extern Authmethod method_gsskeyex;

	&method_gsskeyex,

	authctxt->server_caused_failure = 0;

/* 

 * The 'gssapi_keyex' userauth mechanism.

 */

static int

userauth_gsskeyex(Authctxt *authctxt)

{

	int authenticated = 0;

	Buffer b;

	gss_buffer_desc mic, gssbuf;

	u_int len;

	mic.value = packet_get_string(&len);

	mic.length = len;

	packet_check_eom();

	ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,

	    "gssapi-keyex");

	gssbuf.value = buffer_ptr(&b);

	gssbuf.length = buffer_len(&b);

	/* gss_kex_context is NULL with privsep, so we can't check it here */

	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 

	    &gssbuf, &mic))))

		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));

	buffer_free(&b);

	xfree(mic.value);

	return (authenticated);

}

		authctxt->server_caused_failure = 1;

		authctxt->server_caused_failure = 1;

Authmethod method_gsskeyex = {

	"gssapi-keyex",

	userauth_gsskeyex,

	&options.gss_authentication

};

	int		 server_caused_failure; 

#ifdef USE_CCAPI

	snprintf(authctxt->krb5_ccname, len, "API:%s",

	    authctxt->krb5_ticket_file);

#else

#endif

#ifdef USE_CCAPI

	char cctemplate[] = "API:krb5cc_%d";

#else

	char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";

	int tmpfd;

#endif

#ifndef USE_CCAPI

#endif

/* platform uses an in-memory credentials cache */

#undef USE_CCAPI

/* platform has the Security Authorization Session API */

#undef USE_SECURITY_SESSION_API

 	echo "$as_me:$LINENO: checking if we have the Security Authorization Session API" >&5

echo $ECHO_N "checking if we have the Security Authorization Session API... $ECHO_C" >&6

 	cat >conftest.$ac_ext <<_ACEOF

/* confdefs.h.  */

_ACEOF

cat confdefs.h >>conftest.$ac_ext

cat >>conftest.$ac_ext <<_ACEOF

/* end confdefs.h.  */

#include <Security/AuthSession.h>

int

main ()

{

SessionCreate(0, 0);

  ;

  return 0;

}

_ACEOF

rm -f conftest.$ac_objext

if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5

  (eval $ac_compile) 2>conftest.er1

  ac_status=$?

  grep -v '^ *+' conftest.er1 >conftest.err

  rm -f conftest.er1

  cat conftest.err >&5

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); } &&

	 { ac_try='test -z "$ac_c_werror_flag"

			 || test ! -s conftest.err'

  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5

  (eval $ac_try) 2>&5

  ac_status=$?

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); }; } &&

	 { ac_try='test -s conftest.$ac_objext'

  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5

  (eval $ac_try) 2>&5

  ac_status=$?

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); }; }; then

  ac_cv_use_security_session_api="yes"

cat >>confdefs.h <<\_ACEOF

#define USE_SECURITY_SESSION_API 1

_ACEOF

 		 LIBS="$LIBS -framework Security"

 		 echo "$as_me:$LINENO: result: yes" >&5

echo "${ECHO_T}yes" >&6

else

  echo "$as_me: failed program was:" >&5

sed 's/^/| /' conftest.$ac_ext >&5

ac_cv_use_security_session_api="no"

 		 echo "$as_me:$LINENO: result: no" >&5

echo "${ECHO_T}no" >&6

fi

rm -f conftest.err conftest.$ac_objext conftest.$ac_ext

 	echo "$as_me:$LINENO: checking if we have an in-memory credentials cache" >&5

echo $ECHO_N "checking if we have an in-memory credentials cache... $ECHO_C" >&6

 	cat >conftest.$ac_ext <<_ACEOF

/* confdefs.h.  */

_ACEOF

cat confdefs.h >>conftest.$ac_ext

cat >>conftest.$ac_ext <<_ACEOF

/* end confdefs.h.  */

#include <Kerberos/Kerberos.h>

int

main ()

{

cc_context_t c;

 		 (void) cc_initialize (&c, 0, NULL, NULL);

  ;

  return 0;

}

_ACEOF

rm -f conftest.$ac_objext

if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5

  (eval $ac_compile) 2>conftest.er1

  ac_status=$?

  grep -v '^ *+' conftest.er1 >conftest.err

  rm -f conftest.er1

  cat conftest.err >&5

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); } &&

	 { ac_try='test -z "$ac_c_werror_flag"

			 || test ! -s conftest.err'

  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5

  (eval $ac_try) 2>&5

  ac_status=$?

