shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 09:54:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

packet: complete GSSAPI packet filter

Browse Source 
Reject all GSSAPI-related messages when compiled
without GSSAPI support.

Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Pavol Žáčik
2025-12-02 14:47:12 +01:00
committed by Jakub Jelen
parent 06edb2db5e
commit 06eea93ded
1 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
src/packet.c
View File

@@ -749,15 +749,16 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
rc = SSH_PACKET_ALLOWED; rc = SSH_PACKET_ALLOWED;
break; break;
case SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE: // 63 case SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE: // 63
/* Server only. Ignored */ /* Server only */
/* /*
* States required: * States required:
* - session_state == SSH_SESSION_STATE_AUTHENTICATING * - session_state == SSH_SESSION_STATE_AUTHENTICATING
* - session->gssapi->state == SSH_GSSAPI_STATE_RCV_MIC (TODO) * - session->gssapi->state == SSH_GSSAPI_STATE_RCV_MIC
* *
* Transitions: * Transitions:
* - None * - None
*/ */
#ifdef WITH_GSSAPI
if (session->client) { if (session->client) {
rc = SSH_PACKET_DENIED; rc = SSH_PACKET_DENIED;
break; break;
@@ -766,10 +767,22 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
rc = SSH_PACKET_DENIED; rc = SSH_PACKET_DENIED;
break; break;
} }
if (session->gssapi == NULL) {
rc = SSH_PACKET_DENIED;
break;
}
if (session->gssapi->state != SSH_GSSAPI_STATE_RCV_MIC) {
rc = SSH_PACKET_DENIED;
break;
}
rc = SSH_PACKET_ALLOWED; rc = SSH_PACKET_ALLOWED;
break; break;
#else
rc = SSH_PACKET_DENIED;
break;
#endif /* WITH_GSSAPI */
case SSH2_MSG_USERAUTH_GSSAPI_ERROR: // 64 case SSH2_MSG_USERAUTH_GSSAPI_ERROR: // 64
/* Client only. Ignored */ /* Client only */
/* /*
* States required: * States required:
* - session_state == SSH_SESSION_STATE_AUTHENTICATING * - session_state == SSH_SESSION_STATE_AUTHENTICATING
@@ -777,6 +790,7 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
* Transitions: * Transitions:
* - None * - None
*/ */
#ifdef WITH_GSSAPI
if (session->server) { if (session->server) {
rc = SSH_PACKET_DENIED; rc = SSH_PACKET_DENIED;
break; break;
@@ -788,6 +802,10 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
rc = SSH_PACKET_ALLOWED; rc = SSH_PACKET_ALLOWED;
break; break;
#else
rc = SSH_PACKET_DENIED;
break;
#endif /* WITH_GSSAPI */
case SSH2_MSG_USERAUTH_GSSAPI_ERRTOK: // 65 case SSH2_MSG_USERAUTH_GSSAPI_ERRTOK: // 65
/* /*
* States required: * States required:
@@ -796,6 +814,7 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
* Transitions: * Transitions:
* - None * - None
*/ */
#ifdef WITH_GSSAPI
if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) { if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {
rc = SSH_PACKET_DENIED; rc = SSH_PACKET_DENIED;
break; break;
@@ -803,6 +822,10 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
rc = SSH_PACKET_ALLOWED; rc = SSH_PACKET_ALLOWED;
break; break;
#else
rc = SSH_PACKET_DENIED;
break;
#endif /* WITH_GSSAPI */
case SSH2_MSG_USERAUTH_GSSAPI_MIC: // 66 case SSH2_MSG_USERAUTH_GSSAPI_MIC: // 66
/* Server only */ /* Server only */
@@ -822,7 +845,7 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
* - any other case: * - any other case:
* - None * - None
* */ * */
#ifdef WITH_GSSAPI
/* If this is a client, reject the message */ /* If this is a client, reject the message */
if (session->client) { if (session->client) {
rc = SSH_PACKET_DENIED; rc = SSH_PACKET_DENIED;
@@ -841,6 +864,10 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se
rc = SSH_PACKET_ALLOWED; rc = SSH_PACKET_ALLOWED;
break; break;
#else
rc = SSH_PACKET_DENIED;
break;
#endif /* WITH_GSSAPI */
case SSH2_MSG_GLOBAL_REQUEST: // 80 case SSH2_MSG_GLOBAL_REQUEST: // 80
/* /*
* States required: * States required: