mirror of
https://github.com/opnsense/src.git
synced 2026-02-18 18:20:26 -05:00
ff2fd01609
Highlights from the release notes are reproduced below. Some security and bug fixes were previously merged into FreeBSD and have been elided. See the upstream release notes for full details (https://www.openssh.com/releasenotes.html). --- Future deprecation notice ========================= OpenSSH plans to remove support for the DSA signature algorithm in early 2025. Potentially-incompatible changes -------------------------------- * sshd(8): the server will now block client addresses that repeatedly fail authentication, repeatedly connect without ever completing authentication or that crash the server. See the discussion of PerSourcePenalties below for more information. Operators of servers that accept connections from many users, or servers that accept connections from addresses behind NAT or proxies may need to consider these settings. * sshd(8): the server has been split into a listener binary, sshd(8), and a per-session binary "sshd-session". This allows for a much smaller listener binary, as it no longer needs to support the SSH protocol. As part of this work, support for disabling privilege separation (which previously required code changes to disable) and disabling re-execution of sshd(8) has been removed. Further separation of sshd-session into additional, minimal binaries is planned for the future. * sshd(8): several log messages have changed. In particular, some log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd". * ssh-keyscan(1): this tool previously emitted comment lines containing the hostname and SSH protocol banner to standard error. This release now emits them to standard output, but adds a new "-q" flag to silence them altogether. * sshd(8): (portable OpenSSH only) sshd will no longer use argv[0] as the PAM service name. A new "PAMServiceName" sshd_config(5) directive allows selecting the service name at runtime. This defaults to "sshd". bz2101 New features ------------ * sshd(8): sshd(8) will now penalise client addresses that, for various reasons, do not successfully complete authentication. This feature is controlled by a new sshd_config(5) PerSourcePenalties option and is on by default. * ssh(8): allow the HostkeyAlgorithms directive to disable the implicit fallback from certificate host key to plain host keys. Portability ----------- * sshd(8): expose SSH_AUTH_INFO_0 always to PAM auth modules unconditionally. The previous behaviour was to expose it only when particular authentication methods were in use. * ssh(1), ssh-agent(8): allow the presence of the WAYLAND_DISPLAY environment variable to enable SSH_ASKPASS, similarly to the X11 DISPLAY environment variable. GHPR479 --- Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D48914 (cherry picked from commit 0fdf8fae8b569bf9fff3b5171e669dcd7cf9c79e) (cherry picked from commit b4bb480ae9294d7e4b375f0ead9ae57517c79ef3) (cherry picked from commit e95979047aec384852102cf8bb1d55278ea77eeb) (cherry picked from commit dcb4ae528d357f34e4a4b4882c2757c67c98e395) Approved by: re (accelerated MFC)
138 lines
4.7 KiB
C
138 lines
4.7 KiB
C
/* $OpenBSD: ssh-gss.h,v 1.16 2024/05/17 06:42:04 jsg Exp $ */
|
|
/*
|
|
* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#ifndef _SSH_GSS_H
|
|
#define _SSH_GSS_H
|
|
|
|
#ifdef GSSAPI
|
|
|
|
#ifdef HAVE_GSSAPI_GSSAPI_H
|
|
#include <gssapi/gssapi.h>
|
|
#elif defined(HAVE_GSSAPI_H)
|
|
#include <gssapi.h>
|
|
#endif
|
|
|
|
#ifdef KRB5
|
|
# ifndef HEIMDAL
|
|
