#

# GSS-API key exchange support

#

# Based on https://github.com/SimonWilkinson/gss-openssh/commit/ffae842

# Updated to apply to OpenSSH 6.5.

# Default value for GSSAPIKeyExchange changed to yes to match SunSSH behavior.

# New files kexgssc.c and kexgsss.c moved to ../sources/ and made cstyle clean.

#

# Upstream rejected GSS-API key exchange several times before.

#

diff -pur old/Makefile.in new/Makefile.in

--- old/Makefile.in	2014-11-19 08:19:53.525006324 -0800

+++ new/Makefile.in	2014-11-19 08:28:29.235999361 -0800

@@ -72,6 +72,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o

 	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \

 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \

 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \

+	kexgssc.o \

 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \

 	jpake.o schnorr.o ssh-pkcs11.o krl.o smult_curve25519_ref.o \

 	kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \

@@ -92,7 +93,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw

 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \

 	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \

 	kexc25519s.o auth-krb5.o \

-	auth2-gss.o gss-serv.o gss-serv-krb5.o \

+	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \

 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \

 	sftp-server.o sftp-common.o \

 	roaming_common.o roaming_serv.o \

Only in new/: Makefile.in.orig

Only in new/: Makefile.in.rej

diff -pur old/auth2-gss.c new/auth2-gss.c

--- old/auth2-gss.c	2014-11-19 08:19:53.432431374 -0800

+++ new/auth2-gss.c	2014-11-20 07:46:37.640415003 -0800

@@ -1,7 +1,7 @@

 /* $OpenBSD: auth2-gss.c,v 1.20 2013/05/17 00:13:13 djm Exp $ */

 /*

- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.

+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.

  *

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions

@@ -56,6 +56,39 @@ static void input_gssapi_mic(int type, u

 static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);

 static void input_gssapi_errtok(int, u_int32_t, void *);

+/* 

+ * The 'gssapi_keyex' userauth mechanism.

+ */

+static int

+userauth_gsskeyex(Authctxt *authctxt)

+{

+	int authenticated = 0;

+	Buffer b;

+	gss_buffer_desc mic, gssbuf;

+	u_int len;

+

+	mic.value = packet_get_string(&len);

+	mic.length = len;

+

+	packet_check_eom();

+

+	ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,

+	    "gssapi-keyex");

+

+	gssbuf.value = buffer_ptr(&b);

+	gssbuf.length = buffer_len(&b);

+

+	/* gss_kex_context is NULL with privsep, so we can't check it here */

+	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 

+	    &gssbuf, &mic))))

+		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));

+	

+	buffer_free(&b);

+	free(mic.value);

+

+	return (authenticated);

+}

+

 /*

  * We only support those mechanisms that we know about (ie ones that we know

  * how to check local user kuserok and the like)

@@ -300,6 +333,12 @@ input_gssapi_mic(int type, u_int32_t ple

 	userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);

 }

+Authmethod method_gsskeyex = {

+	"gssapi-keyex",

+	userauth_gsskeyex,

+	&options.gss_authentication

+};

+

 Authmethod method_gssapi = {

 	"gssapi-with-mic",

 	userauth_gssapi,

Only in new/: auth2-gss.c.orig

Only in new/: auth2-gss.c~

diff -pur old/auth2.c new/auth2.c

--- old/auth2.c	2014-11-19 08:19:53.555080638 -0800

+++ new/auth2.c	2014-11-19 08:19:53.614409503 -0800

@@ -69,6 +69,7 @@ extern Authmethod method_passwd;

 extern Authmethod method_kbdint;

 extern Authmethod method_hostbased;

 #ifdef GSSAPI

+extern Authmethod method_gsskeyex;

 extern Authmethod method_gssapi;

 #endif

 #ifdef JPAKE

@@ -79,6 +80,7 @@ Authmethod *authmethods[] = {

 	&method_none,

 	&method_pubkey,

 #ifdef GSSAPI

+	&method_gsskeyex,

 	&method_gssapi,

 #endif

 #ifdef JPAKE

diff -pur old/gss-genr.c new/gss-genr.c

--- old/gss-genr.c	2013-11-07 17:19:57.000000000 -0800

+++ new/gss-genr.c	2014-11-20 04:06:38.323380064 -0800

@@ -1,7 +1,7 @@

 /* $OpenBSD: gss-genr.c,v 1.22 2013/11/08 00:39:15 djm Exp $ */

 /*

- * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.

