Add a new API function ssh_session_kex_is_gss

Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Merge-Request: <https://gitlab.com/libssh/libssh-mirror/-/merge_requests/842>

include/libssh/libssh.h

@@ -944,6 +944,7 @@ LIBSSH_API void ssh_event_free(ssh_event event);
 LIBSSH_API const char* ssh_get_clientbanner(ssh_session session);
 LIBSSH_API const char* ssh_get_serverbanner(ssh_session session);
 LIBSSH_API const char* ssh_get_kex_algo(ssh_session session);
+LIBSSH_API bool ssh_session_kex_is_gss(ssh_session session);
 LIBSSH_API const char* ssh_get_cipher_in(ssh_session session);
 LIBSSH_API const char* ssh_get_cipher_out(ssh_session session);
 LIBSSH_API const char* ssh_get_hmac_in(ssh_session session);

src/auth.c

@@ -2721,7 +2721,7 @@ int ssh_userauth_gssapi_keyex(ssh_session session)
     }
 
     /* Check if GSSAPI Key exchange was performed */
-    if (!ssh_kex_is_gss(session->current_crypto)) {
+    if (!ssh_session_kex_is_gss(session)) {
         ssh_set_error(session,
                       SSH_FATAL,
                       "Attempt to authenticate with gssapi-keyex without "

src/libssh.map

@@ -512,4 +512,5 @@ LIBSSH_AFTER_4_11_0
     global:
         ssh_bind_config_parse_string;
         ssh_options_get_int;
+        ssh_session_kex_is_gss;
 } LIBSSH_4_11_0;

src/messages.c

@@ -1167,7 +1167,7 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request)
         OM_uint32 maj_stat, min_stat;
         ssh_buffer buf = NULL;
 
-        if (!ssh_kex_is_gss(session->current_crypto)) {
+        if (!ssh_session_kex_is_gss(session)) {
             ssh_set_error(session,
                           SSH_FATAL,
                           "Attempt to authenticate with gssapi-keyex without "

src/server.c

@@ -704,7 +704,7 @@ int ssh_auth_reply_default(ssh_session session,int partial) {
   }
   /* Check if GSSAPI Key exchange was performed */
   if (session->auth.supported_methods & SSH_AUTH_METHOD_GSSAPI_KEYEX) {
-      if (ssh_kex_is_gss(session->current_crypto)) {
+      if (ssh_session_kex_is_gss(session)) {
           strlcat(methods_c, "gssapi-keyex,", sizeof(methods_c));
       }
   }

src/session.c

@@ -38,6 +38,7 @@
 #include "libssh/ssh2.h"
 #include "libssh/agent.h"
 #include "libssh/packet.h"
+#include "libssh/kex.h"
 #include "libssh/session.h"
 #include "libssh/misc.h"
 #include "libssh/buffer.h"
@@ -560,10 +561,25 @@ const char* ssh_get_kex_algo(ssh_session session) {
         return "diffie-hellman-group-exchange-sha256";
 #endif /* WITH_GEX */
     }
-
     return NULL;
 }
 
+/**
+ * @brief Check if current session keys were exchanged using
+ *        a GSSAPI key exchange method.
+ *
+ * @param[in] session The SSH session.
+ *
+ * @return True if GSSAPI key exchange took place, false otherwise
+ *         (other or no key exchange took place).
+ */
+bool ssh_session_kex_is_gss(ssh_session session)
+{
+    if (session == NULL || session->current_crypto == NULL) {
+        return false;
+    }
+    return ssh_kex_is_gss(session->current_crypto);
+}
 /**
  * @brief get the name of the input cipher for the given session.
  *

tests/client/torture_gssapi_key_exchange.c

@@ -120,7 +120,7 @@ static void torture_gssapi_key_exchange_no_tgt(void **state)
     rc = ssh_connect(session);
     assert_ssh_return_code(session, rc);
 
-    assert_false(ssh_kex_is_gss(session->current_crypto));
+    assert_false(ssh_session_kex_is_gss(session));
 
     torture_teardown_kdc_server(state);
 }

tests/server/torture_gssapi_server_key_exchange.c

@@ -342,7 +342,7 @@ static void torture_gssapi_server_key_exchange_no_tgt(void **state)
     rc = ssh_connect(session);
     assert_ssh_return_code(session, rc);
 
-    assert_false(ssh_kex_is_gss(session->current_crypto));
+    assert_false(ssh_session_kex_is_gss(session));
 
     torture_teardown_kdc_server((void **)&s);
 }