From 55fb99fcbaaa661b659554f602da575d9bd195cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= Date: Thu, 11 Jun 2026 15:45:43 +0200 Subject: [PATCH] Add a new API function ssh_session_kex_is_gss MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pavol Žáčik Reviewed-by: Jakub Jelen Merge-Request: --- include/libssh/libssh.h | 1 + src/auth.c | 2 +- src/libssh.map | 1 + src/messages.c | 2 +- src/server.c | 2 +- src/session.c | 18 +++++++++++++++++- tests/client/torture_gssapi_key_exchange.c | 2 +- .../torture_gssapi_server_key_exchange.c | 2 +- 8 files changed, 24 insertions(+), 6 deletions(-) diff --git a/include/libssh/libssh.h b/include/libssh/libssh.h index 0444b908..cfadb679 100644 --- a/include/libssh/libssh.h +++ b/include/libssh/libssh.h @@ -944,6 +944,7 @@ LIBSSH_API void ssh_event_free(ssh_event event); LIBSSH_API const char* ssh_get_clientbanner(ssh_session session); LIBSSH_API const char* ssh_get_serverbanner(ssh_session session); LIBSSH_API const char* ssh_get_kex_algo(ssh_session session); +LIBSSH_API bool ssh_session_kex_is_gss(ssh_session session); LIBSSH_API const char* ssh_get_cipher_in(ssh_session session); LIBSSH_API const char* ssh_get_cipher_out(ssh_session session); LIBSSH_API const char* ssh_get_hmac_in(ssh_session session); diff --git a/src/auth.c b/src/auth.c index fdd04f41..5e2abdf5 100644 --- a/src/auth.c +++ b/src/auth.c @@ -2721,7 +2721,7 @@ int ssh_userauth_gssapi_keyex(ssh_session session) } /* Check if GSSAPI Key exchange was performed */ - if (!ssh_kex_is_gss(session->current_crypto)) { + if (!ssh_session_kex_is_gss(session)) { ssh_set_error(session, SSH_FATAL, "Attempt to authenticate with gssapi-keyex without " diff --git a/src/libssh.map b/src/libssh.map index 687dd06c..e8f31f95 100644 --- a/src/libssh.map +++ b/src/libssh.map @@ -512,4 +512,5 @@ LIBSSH_AFTER_4_11_0 global: ssh_bind_config_parse_string; ssh_options_get_int; + ssh_session_kex_is_gss; } LIBSSH_4_11_0; diff --git a/src/messages.c b/src/messages.c index 24b4ad3d..654346a2 100644 --- a/src/messages.c +++ b/src/messages.c @@ -1167,7 +1167,7 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request) OM_uint32 maj_stat, min_stat; ssh_buffer buf = NULL; - if (!ssh_kex_is_gss(session->current_crypto)) { + if (!ssh_session_kex_is_gss(session)) { ssh_set_error(session, SSH_FATAL, "Attempt to authenticate with gssapi-keyex without " diff --git a/src/server.c b/src/server.c index 3d70f543..15398521 100644 --- a/src/server.c +++ b/src/server.c @@ -704,7 +704,7 @@ int ssh_auth_reply_default(ssh_session session,int partial) { } /* Check if GSSAPI Key exchange was performed */ if (session->auth.supported_methods & SSH_AUTH_METHOD_GSSAPI_KEYEX) { - if (ssh_kex_is_gss(session->current_crypto)) { + if (ssh_session_kex_is_gss(session)) { strlcat(methods_c, "gssapi-keyex,", sizeof(methods_c)); } } diff --git a/src/session.c b/src/session.c index 2f47e68f..835ab1e4 100644 --- a/src/session.c +++ b/src/session.c @@ -38,6 +38,7 @@ #include "libssh/ssh2.h" #include "libssh/agent.h" #include "libssh/packet.h" +#include "libssh/kex.h" #include "libssh/session.h" #include "libssh/misc.h" #include "libssh/buffer.h" @@ -560,10 +561,25 @@ const char* ssh_get_kex_algo(ssh_session session) { return "diffie-hellman-group-exchange-sha256"; #endif /* WITH_GEX */ } - return NULL; } +/** + * @brief Check if current session keys were exchanged using + * a GSSAPI key exchange method. + * + * @param[in] session The SSH session. + * + * @return True if GSSAPI key exchange took place, false otherwise + * (other or no key exchange took place). + */ +bool ssh_session_kex_is_gss(ssh_session session) +{ + if (session == NULL || session->current_crypto == NULL) { + return false; + } + return ssh_kex_is_gss(session->current_crypto); +} /** * @brief get the name of the input cipher for the given session. * diff --git a/tests/client/torture_gssapi_key_exchange.c b/tests/client/torture_gssapi_key_exchange.c index a1fcaa1d..70bf02a5 100644 --- a/tests/client/torture_gssapi_key_exchange.c +++ b/tests/client/torture_gssapi_key_exchange.c @@ -120,7 +120,7 @@ static void torture_gssapi_key_exchange_no_tgt(void **state) rc = ssh_connect(session); assert_ssh_return_code(session, rc); - assert_false(ssh_kex_is_gss(session->current_crypto)); + assert_false(ssh_session_kex_is_gss(session)); torture_teardown_kdc_server(state); } diff --git a/tests/server/torture_gssapi_server_key_exchange.c b/tests/server/torture_gssapi_server_key_exchange.c index 476786f3..c06f676e 100644 --- a/tests/server/torture_gssapi_server_key_exchange.c +++ b/tests/server/torture_gssapi_server_key_exchange.c @@ -342,7 +342,7 @@ static void torture_gssapi_server_key_exchange_no_tgt(void **state) rc = ssh_connect(session); assert_ssh_return_code(session, rc); - assert_false(ssh_kex_is_gss(session->current_crypto)); + assert_false(ssh_session_kex_is_gss(session)); torture_teardown_kdc_server((void **)&s); }