+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.

  *

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions

@@ -39,12 +39,167 @@

 #include "buffer.h"

 #include "log.h"

 #include "ssh2.h"

+#include "cipher.h"

+#include "key.h"

+#include "kex.h"

+#include <openssl/evp.h>

 #include "ssh-gss.h"

 extern u_char *session_id2;

 extern u_int session_id2_len;

+typedef struct {

+	char *encoded;

+	gss_OID oid;

+} ssh_gss_kex_mapping;

+

+/*

+ * XXX - It would be nice to find a more elegant way of handling the

+ * XXX   passing of the key exchange context to the userauth routines

+ */

+

+Gssctxt *gss_kex_context = NULL;

+

+static ssh_gss_kex_mapping *gss_enc2oid = NULL;

+

+int 

+ssh_gssapi_oid_table_ok() {

+	return (gss_enc2oid != NULL);

+}

+

+/*

+ * Return a list of the gss-group1-sha1 mechanisms supported by this program

+ *

+ * We test mechanisms to ensure that we can use them, to avoid starting

+ * a key exchange with a bad mechanism

+ */

+

+char *

+ssh_gssapi_client_mechanisms(const char *host) {

+	gss_OID_set gss_supported;

+	OM_uint32 min_status;

+

+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))

+		return NULL;

+

+	return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,

+	    host));

+}

+

+char *

+ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,

+    const char *data) {

+	Buffer buf;

+	size_t i;

+	int oidpos, enclen;

+	char *mechs, *encoded;

+	u_char digest[EVP_MAX_MD_SIZE];

+	char deroid[2];

+	const EVP_MD *evp_md = EVP_md5();

+	EVP_MD_CTX md;

+

+	if (gss_enc2oid != NULL) {

+		for (i = 0; gss_enc2oid[i].encoded != NULL; i++)

+			free(gss_enc2oid[i].encoded);

+		free(gss_enc2oid);

+	}

+

+	gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) *

+	    (gss_supported->count + 1));

+

+	buffer_init(&buf);

+

+	oidpos = 0;

+	for (i = 0; i < gss_supported->count; i++) {

+		if (gss_supported->elements[i].length < 128 &&

+		    (*check)(NULL, &(gss_supported->elements[i]), data)) {

+

+			deroid[0] = SSH_GSS_OIDTYPE;

+			deroid[1] = gss_supported->elements[i].length;

+

+			EVP_DigestInit(&md, evp_md);

+			EVP_DigestUpdate(&md, deroid, 2);

+			EVP_DigestUpdate(&md,

+			    gss_supported->elements[i].elements,

+			    gss_supported->elements[i].length);

+			EVP_DigestFinal(&md, digest, NULL);

+

+			encoded = xmalloc(EVP_MD_size(evp_md) * 2);

+			enclen = __b64_ntop(digest, EVP_MD_size(evp_md),

+			    encoded, EVP_MD_size(evp_md) * 2);

+

+			if (oidpos != 0)

+				buffer_put_char(&buf, ',');

+

+			buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,

+			    sizeof(KEX_GSS_GEX_SHA1_ID) - 1);

+			buffer_append(&buf, encoded, enclen);

+			buffer_put_char(&buf, ',');

+			buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 

+			    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1);

+			buffer_append(&buf, encoded, enclen);

+			buffer_put_char(&buf, ',');

+			buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID,

+			    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1);

+			buffer_append(&buf, encoded, enclen);

+

+			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);

+			gss_enc2oid[oidpos].encoded = encoded;

+			oidpos++;

+		}

+	}

+	gss_enc2oid[oidpos].oid = NULL;

+	gss_enc2oid[oidpos].encoded = NULL;

+

+	buffer_put_char(&buf, '\0');

+

+	mechs = xmalloc(buffer_len(&buf));

+	buffer_get(&buf, mechs, buffer_len(&buf));

+	buffer_free(&buf);

+

+	if (strlen(mechs) == 0) {

+		free(mechs);