# ifdef HAVE_GSSAPI_GENERIC_H
|
|
# include <gssapi_generic.h>
|
|
# elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
|
|
# include <gssapi/gssapi_generic.h>
|
|
# endif
|
|
|
|
/* Old MIT Kerberos doesn't seem to define GSS_NT_HOSTBASED_SERVICE */
|
|
|
|
# if !HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE
|
|
# define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
|
|
# endif /* !HAVE_DECL_GSS_C_NT_... */
|
|
|
|
# endif /* !HEIMDAL */
|
|
#endif /* KRB5 */
|
|
|
|
/* draft-ietf-secsh-gsskeyex-06 */
|
|
#define SSH2_MSG_USERAUTH_GSSAPI_RESPONSE 60
|
|
#define SSH2_MSG_USERAUTH_GSSAPI_TOKEN 61
|
|
#define SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE 63
|
|
#define SSH2_MSG_USERAUTH_GSSAPI_ERROR 64
|
|
#define SSH2_MSG_USERAUTH_GSSAPI_ERRTOK 65
|
|
#define SSH2_MSG_USERAUTH_GSSAPI_MIC 66
|
|
|
|
#define SSH_GSS_OIDTYPE 0x06
|
|
|
|
typedef struct {
|
|
char *filename;
|
|
char *envvar;
|
|
char *envval;
|
|
void *data;
|
|
} ssh_gssapi_ccache;
|
|
|
|
typedef struct {
|
|
gss_buffer_desc displayname;
|
|
gss_buffer_desc exportedname;
|
|
gss_cred_id_t creds;
|
|
struct ssh_gssapi_mech_struct *mech;
|
|
ssh_gssapi_ccache store;
|
|
} ssh_gssapi_client;
|
|
|
|
typedef struct ssh_gssapi_mech_struct {
|
|
char *enc_name;
|
|
char *name;
|
|
gss_OID_desc oid;
|
|
int (*dochild) (ssh_gssapi_client *);
|
|
int (*userok) (ssh_gssapi_client *, char *);
|
|
int (*localname) (ssh_gssapi_client *, char **);
|
|
void (*storecreds) (ssh_gssapi_client *);
|
|
} ssh_gssapi_mech;
|
|
|
|
typedef struct {
|
|
OM_uint32 major; /* both */
|
|
OM_uint32 minor; /* both */
|
|
gss_ctx_id_t context; /* both */
|
|
gss_name_t name; /* both */
|
|
gss_OID oid; /* client */
|
|
gss_cred_id_t creds; /* server */
|
|
gss_name_t client; /* server */
|
|
gss_cred_id_t client_creds; /* server */
|
|
} Gssctxt;
|
|
|
|
extern ssh_gssapi_mech *supported_mechs[];
|
|
|
|
int ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
|
|
void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
|
|
void ssh_gssapi_set_oid(Gssctxt *, gss_OID);
|
|
void ssh_gssapi_supported_oids(gss_OID_set *);
|
|
void ssh_gssapi_prepare_supported_oids(void);
|
|
OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *);
|
|
|
|
struct sshbuf;
|
|
int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
|
|
|
|
OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
|
|
OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
|
|
gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
|
|
OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *,
|
|
gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
|
|
OM_uint32 ssh_gssapi_getclient(Gssctxt *, ssh_gssapi_client *);
|
|
void ssh_gssapi_error(Gssctxt *);
|
|
char *ssh_gssapi_last_error(Gssctxt *, OM_uint32 *, OM_uint32 *);
|
|
void ssh_gssapi_build_ctx(Gssctxt **);
|
|
void ssh_gssapi_delete_ctx(Gssctxt **);
|
|
OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
|
|
void ssh_gssapi_buildmic(struct sshbuf *, const char *,
|
|
const char *, const char *, const struct sshbuf *);
|
|
int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
|
|
|
|
/* In the server */
|
|
OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
|
|
int ssh_gssapi_userok(char *name);
|
|
OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
|
|
void ssh_gssapi_do_child(char ***, u_int *);
|
|
void ssh_gssapi_cleanup_creds(void);
|
|
void ssh_gssapi_storecreds(void);
|
|
const char *ssh_gssapi_displayname(void);
|
|
|
|
#endif /* GSSAPI */
|
|
|
|
#endif /* _SSH_GSS_H */
|