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); }; } &&

	 { ac_try='test -s conftest.$ac_objext'

  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5

  (eval $ac_try) 2>&5

  ac_status=$?

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); }; }; then

cat >>confdefs.h <<\_ACEOF

#define USE_CCAPI 1

_ACEOF

 		 LIBS="$LIBS -framework Security"

 		 echo "$as_me:$LINENO: result: yes" >&5

echo "${ECHO_T}yes" >&6

 		 if test "x$ac_cv_use_security_session_api" = "xno"; then

 			{ { echo "$as_me:$LINENO: error: *** Need a security framework to use the credentials cache API ***" >&5

echo "$as_me: error: *** Need a security framework to use the credentials cache API ***" >&2;}

   { (exit 1); exit 1; }; }

 		fi

else

  echo "$as_me: failed program was:" >&5

sed 's/^/| /' conftest.$ac_ext >&5

echo "$as_me:$LINENO: result: no" >&5

echo "${ECHO_T}no" >&6

fi

rm -f conftest.err conftest.$ac_objext conftest.$ac_ext

 	AC_MSG_CHECKING(if we have the Security Authorization Session API)

 	AC_TRY_COMPILE([#include <Security/AuthSession.h>],

 		[SessionCreate(0, 0);],

 		[ac_cv_use_security_session_api="yes"

 		 AC_DEFINE(USE_SECURITY_SESSION_API, 1, 

			[platform has the Security Authorization Session API])

 		 LIBS="$LIBS -framework Security"

 		 AC_MSG_RESULT(yes)],

 		[ac_cv_use_security_session_api="no"

 		 AC_MSG_RESULT(no)])

 	AC_MSG_CHECKING(if we have an in-memory credentials cache)

 	AC_TRY_COMPILE(

 		[#include <Kerberos/Kerberos.h>],

 		[cc_context_t c;

 		 (void) cc_initialize (&c, 0, NULL, NULL);],

 		[AC_DEFINE(USE_CCAPI, 1, 

			[platform uses an in-memory credentials cache])

 		 LIBS="$LIBS -framework Security"

 		 AC_MSG_RESULT(yes)

 		 if test "x$ac_cv_use_security_session_api" = "xno"; then

 			AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)

 		fi],

 		[AC_MSG_RESULT(no)]

 	)

#include <openssl/evp.h>

typedef struct {

	char *encoded;

	gss_OID oid;

} ssh_gss_kex_mapping;

/*

 * XXX - It would be nice to find a more elegant way of handling the

 * XXX   passing of the key exchange context to the userauth routines

 */

Gssctxt *gss_kex_context = NULL;

static ssh_gss_kex_mapping *gss_enc2oid = NULL;

int 

ssh_gssapi_oid_table_ok() {

	return (gss_enc2oid != NULL);

}

/*

 * Return a list of the gss-group1-sha1 mechanisms supported by this program

 *

 * We test mechanisms to ensure that we can use them, to avoid starting

 * a key exchange with a bad mechanism

 */

char *

ssh_gssapi_client_mechanisms(const char *host) {

	gss_OID_set gss_supported;

	OM_uint32 min_status;

	gss_indicate_mechs(&min_status, &gss_supported);

	return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,

	    (void *)host));

}

char *

ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,

    void *data) {

	Buffer buf;

	int i, oidpos, enclen;

	char *mechs, *encoded;

	char digest[EVP_MAX_MD_SIZE];

	char deroid[2];

	const EVP_MD *evp_md = EVP_md5();

	EVP_MD_CTX md;

	if (gss_enc2oid != NULL) {

		for (i=0;gss_enc2oid[i].encoded!=NULL;i++)

			xfree(gss_enc2oid[i].encoded);

		xfree(gss_enc2oid);

