Annotation of src/usr.bin/ssh/auth2-pubkey.c, Revision 1.75
1.75 ! djm 1: /* $OpenBSD: auth2-pubkey.c,v 1.74 2017/12/21 00:00:28 djm Exp $ */
1.1 markus 2: /*
3: * Copyright (c) 2000 Markus Friedl. All rights reserved.
4: *
5: * Redistribution and use in source and binary forms, with or without
6: * modification, are permitted provided that the following conditions
7: * are met:
8: * 1. Redistributions of source code must retain the above copyright
9: * notice, this list of conditions and the following disclaimer.
10: * 2. Redistributions in binary form must reproduce the above copyright
11: * notice, this list of conditions and the following disclaimer in the
12: * documentation and/or other materials provided with the distribution.
13: *
14: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24: */
25:
1.10 stevesk 26:
27: #include <sys/types.h>
28: #include <sys/stat.h>
1.13 stevesk 29:
1.31 djm 30: #include <errno.h>
1.16 djm 31: #include <fcntl.h>
1.31 djm 32: #include <paths.h>
1.13 stevesk 33: #include <pwd.h>
1.31 djm 34: #include <signal.h>
1.14 stevesk 35: #include <stdio.h>
1.15 deraadt 36: #include <stdarg.h>
1.20 djm 37: #include <string.h>
38: #include <time.h>
1.17 dtucker 39: #include <unistd.h>
1.44 djm 40: #include <limits.h>
1.1 markus 41:
1.15 deraadt 42: #include "xmalloc.h"
1.8 dtucker 43: #include "ssh.h"
1.1 markus 44: #include "ssh2.h"
45: #include "packet.h"
46: #include "buffer.h"
47: #include "log.h"
1.41 millert 48: #include "misc.h"
1.1 markus 49: #include "servconf.h"
50: #include "compat.h"
1.64 markus 51: #include "sshkey.h"
1.15 deraadt 52: #include "hostfile.h"
1.1 markus 53: #include "auth.h"
54: #include "pathnames.h"
55: #include "uidswap.h"
56: #include "auth-options.h"
57: #include "canohost.h"
1.15 deraadt 58: #ifdef GSSAPI
59: #include "ssh-gss.h"
60: #endif
1.1 markus 61: #include "monitor_wrap.h"
1.21 djm 62: #include "authfile.h"
1.24 djm 63: #include "match.h"
1.50 djm 64: #include "ssherr.h"
65: #include "channels.h" /* XXX for session.h */
66: #include "session.h" /* XXX for child_set_env(); refactor? */
1.1 markus 67:
68: /* import */
69: extern ServerOptions options;
70: extern u_char *session_id2;
1.4 markus 71: extern u_int session_id2_len;
1.1 markus 72:
1.73 djm 73: static char *
74: format_key(const struct sshkey *key)
75: {
76: char *ret, *fp = sshkey_fingerprint(key,
77: options.fingerprint_hash, SSH_FP_DEFAULT);
78:
79: xasprintf(&ret, "%s %s", sshkey_type(key), fp);
80: free(fp);
81: return ret;
82: }
83:
1.2 markus 84: static int
1.65 markus 85: userauth_pubkey(struct ssh *ssh)
1.1 markus 86: {
1.65 markus 87: Authctxt *authctxt = ssh->authctxt;
1.64 markus 88: struct sshbuf *b;
1.63 markus 89: struct sshkey *key = NULL;
1.73 djm 90: char *pkalg, *userstyle = NULL, *key_s = NULL, *ca_s = NULL;
1.64 markus 91: u_char *pkblob, *sig, have_sig;
92: size_t blen, slen;
93: int r, pktype;
1.1 markus 94: int authenticated = 0;
95:
96: if (!authctxt->valid) {
1.55 djm 97: debug2("%s: disabled because of invalid user", __func__);
1.1 markus 98: return 0;
99: }
1.75 ! djm 100: if ((r = sshpkt_get_u8(ssh, &have_sig)) != 0 ||
! 101: (r = sshpkt_get_cstring(ssh, &pkalg, NULL)) != 0 ||
! 102: (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0)
