master/f/openssh-6.6p1-kuserok.patch
+[3] https://src.fedoraproject.org/rpms/openssh/blob/master/f/openssh-6.6p1-GSSAPIEnablek5users.patch
+[4] https://bugzilla.mindrot.org/show_bug.cgi?id=2775
+
+-------------------------------------------------------------------------------
+
 # Portable OpenSSH
 
 [![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml)

auth.c

@@ -369,7 +369,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
 	case PERMIT_NO_PASSWD:
 		if (strcmp(method, "publickey") == 0 ||
 		    strcmp(method, "hostbased") == 0 ||
-		    strcmp(method, "gssapi-with-mic") == 0)
+		    strcmp(method, "gssapi-with-mic") == 0 ||
+		    strcmp(method, "gssapi-keyex") == 0)
 			return 1;
 		break;
 	case PERMIT_FORCED_ONLY:

auth2-gss.c

@@ -1,7 +1,7 @@
 /* $OpenBSD: auth2-gss.c,v 1.36 2024/05/17 04:42:13 djm Exp $ */
 
 /*
- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,13 +51,55 @@
 #define SSH_GSSAPI_MAX_MECHS	2048
 
 extern ServerOptions options;
+extern struct authmethod_cfg methodcfg_gsskeyex;
 extern struct authmethod_cfg methodcfg_gssapi;
 
 static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh);
 static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
 static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
 static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
 
+/*
+ * The 'gssapi_keyex' userauth mechanism.
+ */
+static int
+userauth_gsskeyex(struct ssh *ssh, const char *method)
+{
+	Authctxt *authctxt = ssh->authctxt;
+	int r, authenticated = 0;
+	struct sshbuf *b = NULL;
+	gss_buffer_desc mic, gssbuf;
+	u_char *p;
+	size_t len;
+
+	if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
+	    (r = sshpkt_get_end(ssh)) != 0)
+		fatal_fr(r, "parsing");
+
+	if ((b = sshbuf_new()) == NULL)
+		fatal_f("sshbuf_new failed");
+
+	mic.value = p;
+	mic.length = len;
+
+	ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
+	    "gssapi-keyex", ssh->kex->session_id);
+
+	if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
+		fatal_f("sshbuf_mutable_ptr failed");
+	gssbuf.length = sshbuf_len(b);
+
+	/* gss_kex_context is NULL with privsep, so we can't check it here */
+	if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gss_kex_context, &gssbuf, &mic)))
+		authenticated = mm_ssh_gssapi_userok(authctxt->user,
+		    authctxt->pw, 1);
+
+	sshbuf_free(b);
+	free(mic.value);
+
+	return (authenticated);
+}
+
 /*
  * We only support those mechanisms that we know about (ie ones that we know
  * how to check local user kuserok and the like)
@@ -267,7 +309,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
 	if ((r = sshpkt_get_end(ssh)) != 0)
 		fatal_fr(r, "parse packet");
 
-	authenticated = mm_ssh_gssapi_userok(authctxt->user);
+	authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 1);
 
 	authctxt->postponed = 0;
 	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
@@ -308,7 +350,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
 	gssbuf.length = sshbuf_len(b);
 
 	if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))
-		authenticated = mm_ssh_gssapi_userok(authctxt->user);
+		authenticated = mm_ssh_gssapi_userok(authctxt->user,
+		    authctxt->pw, 0);
 	else
 		logit("GSSAPI MIC check failed");
 
@@ -324,6 +367,11 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
 	return 0;
 }
 
+Authmethod method_gsskeyex = {
+	&methodcfg_gsskeyex,
+	userauth_gsskeyex,
+};
+
 Authmethod method_gssapi = {
 	&methodcfg_gssapi,
 	userauth_gssapi,

auth2-methods.c

@@ -50,6 +50,11 @@ struct authmethod_cfg methodcfg_pubkey = {
 	&options.pubkey_authentication
 };
 #ifdef GSSAPI
+struct authmethod_cfg methodcfg_gsskeyex = {
+	"gssapi-keyex",
+	NULL,
+	&options.gss_authentication
+};
 struct authmethod_cfg methodcfg_gssapi = {
 	"gssapi-with-mic",
 	NULL,
@@ -76,6 +81,7 @@ static struct authmethod_cfg *authmethod_cfgs[] = {
 	&methodcfg_none,
 	&methodcfg_pubkey,
 #ifdef GSSAPI
+	&methodcfg_gsskeyex,
 	&methodcfg_gssapi,
 #endif
 	&methodcfg_passwd,

auth2.c

@@ -74,13 +74,15 @@ extern Authmethod method_passwd;
 extern Authmethod method_kbdint;
 extern Authmethod method_hostbased;
 #ifdef GSSAPI
+extern Authmethod method_gsskeyex;
 extern Authmethod method_gssapi;
 #endif
 
 Authmethod *authmethods[] = {
 	&method_none,
 	&method_pubkey,
 #ifdef GSSAPI
+	&method_gsskeyex,
 	&method_gssapi,
 #endif
 	&method_passwd,

clientloop.c

@@ -115,6 +115,10 @@
 #include "ssherr.h"
 #include "hostfile.h"
 
+#ifdef GSSAPI
+#include "ssh-gss.h"
+#endif
+
 /* Permitted RSA signature algorithms for UpdateHostkeys proofs */
 #define HOSTKEY_PROOF_RSA_ALGS	"rsa-sha2-512,rsa-sha2-256"
 
@@ -1599,6 +1603,15 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
 		/* Do channel operations. */
 		channel_after_poll(ssh, pfd, npfd_active);
 