	}

	gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping)*

	    (gss_supported->count+1));

	buffer_init(&buf);

	oidpos = 0;

	for (i = 0;i < gss_supported->count;i++) {

		if (gss_supported->elements[i].length < 128 &&

		    (*check)(&(gss_supported->elements[i]), data)) {

			deroid[0] = SSH_GSS_OIDTYPE;

			deroid[1] = gss_supported->elements[i].length;

			EVP_DigestInit(&md, evp_md);

			EVP_DigestUpdate(&md, deroid, 2);

			EVP_DigestUpdate(&md,

			    gss_supported->elements[i].elements,

			    gss_supported->elements[i].length);

			EVP_DigestFinal(&md, digest, NULL);

			encoded = xmalloc(EVP_MD_size(evp_md)*2);

			enclen = __b64_ntop(digest, EVP_MD_size(evp_md),

			    encoded, EVP_MD_size(evp_md)*2);

			if (oidpos != 0)

			    buffer_put_char(&buf, ',');

			buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,

			    sizeof(KEX_GSS_GEX_SHA1_ID)-1);

			buffer_append(&buf, encoded, enclen);

			buffer_put_char(&buf,',');

			buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 

			    sizeof(KEX_GSS_GRP1_SHA1_ID)-1);

			buffer_append(&buf, encoded, enclen);

			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);

			gss_enc2oid[oidpos].encoded = encoded;

			oidpos++;

		}

	}

	gss_enc2oid[oidpos].oid = NULL;

	gss_enc2oid[oidpos].encoded = NULL;

	buffer_put_char(&buf, '\0');

	mechs = xmalloc(buffer_len(&buf));

	buffer_get(&buf, mechs, buffer_len(&buf));

	buffer_free(&buf);

	if (strlen(mechs) == 0) {

		xfree(mechs);

		mechs = NULL;

	}

	return (mechs);

}

gss_OID

ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int *gex) {

	int i = 0;

	if (strncmp(name, KEX_GSS_GRP1_SHA1_ID,

	    sizeof(KEX_GSS_GRP1_SHA1_ID)-1) == 0) {

		name+=sizeof(KEX_GSS_GRP1_SHA1_ID)-1;

		*gex = 0;

	} else if (strncmp(name, KEX_GSS_GEX_SHA1_ID,

	    sizeof(KEX_GSS_GEX_SHA1_ID)-1) == 0) {

		name+=sizeof(KEX_GSS_GEX_SHA1_ID)-1;

		*gex = 1;

	} else {

		return NULL;

	}

	while (gss_enc2oid[i].encoded != NULL &&

	    strcmp(name, gss_enc2oid[i].encoded) != 0) {

		i++;

	}

	if (gss_enc2oid[i].oid != NULL && ctx != NULL)

		ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);

	return gss_enc2oid[i].oid;

}

	if (ctx == NULL) 

		return -1;

/* Priviledged when used by server */

OM_uint32

ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)

{

	if (ctx == NULL)

		return -1;

	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,

	    gssbuf, gssmic, NULL);

	return (ctx->major);

}

int

ssh_gssapi_check_mechanism(gss_OID oid, void *host) {

	Gssctxt * ctx = NULL;

	gss_buffer_desc token = GSS_C_EMPTY_BUFFER;

	OM_uint32 major, minor;

	ssh_gssapi_build_ctx(&ctx);

	ssh_gssapi_set_oid(ctx, oid);

	ssh_gssapi_import_name(ctx, host);

	major = ssh_gssapi_init_ctx(ctx, 0, GSS_C_NO_BUFFER, &token, NULL);

	gss_release_buffer(&minor, &token);

	ssh_gssapi_delete_ctx(&ctx);

	return (!GSS_ERROR(major));

}

#include "monitor_wrap.h"

char *

ssh_gssapi_server_mechanisms() {

	gss_OID_set	supported;

	ssh_gssapi_supported_oids(&supported);

	return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech,

	    NULL));

}

/* Unprivileged */

int

ssh_gssapi_server_check_mech(gss_OID oid, void *data) {

	Gssctxt * ctx = NULL;

	int res;

	res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));

	ssh_gssapi_delete_ctx(&ctx);

	return (res);

}

/* Unprivileged */

#ifdef GSSAPI

#include "ssh-gss.h"