! 103: fatal("%s: parse request failed: %s", __func__, ssh_err(r));
1.64 markus 104: pktype = sshkey_type_from_name(pkalg);
1.1 markus 105: if (pktype == KEY_UNSPEC) {
106: /* this is perfectly legal */
1.55 djm 107: logit("%s: unsupported public key algorithm: %s",
108: __func__, pkalg);
1.1 markus 109: goto done;
110: }
1.64 markus 111: if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
112: error("%s: could not parse key: %s", __func__, ssh_err(r));
113: goto done;
114: }
1.1 markus 115: if (key == NULL) {
1.55 djm 116: error("%s: cannot decode key: %s", __func__, pkalg);
1.1 markus 117: goto done;
118: }
119: if (key->type != pktype) {
1.55 djm 120: error("%s: type mismatch for decoded key "
121: "(received %d, expected %d)", __func__, key->type, pktype);
1.39 djm 122: goto done;
123: }
1.64 markus 124: if (sshkey_type_plain(key->type) == KEY_RSA &&
125: (ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
1.39 djm 126: logit("Refusing RSA key because client uses unsafe "
127: "signature scheme");
1.1 markus 128: goto done;
129: }
1.68 djm 130: if (auth2_key_already_used(authctxt, key)) {
1.64 markus 131: logit("refusing previously-used %s key", sshkey_type(key));
1.44 djm 132: goto done;
133: }
1.49 djm 134: if (match_pattern_list(sshkey_ssh_name(key),
135: options.pubkey_key_types, 0) != 1) {
1.45 djm 136: logit("%s: key type %s not in PubkeyAcceptedKeyTypes",
137: __func__, sshkey_ssh_name(key));
138: goto done;
139: }
140:
1.73 djm 141: key_s = format_key(key);
142: if (sshkey_is_cert(key))
143: ca_s = format_key(key->cert->signature_key);
144:
1.1 markus 145: if (have_sig) {
1.73 djm 146: debug3("%s: have %s signature for %s%s%s",
147: __func__, pkalg, key_s,
148: ca_s == NULL ? "" : " CA ",
149: ca_s == NULL ? "" : ca_s);
1.64 markus 150: if ((r = sshpkt_get_string(ssh, &sig, &slen)) != 0 ||
151: (r = sshpkt_get_end(ssh)) != 0)
152: fatal("%s: %s", __func__, ssh_err(r));
153: if ((b = sshbuf_new()) == NULL)
154: fatal("%s: sshbuf_new failed", __func__);
155: if (ssh->compat & SSH_OLD_SESSIONID) {
156: if ((r = sshbuf_put(b, session_id2,
157: session_id2_len)) != 0)
158: fatal("%s: sshbuf_put session id: %s",
159: __func__, ssh_err(r));
1.1 markus 160: } else {
1.64 markus 161: if ((r = sshbuf_put_string(b, session_id2,
162: session_id2_len)) != 0)
163: fatal("%s: sshbuf_put_string session id: %s",
164: __func__, ssh_err(r));
1.1 markus 165: }
166: /* reconstruct packet */
1.35 djm 167: xasprintf(&userstyle, "%s%s%s", authctxt->user,
168: authctxt->style ? ":" : "",
169: authctxt->style ? authctxt->style : "");
1.64 markus 170: if ((r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
171: (r = sshbuf_put_cstring(b, userstyle)) != 0 ||
1.75 ! djm 172: (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
! 173: (r = sshbuf_put_cstring(b, "publickey")) != 0 ||
! 174: (r = sshbuf_put_u8(b, have_sig)) != 0 ||
! 175: (r = sshbuf_put_cstring(b, pkalg) != 0) ||
! 176: (r = sshbuf_put_string(b, pkblob, blen)) != 0)
1.64 markus 177: fatal("%s: build packet failed: %s",
178: __func__, ssh_err(r));
1.1 markus 179: #ifdef DEBUG_PK
1.64 markus 180: sshbuf_dump(b, stderr);
1.1 markus 181: #endif
1.37 djm 182:
1.1 markus 183: /* test for correct signature */
184: authenticated = 0;
1.48 djm 185: if (PRIVSEP(user_key_allowed(authctxt->pw, key, 1)) &&