+#ifdef GSSAPI
+		if (!ssh_packet_is_rekeying(ssh) &&
+		    options.gss_renewal_rekey &&
+		    ssh_gssapi_credentials_updated(NULL)) {
+			debug("credentials updated - forcing rekey");
+			need_rekeying = 1;
+		}
+#endif
+
 		/* Buffer input from the connection.  */
 		if (conn_in_ready)
 			client_process_net_input(ssh);

configure.ac

@@ -786,6 +786,30 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 	    [Use tunnel device compatibility to OpenBSD])
 	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 	    [Prepend the address family to IP tunnel traffic])
+	AC_MSG_CHECKING([if we have the Security Authorization Session API])
+	AC_TRY_COMPILE([#include <Security/AuthSession.h>],
+		[SessionCreate(0, 0);],
+		[ac_cv_use_security_session_api="yes"
+		 AC_DEFINE([USE_SECURITY_SESSION_API], [1],
+			[platform has the Security Authorization Session API])
+		 LIBS="$LIBS -framework Security"
+		 AC_MSG_RESULT([yes])],
+		[ac_cv_use_security_session_api="no"
+		 AC_MSG_RESULT([no])])
+	AC_MSG_CHECKING([if we have an in-memory credentials cache])
+	AC_TRY_COMPILE(
+		[#include <Kerberos/Kerberos.h>],
+		[cc_context_t c;
+		 (void) cc_initialize (&c, 0, NULL, NULL);],
+		[AC_DEFINE([USE_CCAPI], [1],
+			[platform uses an in-memory credentials cache])
+		 LIBS="$LIBS -framework Security"
+		 AC_MSG_RESULT([yes])
+		 if test "x$ac_cv_use_security_session_api" = "xno"; then
+			AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***])
+		fi],
+		[AC_MSG_RESULT([no])]
+	)
 	m4_pattern_allow([AU_IPv])
 	AC_CHECK_DECL([AU_IPv4], [],
 	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])

contrib/win32/openssh/libssh.vcxproj

@@ -404,6 +404,9 @@
     <ClCompile Include="$(OpenSSH-Src-Path)kexgexc.c">
       <ExcludedFromBuild Condition="$(UseOpenSSL)==false">true</ExcludedFromBuild>
     </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)kexgssc.c">
+      <ExcludedFromBuild Condition="$(UseOpenSSL)==false">true</ExcludedFromBuild>
+    </ClCompile>
     <ClCompile Include="$(OpenSSH-Src-Path)kexgen.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)kexsntrup761x25519.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)krl.c" />
@@ -433,6 +436,7 @@
     <ClCompile Include="$(OpenSSH-Src-Path)ssh-rsa.c">
       <ExcludedFromBuild Condition="$(UseOpenSSL)==false">true</ExcludedFromBuild>
     </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)ssh-null.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-basic.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-crypto.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-misc.c" />
@@ -467,4 +471,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

contrib/win32/openssh/libssh.vcxproj.filters

@@ -30,9 +30,10 @@
     <ClCompile Include="$(OpenSSH-Src-Path)kexc25519.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)kexdh.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)kexecdh.c" />
-    <ClCompile Include="$(OpenSSH-Src-Path)kexgex.c" />
-    <ClCompile Include="$(OpenSSH-Src-Path)kexgexc.c" />
-    <ClCompile Include="$(OpenSSH-Src-Path)krl.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)kexgex.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)kexgexc.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)kexgssc.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)krl.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)log.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)mac.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)monitor_fdpass.c" />
@@ -44,9 +45,10 @@
     <ClCompile Include="$(OpenSSH-Src-Path)ssh-dss.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)ssh-ecdsa.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)ssh-ed25519.c" />
-    <ClCompile Include="$(OpenSSH-Src-Path)ssh-pkcs11.c" />
-    <ClCompile Include="$(OpenSSH-Src-Path)ssh-rsa.c" />
-    <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-basic.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)ssh-pkcs11.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)ssh-rsa.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)ssh-null.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-basic.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-crypto.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-misc.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)sshbuf.c" />
@@ -173,10 +175,13 @@
     <ClCompile Include="$(OpenSSH-Src-Path)kexgex.c">
       <Filter>Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="$(OpenSSH-Src-Path)kexgexc.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-    <ClCompile Include="$(OpenSSH-Src-Path)krl.c">
+    <ClCompile Include="$(OpenSSH-Src-Path)kexgexc.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)kexgssc.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)krl.c">
       <Filter>Source Files</Filter>
     </ClCompile>
     <ClCompile Include="$(OpenSSH-Src-Path)log.c">
@@ -215,10 +220,13 @@
     <ClCompile Include="$(OpenSSH-Src-Path)ssh-pkcs11.c">
       <Filter>Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="$(OpenSSH-Src-Path)ssh-rsa.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-    <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-basic.c">
+    <ClCompile Include="$(OpenSSH-Src-Path)ssh-rsa.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)ssh-null.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-basic.c">
       <Filter>Source Files</Filter>
     </ClCompile>
     <ClCompile Include="$(OpenSSH-Src-Path)sshbuf-getput-crypto.c">
@@ -267,4 +275,4 @@
   <ItemGroup>
     <ClInclude Include="$(OpenSSH-Src-Path)sshfileperm.h" />
   </ItemGroup>
-</Project>
+</Project>

contrib/win32/openssh/sshd-auth.vcxproj

@@ -455,6 +455,7 @@
     <ClCompile Include="$(OpenSSH-Src-Path)auth2.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)gss-serv-krb5.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)gss-serv.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)kexgsss.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)loginrec.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)monitor_wrap.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)platform.c" />
@@ -491,4 +492,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>