#endif

#ifdef GSSAPI

	} else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID,

	    sizeof(KEX_GSS_GEX_SHA1_ID)-1) == 0) {

		k->kex_type = KEX_GSS_GEX_SHA1;

		k->evp_md = EVP_sha1();

	} else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID,

	    sizeof(KEX_GSS_GRP1_SHA1_ID)-1) == 0) {

		k->kex_type = KEX_GSS_GRP1_SHA1;

		k->evp_md = EVP_sha1();

#endif

/*

 * Copyright (c) 2001-2005 Simon Wilkinson. All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#include "includes.h"

#ifdef GSSAPI

#include <openssl/crypto.h>

#include <openssl/bn.h>

#include "xmalloc.h"

#include "buffer.h"

#include "bufaux.h"

#include "kex.h"

#include "log.h"

#include "packet.h"

#include "dh.h"

#include "canohost.h"

#include "ssh2.h"

#include "ssh-gss.h"

void

kexgss_client(Kex *kex) {

	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;

        gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;

	Gssctxt *ctxt;

	OM_uint32 maj_status, min_status, ret_flags;

	u_int klen, kout, slen = 0, hashlen, strlen;

	DH *dh; 

	BIGNUM *dh_server_pub = NULL;

	BIGNUM *shared_secret = NULL;

	BIGNUM *p = NULL;

	BIGNUM *g = NULL;	

	u_char *kbuf, *hash;

	u_char *serverhostkey = NULL;

	char *msg;

	char *lang;

	int type = 0;

	int first = 1;

	int gex = 0;

	int nbits, min, max;

	/* Initialise our GSSAPI world */	

	ssh_gssapi_build_ctx(&ctxt);

	if (ssh_gssapi_id_kex(ctxt, kex->name, &gex) == NULL)

		fatal("Couldn't identify host exchange");

	if (ssh_gssapi_import_name(ctxt, kex->gss_host))

		fatal("Couldn't import hostname");

	if (gex) {

		debug("Doing group exchange\n");

		nbits = dh_estimate(kex->we_need * 8);

		min = DH_GRP_MIN;

		max = DH_GRP_MAX;

		packet_start(SSH2_MSG_KEXGSS_GROUPREQ);

		packet_put_int(min);

		packet_put_int(nbits);

		packet_put_int(max);

		packet_send();

		packet_read_expect(SSH2_MSG_KEXGSS_GROUP);

		if ((p = BN_new()) == NULL)

			fatal("BN_new() failed");

		packet_get_bignum2(p);

		if ((g = BN_new()) == NULL)

			fatal("BN_new() failed");

		packet_get_bignum2(g);

		packet_check_eom();

		if (BN_num_bits(p) < min || BN_num_bits(p) > max)

			fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",

			    min, BN_num_bits(p), max);

		dh = dh_new_group(g, p);

	} else {

		dh = dh_new_group1();

	}

	/* Step 1 - e is dh->pub_key */

	dh_gen_key(dh, kex->we_need * 8);

	/* This is f, we initialise it now to make life easier */

	dh_server_pub = BN_new();

	if (dh_server_pub == NULL)

		fatal("dh_server_pub == NULL");

	token_ptr = GSS_C_NO_BUFFER;

	do {

		debug("Calling gss_init_sec_context");

		maj_status = ssh_gssapi_init_ctx(ctxt,

		    kex->gss_deleg_creds, token_ptr, &send_tok,

		    &ret_flags);

		if (GSS_ERROR(maj_status)) {

			if (send_tok.length != 0) {

				packet_start(SSH2_MSG_KEXGSS_CONTINUE);

				packet_put_string(send_tok.value,

				    send_tok.length);

			}

			fatal("gss_init_context failed");

		}

		/* If we've got an old receive buffer get rid of it */

		if (token_ptr != GSS_C_NO_BUFFER)

			xfree(recv_tok.value);

		if (maj_status == GSS_S_COMPLETE) {

			/* If mutual state flag is not true, kex fails */

			if (!(ret_flags & GSS_C_MUTUAL_FLAG))

				fatal("Mutual authentication failed");

			/* If integ avail flag is not true kex fails */

			if (!(ret_flags & GSS_C_INTEG_FLAG))

				fatal("Integrity check failed");

		}

		/* 

		 * If we have data to send, then the last message that we

		 * received cannot have been a 'complete'. 