1.64 markus 186: PRIVSEP(sshkey_verify(key, sig, slen, sshbuf_ptr(b),
1.74 djm 187: sshbuf_len(b), NULL, ssh->compat)) == 0) {
1.1 markus 188: authenticated = 1;
1.44 djm 189: }
1.64 markus 190: sshbuf_free(b);
1.36 djm 191: free(sig);
1.68 djm 192: auth2_record_key(authctxt, authenticated, key);
1.1 markus 193: } else {
1.73 djm 194: debug("%s: test pkalg %s pkblob %s%s%s",
195: __func__, pkalg, key_s,
196: ca_s == NULL ? "" : " CA ",
197: ca_s == NULL ? "" : ca_s);
198:
1.64 markus 199: if ((r = sshpkt_get_end(ssh)) != 0)
200: fatal("%s: %s", __func__, ssh_err(r));
1.1 markus 201:
202: /* XXX fake reply and always send PK_OK ? */
203: /*
204: * XXX this allows testing whether a user is allowed
205: * to login: if you happen to have a valid pubkey this
206: * message is sent. the message is NEVER sent at all
207: * if a user is not allowed to login. is this an
208: * issue? -markus
209: */
1.48 djm 210: if (PRIVSEP(user_key_allowed(authctxt->pw, key, 0))) {
1.64 markus 211: if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_PK_OK))
212: != 0 ||
213: (r = sshpkt_put_cstring(ssh, pkalg)) != 0 ||
214: (r = sshpkt_put_string(ssh, pkblob, blen)) != 0 ||
215: (r = sshpkt_send(ssh)) != 0)
216: fatal("%s: %s", __func__, ssh_err(r));
217: ssh_packet_write_wait(ssh);
1.1 markus 218: authctxt->postponed = 1;
219: }
220: }
221: if (authenticated != 1)
222: auth_clear_options();
223: done:
1.55 djm 224: debug2("%s: authenticated %d pkalg %s", __func__, authenticated, pkalg);
1.68 djm 225: sshkey_free(key);
1.64 markus 226: free(userstyle);
1.36 djm 227: free(pkalg);
228: free(pkblob);
1.73 djm 229: free(key_s);
230: free(ca_s);
1.1 markus 231: return authenticated;
232: }
233:
1.24 djm 234: static int
1.40 djm 235: match_principals_option(const char *principal_list, struct sshkey_cert *cert)
1.24 djm 236: {
237: char *result;
238: u_int i;
239:
240: /* XXX percent_expand() sequences for authorized_principals? */
241:
242: for (i = 0; i < cert->nprincipals; i++) {
243: if ((result = match_list(cert->principals[i],
244: principal_list, NULL)) != NULL) {
245: debug3("matched principal from key options \"%.100s\"",
246: result);
1.36 djm 247: free(result);
1.24 djm 248: return 1;
249: }
250: }
251: return 0;
252: }
253:
254: static int
1.67 markus 255: process_principals(FILE *f, const char *file, struct passwd *pw,
1.56 djm 256: const struct sshkey_cert *cert)
1.24 djm 257: {
1.26 djm 258: char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts;
1.24 djm 259: u_long linenum = 0;
1.62 djm 260: u_int i, found_principal = 0;
1.24 djm 261:
262: while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
1.62 djm 263: /* Always consume entire input */
264: if (found_principal)
265: continue;
1.26 djm 266: /* Skip leading whitespace. */
1.24 djm 267: for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
268: ;
1.26 djm 269: /* Skip blank and comment lines. */
270: if ((ep = strchr(cp, '#')) != NULL)
271: *ep = '\0';
272: if (!*cp || *cp == '\n')
1.24 djm 273: continue;
1.26 djm 274: /* Trim trailing whitespace. */
275: ep = cp + strlen(cp) - 1;
276: while (ep > cp && (*ep == '\n' || *ep == ' ' || *ep == '\t'))
277: *ep-- = '\0';
278: /*
279: * If the line has internal whitespace then assume it has
280: * key options.
