gitlabhq/gitlab-shell

//go:build gssapi

package sshd

import (
    "fmt"
    "sync"

    "github.com/openshift/gssapi"

    "gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"

    "gitlab.com/gitlab-org/labkit/log"
)

func NewGSSAPIServer(c *config.GSSAPIConfig) (*OSGSSAPIServer, error) {
    lib, err := loadGSSAPILib(c)
    if err != nil {
        return nil, err
    }

    s := &OSGSSAPIServer{
        ServicePrincipalName: c.ServicePrincipalName,
        lib:                  lib,
    }

    return s, nil
}

func loadGSSAPILib(config *config.GSSAPIConfig) (*gssapi.Lib, error) {
    var err error
    var lib *gssapi.Lib

    if config.Enabled {
        options := &gssapi.Options{
            Krb5Ktname: config.Keytab,
        }

        if config.LibPath != "" {
            options.LibPath = config.LibPath
        }

        lib, err = gssapi.Load(options)

        if err != nil {
            log.WithError(err).Error("Unable to load GSSAPI library, gssapi-with-mic is disabled")
            config.Enabled = false
        }
    }

    return lib, err
}

type OSGSSAPIServer struct {
    Keytab               string
    ServicePrincipalName string

    mutex     sync.RWMutex
    lib       *gssapi.Lib
    contextId *gssapi.CtxId
}

func (server *OSGSSAPIServer) str2name(str string) (*gssapi.Name, error) {
    strBuffer, err := server.lib.MakeBufferString(str)
    if err != nil {
        return nil, err
    }
    defer strBuffer.Release()

    return strBuffer.Name(server.lib.GSS_C_NO_OID)
}

func (server *OSGSSAPIServer) AcceptSecContext(
    token []byte,
) (
    outputToken []byte,
    srcName string,
    needContinue bool,
    err error,
) {
    server.mutex.Lock()
    defer server.mutex.Unlock()

    tokenBuffer, err := server.lib.MakeBufferBytes(token)
    if err != nil {
        return
    }
    defer tokenBuffer.Release()

    var spn *gssapi.CredId = server.lib.GSS_C_NO_CREDENTIAL
    if server.ServicePrincipalName != "" {
        var name *gssapi.Name
        name, err = server.str2name(server.ServicePrincipalName)
        if err != nil {
            return
        }
        defer name.Release()

        var actualMech *gssapi.OIDSet
        spn, actualMech, _, err = server.lib.AcquireCred(name, 0, server.lib.GSS_C_NO_OID_SET, gssapi.GSS_C_ACCEPT)
        if err != nil {
            return
        }
        defer spn.Release()
        defer actualMech.Release()
    }

    ctxOut, srcNameName, _, outputTokenBuffer, _, _, _, err := server.lib.AcceptSecContext(
        server.contextId,
        spn,
        tokenBuffer,
        nil,
    )
    if err == gssapi.ErrContinueNeeded {
        needContinue = true
        err = nil
    } else if err != nil {
        return
    }
    defer outputTokenBuffer.Release()
    defer srcNameName.Release()

    outputToken = outputTokenBuffer.Bytes()
    server.contextId = ctxOut

    return outputToken, srcNameName.String(), needContinue, err
}

func (server *OSGSSAPIServer) VerifyMIC(
    micField []byte,
    micToken []byte,
) error {
    server.mutex.Lock()
    defer server.mutex.Unlock()

    if server.contextId == nil {
        return fmt.Errorf("gssapi: uninitialized contextId")
    }

    micFieldBuffer, err := server.lib.MakeBufferBytes(micField)
    if err != nil {
        return err
    }
    defer micFieldBuffer.Release()
    micTokenBuffer, err := server.lib.MakeBufferBytes(micToken)
    if err != nil {
        return err
    }
    defer micTokenBuffer.Release()

    _, err = server.contextId.VerifyMIC(micFieldBuffer, micTokenBuffer)
    return err

}

func (server *OSGSSAPIServer) DeleteSecContext() error {
    server.mutex.Lock()
    defer server.mutex.Unlock()

    if server.contextId == nil {
        return nil
    }

    err := server.contextId.DeleteSecContext()
    if err == nil {
        server.contextId = server.lib.GSS_C_NO_CONTEXT
    }
    return err
}