[openssh-commits] [openssh] 10/14: upstream: Only store GSSAPI creds when authn succeeds

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 6f9cd19af05aa828d7778cfb047faaed1679e8b7
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Wed Sep 16 00:37:52 2026 +0000

    upstream: Only store GSSAPI creds when authn succeeds
    
    Issue report and patch from Moritz Theile
    
    ok markus, deraadt
    
    OpenBSD-Commit-ID: 812bbd22b8dd5a1583094ab2b6ff0045e4088467
---
 gss-serv.c | 15 +++++++++++----
 ssh-gss.h  |  3 ++-
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/gss-serv.c b/gss-serv.c
index 9dfe1b165..16f653202 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gss-serv.c,v 1.38 2026/09/16 00:37:07 djm Exp $ */
+/* $OpenBSD: gss-serv.c,v 1.39 2026/09/16 00:37:52 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -53,7 +53,7 @@ extern ServerOptions options;
 
 static ssh_gssapi_client gssapi_client =
     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
-    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
+    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}, 0};
 
 ssh_gssapi_mech gssapi_null_mech =
     { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
@@ -281,6 +281,7 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
 
 	gss_buffer_desc ename;
 
+	client->userok = 0;
 	client->mech = NULL;
 
 	while (supported_mechs[i]->name != NULL) {
@@ -333,6 +334,11 @@ ssh_gssapi_cleanup_creds(void)
 void
 ssh_gssapi_storecreds(void)
 {
+	if (!gssapi_client.userok) {
+		debug_f("GSSAPI client was not authorized, doing nothing");
+		return;
+	}
+
 	if (options.gss_deleg_creds == 0) {
 		debug_f("delegate credential is disabled, doing nothing");
 		return;
@@ -382,9 +388,10 @@ ssh_gssapi_userok(char *user)
 		return 0;
 	}
 	if (gssapi_client.mech && gssapi_client.mech->userok)
-		if ((*gssapi_client.mech->userok)(&gssapi_client, user))
+		if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
+			gssapi_client.userok = 1;
 			return 1;
-		else {
+		} else {
 			/* Destroy delegated credentials if userok fails */
 			ssh_gssapi_cleanup_global_client();
 			return 0;
diff --git a/ssh-gss.h b/ssh-gss.h
index a5d3c12f7..3648c6d04 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-gss.h,v 1.17 2026/09/16 00:37:07 djm Exp $ */
+/* $OpenBSD: ssh-gss.h,v 1.18 2026/09/16 00:37:52 djm Exp $ */
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
  *
@@ -74,6 +74,7 @@ typedef struct {
 	gss_cred_id_t creds;
 	struct ssh_gssapi_mech_struct *mech;
 	ssh_gssapi_ccache store;
+	int userok;
 } ssh_gssapi_client;
 
 typedef struct ssh_gssapi_mech_struct {

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.