281: */
282: line_opts = NULL;
283: if ((ep = strrchr(cp, ' ')) != NULL ||
284: (ep = strrchr(cp, '\t')) != NULL) {
285: for (; *ep == ' ' || *ep == '\t'; ep++)
1.27 deraadt 286: ;
1.26 djm 287: line_opts = cp;
288: cp = ep;
289: }
1.24 djm 290: for (i = 0; i < cert->nprincipals; i++) {
291: if (strcmp(cp, cert->principals[i]) == 0) {
1.51 djm 292: debug3("%s:%lu: matched principal \"%.100s\"",
1.67 markus 293: file, linenum, cert->principals[i]);
1.26 djm 294: if (auth_parse_options(pw, line_opts,
295: file, linenum) != 1)
296: continue;
1.62 djm 297: found_principal = 1;
298: continue;
1.24 djm 299: }
300: }
301: }
1.62 djm 302: return found_principal;
1.51 djm 303: }
304:
305: static int
306: match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert)
307: {
308: FILE *f;
309: int success;
310:
311: temporarily_use_uid(pw);
312: debug("trying authorized principals file %s", file);
313: if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) {
314: restore_uid();
315: return 0;
316: }
317: success = process_principals(f, file, pw, cert);
1.24 djm 318: fclose(f);
319: restore_uid();
1.51 djm 320: return success;
1.31 djm 321: }
1.24 djm 322:
1.31 djm 323: /*
1.51 djm 324: * Checks whether principal is allowed in output of command.
325: * returns 1 if the principal is allowed or 0 otherwise.
326: */
327: static int
1.56 djm 328: match_principals_command(struct passwd *user_pw, const struct sshkey *key)
1.51 djm 329: {
1.56 djm 330: const struct sshkey_cert *cert = key->cert;
1.51 djm 331: FILE *f = NULL;
1.56 djm 332: int r, ok, found_principal = 0;
1.51 djm 333: struct passwd *pw;
334: int i, ac = 0, uid_swapped = 0;
335: pid_t pid;
336: char *tmp, *username = NULL, *command = NULL, **av = NULL;
1.56 djm 337: char *ca_fp = NULL, *key_fp = NULL, *catext = NULL, *keytext = NULL;
1.58 djm 338: char serial_s[16];
1.51 djm 339: void (*osigchld)(int);
340:
341: if (options.authorized_principals_command == NULL)
342: return 0;
343: if (options.authorized_principals_command_user == NULL) {
344: error("No user for AuthorizedPrincipalsCommand specified, "
345: "skipping");
346: return 0;
347: }
348:
349: /*
350: * NB. all returns later this function should go via "out" to
351: * ensure the original SIGCHLD handler is restored properly.
352: */
353: osigchld = signal(SIGCHLD, SIG_DFL);
354:
355: /* Prepare and verify the user for the command */
356: username = percent_expand(options.authorized_principals_command_user,
357: "u", user_pw->pw_name, (char *)NULL);
358: pw = getpwnam(username);
359: if (pw == NULL) {
360: error("AuthorizedPrincipalsCommandUser \"%s\" not found: %s",
361: username, strerror(errno));
362: goto out;
363: }
364:
365: /* Turn the command into an argument vector */
1.69 djm 366: if (argv_split(options.authorized_principals_command, &ac, &av) != 0) {
1.51 djm 367: error("AuthorizedPrincipalsCommand \"%s\" contains "
368: "invalid quotes", command);
369: goto out;
370: }
371: if (ac == 0) {
372: error("AuthorizedPrincipalsCommand \"%s\" yielded no arguments",
373: command);
374: goto out;
375: }
1.56 djm 376: if ((ca_fp = sshkey_fingerprint(cert->signature_key,
377: options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
378: error("%s: sshkey_fingerprint failed", __func__);
379: goto out;
380: }
1.57 djm 381: if ((key_fp = sshkey_fingerprint(key,
1.56 djm 382: options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
383: error("%s: sshkey_fingerprint failed", __func__);
384: goto out;
385: }
386: if ((r = sshkey_to_base64(cert->signature_key, &catext)) != 0) {
387: error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
388: goto out;
389: }
390: if ((r = sshkey_to_base64(key, &keytext)) != 0) {
391: error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
392: goto out;
393: }
1.59 djm 394: snprintf(serial_s, sizeof(serial_s), "%llu",
395: (unsigned long long)cert->serial);
1.51 djm 396: for (i = 1; i < ac; i++) {
397: tmp = percent_expand(av[i],
398: "u", user_pw->pw_name,
399: "h", user_pw->pw_dir,
1.56 djm 400: "t", sshkey_ssh_name(key),
401: "T", sshkey_ssh_name(cert->signature_key),
402: "f", key_fp,
403: "F", ca_fp,
404: "k", keytext,
405: "K", catext,
1.58 djm 406: "i", cert->key_id,
407: "s", serial_s,
1.51 djm 408: (char *)NULL);
409: if (tmp == NULL)
410: fatal("%s: percent_expand failed", __func__);
411: free(av[i]);
412: av[i] = tmp;
413: }
414: /* Prepare a printable command for logs, etc. */
1.69 djm 415: command = argv_assemble(ac, av);
1.51 djm 416:
417: if ((pid = subprocess("AuthorizedPrincipalsCommand", pw, command,
1.69 djm 418: ac, av, &f,
419: SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD)) == 0)
1.51 djm 420: goto out;
421:
422: uid_swapped = 1;
423: temporarily_use_uid(pw);
424:
1.67 markus 425: ok = process_principals(f, "(command)", pw, cert);
1.51 djm 426:
1.61 djm 427: fclose(f);
428: f = NULL;
429:
1.70 djm 430: if (exited_cleanly(pid, "AuthorizedPrincipalsCommand", command, 0) != 0)
1.51 djm 431: goto out;
432:
433: /* Read completed successfully */
434: found_principal = ok;
435: out:
436: if (f != NULL)
437: fclose(f);
438: signal(SIGCHLD, osigchld);
439: for (i = 0; i < ac; i++)
440: free(av[i]);
441: free(av);
442: if (uid_swapped)
443: restore_uid();
444: free(command);
445: free(username);
1.56 djm 446: free(ca_fp);
447: free(key_fp);
448: free(catext);
449: free(keytext);
1.51 djm 450: return found_principal;
451: }
452: /*
1.31 djm 453: * Checks whether key is allowed in authorized_keys-format file,
454: * returns 1 if the key is allowed or 0 otherwise.