+		mechs = NULL;

+	}

+	

+	return (mechs);

+}

+

+gss_OID

+ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {

+	int i = 0;

+	

+	switch (kex_type) {

+	case KEX_GSS_GRP1_SHA1:

+		if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID))

+			return GSS_C_NO_OID;

+		name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1;

+		break;

+	case KEX_GSS_GRP14_SHA1:

+		if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID))

+			return GSS_C_NO_OID;

+		name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;

+		break;

+	case KEX_GSS_GEX_SHA1:

+		if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))

+			return GSS_C_NO_OID;

+		name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;

+		break;

+	default:

+		return GSS_C_NO_OID;

+	}

+

+	while (gss_enc2oid[i].encoded != NULL &&

+	    strcmp(name, gss_enc2oid[i].encoded) != 0)

+		i++;

+

+	if (gss_enc2oid[i].oid != NULL && ctx != NULL)

+		ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);

+

+	return gss_enc2oid[i].oid;

+}

+

 /* Check that the OID in a data stream matches that in the context */

 int

 ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)

@@ -229,6 +384,9 @@ ssh_gssapi_import_name(Gssctxt *ctx, con

 OM_uint32

 ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)

 {

+	if (ctx == NULL) 

+		return -1;

+

 	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,

 	    GSS_C_QOP_DEFAULT, buffer, hash)))

 		ssh_gssapi_error(ctx);

@@ -236,6 +394,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer

 	return (ctx->major);

 }

+/* Priviledged when used by server */

+OM_uint32

+ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)

+{

+	if (ctx == NULL)

+		return -1;

+

+	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,

+	    gssbuf, gssmic, NULL);

+

+	return (ctx->major);

+}

+

 void

 ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,

     const char *context)

@@ -254,6 +425,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx

 	gss_buffer_desc token = GSS_C_EMPTY_BUFFER;

 	OM_uint32 major, minor;

 	gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"};

+	Gssctxt *intctx = NULL;

+

+	if (ctx == NULL)

+		ctx = &intctx;

 	/* RFC 4462 says we MUST NOT do SPNEGO */

 	if (oid->length == spnego_oid.length && 

@@ -272,7 +447,7 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx

 			    GSS_C_NO_BUFFER);

 	}

-	if (GSS_ERROR(major)) 

+	if (GSS_ERROR(major) || intctx != NULL) 

 		ssh_gssapi_delete_ctx(ctx);

 	return (!GSS_ERROR(major));

Only in new/: gss-genr.c.orig

Only in new/: gss-genr.c~

diff -pur old/gss-serv.c new/gss-serv.c

--- old/gss-serv.c	2014-11-19 08:19:53.495994604 -0800

+++ new/gss-serv.c	2014-11-19 08:19:53.614894916 -0800

@@ -1,7 +1,7 @@

 /* $OpenBSD: gss-serv.c,v 1.24 2013/07/20 01:55:13 djm Exp $ */

 /*

- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.

+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.

  *

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions

@@ -47,6 +47,7 @@

 #include "misc.h"

 #include "ssh-gss.h"

+#include "monitor_wrap.h"

 static ssh_gssapi_client gssapi_client =

     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,

@@ -114,6 +115,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss

 }

 /* Unprivileged */

+char *

+ssh_gssapi_server_mechanisms() {

+	gss_OID_set	supported;

+

+	ssh_gssapi_supported_oids(&supported);

+	return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech,

+	    NULL));

+}

+

+/* Unprivileged */

+int

+ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data) {

+	Gssctxt *ctx = NULL;

+	int res;

+ 

+	res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));

+	ssh_gssapi_delete_ctx(&ctx);

+

+	return (res);

+}

+

+/* Unprivileged */

 void

 ssh_gssapi_supported_oids(gss_OID_set *oidset)

 {

@@ -123,7 +146,9 @@ ssh_gssapi_supported_oids(gss_OID_set *o

 	gss_OID_set supported;

 	gss_create_empty_oid_set(&min_status, oidset);

-	gss_indicate_mechs(&min_status, &supported);

+

+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported)))

+		return;

 	while (supported_mechs[i]->name != NULL) {

 		if (GSS_ERROR(gss_test_oid_set_member(&min_status,

@@ -398,14 +423,4 @@ ssh_gssapi_userok(char *user)

 	return (0);