		 */

		if (send_tok.length != 0) {

			if (first) {

				packet_start(SSH2_MSG_KEXGSS_INIT);

				packet_put_string(send_tok.value,

				    send_tok.length);

				packet_put_bignum2(dh->pub_key);

				first = 0;

			} else {

				packet_start(SSH2_MSG_KEXGSS_CONTINUE);

				packet_put_string(send_tok.value,

				    send_tok.length);

			}

			packet_send();

			gss_release_buffer(&min_status, &send_tok);

			/* If we've sent them data, they should reply */

			do {	

				type = packet_read();

				if (type == SSH2_MSG_KEXGSS_HOSTKEY) {

					debug("Received KEXGSS_HOSTKEY");

					if (serverhostkey)

						fatal("Server host key received more than once");

					serverhostkey = 

					    packet_get_string(&slen);

				}

			} while (type == SSH2_MSG_KEXGSS_HOSTKEY);

			switch (type) {

			case SSH2_MSG_KEXGSS_CONTINUE:

				debug("Received GSSAPI_CONTINUE");

				if (maj_status == GSS_S_COMPLETE) 

					fatal("GSSAPI Continue received from server when complete");

				recv_tok.value = packet_get_string(&strlen);

				recv_tok.length = strlen; 

				break;

			case SSH2_MSG_KEXGSS_COMPLETE:

				debug("Received GSSAPI_COMPLETE");

				packet_get_bignum2(dh_server_pub);

				msg_tok.value =  packet_get_string(&strlen);

				msg_tok.length = strlen; 

				/* Is there a token included? */

				if (packet_get_char()) {

					recv_tok.value=

					    packet_get_string(&strlen);

					recv_tok.length = strlen;

					/* If we're already complete - protocol error */

					if (maj_status == GSS_S_COMPLETE)

						packet_disconnect("Protocol error: received token when complete");

					} else {

						/* No token included */

						if (maj_status != GSS_S_COMPLETE)

							packet_disconnect("Protocol error: did not receive final token");

				}

				break;

			case SSH2_MSG_KEXGSS_ERROR:

				debug("Received Error");

				maj_status = packet_get_int();

				min_status = packet_get_int();

				msg = packet_get_string(NULL);

				lang = packet_get_string(NULL);

				fatal("GSSAPI Error: \n%s",msg);

			default:

				packet_disconnect("Protocol error: didn't expect packet type %d",

		    		type);

			}

			token_ptr = &recv_tok;

		} else {

			/* No data, and not complete */

			if (maj_status != GSS_S_COMPLETE)

				fatal("Not complete, and no token output");

		}

	} while (maj_status & GSS_S_CONTINUE_NEEDED);

	/* 

	 * We _must_ have received a COMPLETE message in reply from the 

	 * server, which will have set dh_server_pub and msg_tok 

	 */

	if (type != SSH2_MSG_KEXGSS_COMPLETE)

		fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");

	/* Check f in range [1, p-1] */

	if (!dh_pub_is_valid(dh, dh_server_pub))

		packet_disconnect("bad server public DH value");

	/* compute K=f^x mod p */

	klen = DH_size(dh);

	kbuf = xmalloc(klen);

	kout = DH_compute_key(kbuf, dh_server_pub, dh);

	shared_secret = BN_new();

	BN_bin2bn(kbuf,kout, shared_secret);

	memset(kbuf, 0, klen);

	xfree(kbuf);

	if (gex) {

		kexgex_hash(

		    kex->evp_md,

		    kex->client_version_string,

		    kex->server_version_string,

		    buffer_ptr(&kex->my), buffer_len(&kex->my),

		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),

		    serverhostkey, slen,

 		    min, nbits, max,

		    dh->p, dh->g,

		    dh->pub_key,

		    dh_server_pub,

		    shared_secret,

		    &hash, &hashlen

		);

	} else {

		/* The GSS hash is identical to the DH one */

		kex_dh_hash( kex->client_version_string, 

		    kex->server_version_string,

		    buffer_ptr(&kex->my), buffer_len(&kex->my),

		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),

		    serverhostkey, slen, /* server host key */

		    dh->pub_key,	/* e */

		    dh_server_pub,	/* f */

		    shared_secret,	/* K */

		    &hash, &hashlen

		);

