[openssh-commits] [openssh] 09/14: upstream: Reset GSSAPI client state before authentication

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 670510d1e190b0f4e47066f24498c04ada1da0f0
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Wed Sep 16 00:37:07 2026 +0000

    upstream: Reset GSSAPI client state before authentication
    
    Avoids situation where a partially-completed GSSAPI authentication attempt
    can retain state that is subsequently used by a later attempt.
    
    Report and feedback Moritz Theile, also reported by several others.
    
    ok markus, deraadt
    
    OpenBSD-Commit-ID: 95758f23e358b7c19e6205ac1c979193a9145556
---
 auth2.c    |  3 ++-
 gss-serv.c | 21 +++++++++++++--------
 monitor.c  |  4 +++-
 ssh-gss.h  |  3 ++-
 4 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/auth2.c b/auth2.c
index 6971b933b..2da7a4da9 100644
--- a/auth2.c
+++ b/auth2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.175 2026/09/16 00:16:52 djm Exp $ */
+/* $OpenBSD: auth2.c,v 1.176 2026/09/16 00:37:07 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -336,6 +336,7 @@ input_userauth_request(int type, uint32_t seq, struct ssh *ssh)
 	auth2_challenge_stop(ssh);
 
 #ifdef GSSAPI
+	ssh_gssapi_cleanup_global_client();
 	/* XXX move to auth2_gssapi_stop() */
 	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
 	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
diff --git a/gss-serv.c b/gss-serv.c
index f9ae303b5..9dfe1b165 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gss-serv.c,v 1.37 2026/02/11 16:57:38 dtucker Exp $ */
+/* $OpenBSD: gss-serv.c,v 1.38 2026/09/16 00:37:07 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -361,12 +361,21 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
 	}
 }
 
+void
+ssh_gssapi_cleanup_global_client()
+{
+	OM_uint32 lmin;
+
+	gss_release_buffer(&lmin, &gssapi_client.displayname);
+	gss_release_buffer(&lmin, &gssapi_client.exportedname);
+	gss_release_cred(&lmin, &gssapi_client.creds);
+	explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client));
+}
+
 /* Privileged */
 int
 ssh_gssapi_userok(char *user)
 {
-	OM_uint32 lmin;
-
 	if (gssapi_client.exportedname.length == 0 ||
 	    gssapi_client.exportedname.value == NULL) {
 		debug("No suitable client data");
@@ -377,11 +386,7 @@ ssh_gssapi_userok(char *user)
 			return 1;
 		else {
 			/* Destroy delegated credentials if userok fails */
-			gss_release_buffer(&lmin, &gssapi_client.displayname);
-			gss_release_buffer(&lmin, &gssapi_client.exportedname);
-			gss_release_cred(&lmin, &gssapi_client.creds);
-			explicit_bzero(&gssapi_client,
-			    sizeof(ssh_gssapi_client));
+			ssh_gssapi_cleanup_global_client();
 			return 0;
 		}
 	else
diff --git a/monitor.c b/monitor.c
index 149671145..940dc275a 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.258 2026/07/27 12:28:52 markus Exp $ */
+/* $OpenBSD: monitor.c,v 1.259 2026/09/16 00:37:07 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos at citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -1977,6 +1977,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
 	if (!options.gss_authentication)
 		fatal_f("GSSAPI authentication not enabled");
 
+	ssh_gssapi_cleanup_global_client();
+
 	if ((r = sshbuf_get_string(m, &p, &len)) != 0)
 		fatal_fr(r, "parse");
 	goid.elements = p;
diff --git a/ssh-gss.h b/ssh-gss.h
index 7b14e74a8..a5d3c12f7 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-gss.h,v 1.16 2024/05/17 06:42:04 jsg Exp $ */
+/* $OpenBSD: ssh-gss.h,v 1.17 2026/09/16 00:37:07 djm Exp $ */
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
  *
@@ -132,6 +132,7 @@ void ssh_gssapi_do_child(char ***, u_int *);
 void ssh_gssapi_cleanup_creds(void);
 void ssh_gssapi_storecreds(void);
 const char *ssh_gssapi_displayname(void);
+void ssh_gssapi_cleanup_global_client();
 
 #endif /* GSSAPI */
 

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.