 }

-/* Privileged */

-OM_uint32

-ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)

-{

-	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,

-	    gssbuf, gssmic, NULL);

-

-	return (ctx->major);

-}

-

 #endif

Only in new/: gss-serv.c.orig

diff -pur old/kex.c new/kex.c

--- old/kex.c	2014-01-25 14:38:04.000000000 -0800

+++ new/kex.c	2014-11-20 06:10:14.432397588 -0800

@@ -51,6 +51,10 @@

 #include "roaming.h"

 #include "digest.h"

+#ifdef GSSAPI

+#include "ssh-gss.h"

+#endif

+

 #if OPENSSL_VERSION_NUMBER >= 0x00907000L

 # if defined(HAVE_EVP_SHA256)

 # define evp_ssh_sha256 EVP_sha256

@@ -90,6 +94,11 @@ static const struct kexalg kexalgs[] = {

 #ifdef HAVE_EVP_SHA256

 	{ KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },

 #endif

+#ifdef GSSAPI

+	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },

+	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },

+	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },

+#endif

 	{ NULL, -1, -1, -1},

 };

@@ -117,7 +126,7 @@ kex_alg_by_name(const char *name)

 	const struct kexalg *k;

 	for (k = kexalgs; k->name != NULL; k++) {

-		if (strcmp(k->name, name) == 0)

+		if (strncmp(k->name, name, strlen(k->name)) == 0)

 			return k;

 	}

 	return NULL;

Only in new/: kex.c.orig

Only in new/: kex.c.rej

Only in new/: kex.c~

diff -pur old/kex.h new/kex.h

--- old/kex.h	2014-01-25 14:37:26.000000000 -0800

+++ new/kex.h	2014-11-20 00:26:26.185459758 -0800

@@ -76,6 +76,9 @@ enum kex_exchange {

 	KEX_DH_GEX_SHA256,

 	KEX_ECDH_SHA2,

 	KEX_C25519_SHA256,

+	KEX_GSS_GRP1_SHA1,

+	KEX_GSS_GRP14_SHA1,

+	KEX_GSS_GEX_SHA1,

 	KEX_MAX

 };

@@ -136,6 +139,10 @@ struct Kex {

 	int	flags;

 	int	hash_alg;

 	int	ec_nid;

+#ifdef GSSAPI

+	int	gss_deleg_creds;

+	char    *gss_host;

+#endif

 	char	*client_version_string;

 	char	*server_version_string;

 	int	(*verify_host_key)(Key *);

@@ -168,6 +175,11 @@ void	 kexecdh_server(Kex *);

 void	 kexc25519_client(Kex *);

 void	 kexc25519_server(Kex *);

+#ifdef GSSAPI

+void	kexgss_client(Kex *);

+void	kexgss_server(Kex *);

+#endif

+

 void

 kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,

     BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);

Only in new/: kex.h.orig

Only in new/: kex.h.rej

Only in new/: kex.h~

Only in new/: kexgssc.c

Only in new/: kexgssc.c~

Only in new/: kexgsss.c

Only in new/: kexgsss.c~

diff -pur old/key.c new/key.c

--- old/key.c	2014-01-09 15:58:53.000000000 -0800

+++ new/key.c	2014-11-19 11:03:01.227859791 -0800

@@ -985,6 +985,7 @@ static const struct keytype keytypes[] =

 	    KEY_DSA_CERT_V00, 0, 1 },

 	{ "[email protected]", "ED25519-CERT",

 	    KEY_ED25519_CERT, 0, 1 },

+	{ "null", "null", KEY_NULL, 0, 0 },

 	{ NULL, NULL, -1, -1, 0 }

 };

Only in new/: key.c.orig

Only in new/: key.c.rej

Only in new/: key.c~

diff -pur old/key.h new/key.h

--- old/key.h	2014-01-09 15:58:53.000000000 -0800

+++ new/key.h	2014-11-19 08:19:53.616502306 -0800

@@ -46,6 +46,7 @@ enum types {

 	KEY_ED25519_CERT,

 	KEY_RSA_CERT_V00,

 	KEY_DSA_CERT_V00,