        }

	gssbuf.value = hash;

	gssbuf.length = hashlen;

        /* Verify that the hash matches the MIC we just got. */

	if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))

		packet_disconnect("Hash's MIC didn't verify");

	xfree(msg_tok.value);

	DH_free(dh);

	if (serverhostkey)

		xfree(serverhostkey);

	BN_clear_free(dh_server_pub);

	/* save session id */

	if (kex->session_id == NULL) {

		kex->session_id_len = hashlen;

		kex->session_id = xmalloc(kex->session_id_len);

		memcpy(kex->session_id, hash, kex->session_id_len);

	}

	if (gss_kex_context == NULL)

		gss_kex_context = ctxt;

	else

		ssh_gssapi_delete_ctx(&ctxt);

	kex_derive_keys(kex, hash, hashlen, shared_secret);

	BN_clear_free(shared_secret);

	kex_finish(kex);

}

#endif /* GSSAPI */

/*

 * Copyright (c) 2001-2005 Simon Wilkinson. All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#include "includes.h"

#ifdef GSSAPI

#include <openssl/crypto.h>

#include <openssl/bn.h>

#include "xmalloc.h"

#include "buffer.h"

#include "bufaux.h"

#include "kex.h"

#include "log.h"

#include "packet.h"

#include "dh.h"

#include "ssh2.h"

#include "ssh-gss.h"

#include "monitor_wrap.h"

void

kexgss_server(Kex *kex)

{

	OM_uint32 maj_status, min_status;

	/* 

	 * Some GSSAPI implementations use the input value of ret_flags (an

 	 * output variable) as a means of triggering mechanism specific 

 	 * features. Initializing it to zero avoids inadvertently 

 	 * activating this non-standard behaviour.

	 */

	OM_uint32 ret_flags = 0;

	gss_buffer_desc gssbuf, recv_tok, msg_tok;

	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;

	Gssctxt *ctxt = NULL;

	u_int slen, klen, kout, hashlen;

	u_char *kbuf, *hash;

	DH *dh;

	int min = -1, max = -1, nbits = -1;

	BIGNUM *shared_secret = NULL;

	BIGNUM *dh_client_pub = NULL;

	int type = 0;

	int gex;

	gss_OID oid;

	/* Initialise GSSAPI */

	/* If we're rekeying, privsep means that some of the private structures

	 * in the GSSAPI code are no longer available. This kludges them back

         * into life

	 */

	if (!ssh_gssapi_oid_table_ok()) 

		ssh_gssapi_server_mechanisms();

	debug2("%s: Identifying %s", __func__, kex->name);

	oid = ssh_gssapi_id_kex(NULL, kex->name, &gex);

	if (oid == NULL)

	   fatal("Unknown gssapi mechanism");

	debug2("%s: Acquiring credentials", __func__);

	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))

        	fatal("Unable to acquire credentials for the server");

	if (gex) {

		debug("Doing group exchange");

		packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);

		min = packet_get_int();

		nbits = packet_get_int();

		max = packet_get_int();

		min = MAX(DH_GRP_MIN, min);

		max = MIN(DH_GRP_MAX, max);

		packet_check_eom();

		if (max < min || nbits < min || max < nbits)

			fatal("GSS_GEX, bad parameters: %d !< %d !< %d",

			    min, nbits, max);

		dh = PRIVSEP(choose_dh(min, nbits, max));

		if (dh == NULL)

			packet_disconnect("Protocol error: no matching group found");

		packet_start(SSH2_MSG_KEXGSS_GROUP);

		packet_put_bignum2(dh->p);

		packet_put_bignum2(dh->g);

		packet_send();

		packet_write_wait();

	} else {

        	dh = dh_new_group1();

	}

	dh_gen_key(dh, kex->we_need * 8);

	do {

		debug("Wait SSH2_MSG_GSSAPI_INIT");

		type = packet_read();

		switch(type) {

		case SSH2_MSG_KEXGSS_INIT:

			if (dh_client_pub != NULL) 

				fatal("Received KEXGSS_INIT after initialising");

			recv_tok.value = packet_get_string(&slen);

			recv_tok.length = slen; 

			if ((dh_client_pub = BN_new()) == NULL)

				fatal("dh_client_pub == NULL");

			packet_get_bignum2(dh_client_pub);

			/* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */

			break;

		case SSH2_MSG_KEXGSS_CONTINUE:

			recv_tok.value = packet_get_string(&slen);

			recv_tok.length = slen; 

			break;

		default:

			packet_disconnect(

			    "Protocol error: didn't expect packet type %d",

			    type);

		}

		maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, 

		    &send_tok, &ret_flags));

		xfree(recv_tok.value);

		if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)

			fatal("Zero length token output when incomplete");

		if (dh_client_pub == NULL)

			fatal("No client public key");

		if (maj_status & GSS_S_CONTINUE_NEEDED) {

			debug("Sending GSSAPI_CONTINUE");

			packet_start(SSH2_MSG_KEXGSS_CONTINUE);

			packet_put_string(send_tok.value, send_tok.length);

			packet_send();

			gss_release_buffer(&min_status, &send_tok);

		}

	} while (maj_status & GSS_S_CONTINUE_NEEDED);

	if (GSS_ERROR(maj_status)) {

		if (send_tok.length > 0) {

			packet_start(SSH2_MSG_KEXGSS_CONTINUE);

			packet_put_string(send_tok.value, send_tok.length);

			packet_send();

		}

		fatal("accept_ctx died");

	}

	if (!(ret_flags & GSS_C_MUTUAL_FLAG))

		fatal("Mutual Authentication flag wasn't set");

	if (!(ret_flags & GSS_C_INTEG_FLAG))

		fatal("Integrity flag wasn't set");

	if (!dh_pub_is_valid(dh, dh_client_pub))

		packet_disconnect("bad client public DH value");

	klen = DH_size(dh);

	kbuf = xmalloc(klen); 

	kout = DH_compute_key(kbuf, dh_client_pub, dh);

	shared_secret = BN_new();

	BN_bin2bn(kbuf, kout, shared_secret);

	memset(kbuf, 0, klen);

	xfree(kbuf);

	if (gex) {

		kexgex_hash(

		    kex->evp_md,

		    kex->client_version_string, kex->server_version_string,

		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),

		    buffer_ptr(&kex->my), buffer_len(&kex->my),

		    NULL, 0,

		    min, nbits, max,

		    dh->p, dh->g,

		    dh_client_pub,

		    dh->pub_key,

		    shared_secret,

		    &hash, &hashlen

		);

	}

	else {	

		/* The GSSAPI hash is identical to the Diffie Helman one */

		kex_dh_hash(

		    kex->client_version_string, kex->server_version_string,

		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),

		    buffer_ptr(&kex->my), buffer_len(&kex->my),

		    NULL, 0, /* Change this if we start sending host keys */

		    dh_client_pub, dh->pub_key, shared_secret,

		    &hash, &hashlen

		);

	}

	BN_free(dh_client_pub);

	if (kex->session_id == NULL) {

		kex->session_id_len = hashlen;

		kex->session_id = xmalloc(kex->session_id_len);

		memcpy(kex->session_id, hash, kex->session_id_len);

	}

	gssbuf.value = hash;

	gssbuf.length = hashlen;

	if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok))))

		fatal("Couldn't get MIC");

	packet_start(SSH2_MSG_KEXGSS_COMPLETE);

	packet_put_bignum2(dh->pub_key);

	packet_put_string((char *)msg_tok.value,msg_tok.length);

	if (send_tok.length != 0) {

		packet_put_char(1); /* true */

		packet_put_string((char *)send_tok.value, send_tok.length);

	} else {

		packet_put_char(0); /* false */

	}

	packet_send();

	gss_release_buffer(&min_status, &send_tok);

	gss_release_buffer(&min_status, &msg_tok);

	if (gss_kex_context == NULL)

		gss_kex_context = ctxt;

	else 

		ssh_gssapi_delete_ctx(&ctxt);

	DH_free(dh);

	kex_derive_keys(kex, hash, hashlen, shared_secret);

	BN_clear_free(shared_secret);

	kex_finish(kex);

}

#endif /* GSSAPI */

	KEX_GSS_GRP1_SHA1,

	KEX_GSS_GEX_SHA1,

#ifdef GSSAPI

	int	gss_deleg_creds;

	int	gss_trust_dns;

	char    *gss_host;

#endif

#ifdef GSSAPI

void	kexgss_client(Kex *);

void	kexgss_server(Kex *);

#endif

	} else if (strcmp(name, "null") == 0) {

		return KEY_NULL;

	KEY_NULL,

int mm_answer_gss_sign(int, Buffer *);

    {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign},

#ifdef GSSAPI

    {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx},

    {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},

    {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign},

#endif

#ifdef GSSAPI

		/* and for the GSSAPI key exchange */

		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);

#endif

#ifdef GSSAPI

		/* and for the GSSAPI key exchange */

		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);

#endif		

#ifdef GSSAPI

	kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;

	kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;

#endif

		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1);

int 

mm_answer_gss_sign(int socket, Buffer *m)

{

	gss_buffer_desc data;

	gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;

	OM_uint32 major, minor;

	u_int len;

	data.value = buffer_get_string(m, &len);

	data.length = len;

	if (data.length != 20) 

		fatal("%s: data length incorrect: %d", __func__, data.length);

	/* Save the session ID on the first time around */

	if (session_id2_len == 0) {

		session_id2_len = data.length;

		session_id2 = xmalloc(session_id2_len);

		memcpy(session_id2, data.value, session_id2_len);

	}

	major = ssh_gssapi_sign(gsscontext, &data, &hash);

	xfree(data.value);

	buffer_clear(m);

	buffer_put_int(m, major);

	buffer_put_string(m, hash.value, hash.length);

	mm_request_send(socket, MONITOR_ANS_GSSSIGN, m);

	gss_release_buffer(&minor, &hash);

	/* Turn on getpwnam permissions */

	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);

	return (0);

}

	MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,

OM_uint32

mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)

{

	Buffer m;

	OM_uint32 major;

	u_int len;

	buffer_init(&m);

	buffer_put_string(&m, data->value, data->length);

	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m);

	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);

	major = buffer_get_int(&m);

	hash->value = buffer_get_string(&m, &len);

	hash->length = len;

	buffer_free(&m);

	return(major);

}

OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);

	oGssTrustDns,

	{ "gssapitrustdns", oGssTrustDns },

	{ "gssapitrustdns", oUnsupported },

	case oGssTrustDns:

		intptr = &options->gss_trust_dns;

		goto parse_flag;

	options->gss_trust_dns = -1;

	if (options->gss_trust_dns == -1)

		options->gss_trust_dns = 0;

	int	gss_trust_dns;		/* Trust DNS for GSS canonicalization */

	options->gss_keyex = -1;

	if (options->gss_keyex == -1)

		options->gss_keyex = 0;

	{ "gssapikeyexchange", sGssKeyEx },

	{ "gssapikeyexchange", sUnsupported },

	case sGssKeyEx:

		intptr = &options->gss_keyex;

		goto parse_flag;

	int 	gss_keyex;		/* If true, permit GSSAPI key exchange */

.It Cm GSSAPITrustDns

Set to 

.Dq yes to indicate that the DNS is trusted to securely canonicalize

the name of the host being connected to. If 

.Dq no, the hostname entered on the

command line will be passed untouched to the GSSAPI library.

The default is

.Dq no .

This option only applies to protocol version 2 connections using GSSAPI 

key exchange.

#ifdef GSSAPI

	char *orig, *gss;

	int len;

        char *gss_host;

#endif

#ifdef GSSAPI

	/* Add the GSSAPI mechanisms currently supported on this client to

	 * the key exchange algorithm proposal */

	orig = myproposal[PROPOSAL_KEX_ALGS];

	if (options.gss_trust_dns)

		gss_host = (char *)get_canonical_hostname(1);

	else

		gss_host = host;

	gss = ssh_gssapi_client_mechanisms(gss_host);

	if (gss) {

		debug("Offering GSSAPI proposal: %s", gss);

		len = strlen(orig) + strlen(gss) + 2;

		myproposal[PROPOSAL_KEX_ALGS] = xmalloc(len);

		snprintf(myproposal[PROPOSAL_KEX_ALGS], len, "%s,%s", gss, 

		    orig);

	}