455: */
1.1 markus 456: static int
1.64 markus 457: check_authkeys_file(FILE *f, char *file, struct sshkey *key, struct passwd *pw)
1.1 markus 458: {
1.8 dtucker 459: char line[SSH_MAX_PUBKEY_BYTES];
1.18 dtucker 460: int found_key = 0;
1.1 markus 461: u_long linenum = 0;
1.64 markus 462: struct sshkey *found = NULL;
1.1 markus 463:
1.8 dtucker 464: while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
1.60 djm 465: char *cp, *key_options = NULL, *fp = NULL;
466: const char *reason = NULL;
467:
1.71 djm 468: /* Always consume entire file */
1.62 djm 469: if (found_key)
470: continue;
1.37 djm 471: if (found != NULL)
1.64 markus 472: sshkey_free(found);
473: found = sshkey_new(sshkey_is_cert(key) ? KEY_UNSPEC : key->type);
474: if (found == NULL)
475: goto done;
1.20 djm 476: auth_clear_options();
477:
1.1 markus 478: /* Skip leading whitespace, empty and comment lines. */
479: for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
480: ;
481: if (!*cp || *cp == '\n' || *cp == '#')
482: continue;
483:
1.64 markus 484: if (sshkey_read(found, &cp) != 0) {
1.1 markus 485: /* no key? check if there are options for this key */
486: int quoted = 0;
487: debug2("user_key_allowed: check options: '%s'", cp);
1.7 avsm 488: key_options = cp;
1.1 markus 489: for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
490: if (*cp == '\\' && cp[1] == '"')
491: cp++; /* Skip both */
492: else if (*cp == '"')
493: quoted = !quoted;
494: }
495: /* Skip remaining whitespace. */
496: for (; *cp == ' ' || *cp == '\t'; cp++)
497: ;
1.64 markus 498: if (sshkey_read(found, &cp) != 0) {
1.1 markus 499: debug2("user_key_allowed: advance: '%s'", cp);
500: /* still no key? advance to next line*/
501: continue;
502: }
503: }
1.64 markus 504: if (sshkey_is_cert(key)) {
505: if (!sshkey_equal(found, key->cert->signature_key))
1.25 djm 506: continue;
507: if (auth_parse_options(pw, key_options, file,
508: linenum) != 1)
509: continue;
1.20 djm 510: if (!key_is_cert_authority)
511: continue;
1.46 djm 512: if ((fp = sshkey_fingerprint(found,
513: options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
514: continue;
1.22 djm 515: debug("matching CA found: file %s, line %lu, %s %s",
1.64 markus 516: file, linenum, sshkey_type(found), fp);
1.24 djm 517: /*
518: * If the user has specified a list of principals as
519: * a key option, then prefer that list to matching
520: * their username in the certificate principals list.
521: */
522: if (authorized_principals != NULL &&
523: !match_principals_option(authorized_principals,
524: key->cert)) {
525: reason = "Certificate does not contain an "
526: "authorized principal";
527: fail_reason:
1.36 djm 528: free(fp);
1.20 djm 529: error("%s", reason);
530: auth_debug_add("%s", reason);
531: continue;
532: }
1.64 markus 533: if (sshkey_cert_check_authority(key, 0, 0,
1.24 djm 534: authorized_principals == NULL ? pw->pw_name : NULL,
535: &reason) != 0)
536: goto fail_reason;
1.60 djm 537: if (auth_cert_options(key, pw, &reason) != 0)
538: goto fail_reason;
1.54 djm 539: verbose("Accepted certificate ID \"%s\" (serial %llu) "
1.22 djm 540: "signed by %s CA %s via %s", key->cert->key_id,
1.54 djm 541: (unsigned long long)key->cert->serial,
1.64 markus 542: sshkey_type(found), fp, file);
1.36 djm 543: free(fp);
1.20 djm 544: found_key = 1;
545: break;
1.64 markus 546: } else if (sshkey_equal(found, key)) {
1.25 djm 547: if (auth_parse_options(pw, key_options, file,
548: linenum) != 1)
549: continue;
550: if (key_is_cert_authority)
551: continue;
1.46 djm 552: if ((fp = sshkey_fingerprint(found,
553: options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
554: continue;
1.37 djm 555: debug("matching key found: file %s, line %lu %s %s",
1.64 markus 556: file, linenum, sshkey_type(found), fp);
1.36 djm 557: free(fp);
1.46 djm 558: found_key = 1;
1.62 djm 559: continue;
1.1 markus 560: }
561: }
1.64 markus 562: done:
1.37 djm 563: if (found != NULL)
1.64 markus 564: sshkey_free(found);
1.1 markus 565: if (!found_key)
566: debug2("key not found");
567: return found_key;
568: }
569:
1.21 djm 570: /* Authenticate a certificate key against TrustedUserCAKeys */
571: static int
1.63 markus 572: user_cert_trusted_ca(struct passwd *pw, struct sshkey *key)
1.21 djm 573: {
1.24 djm 574: char *ca_fp, *principals_file = NULL;
1.21 djm 575: const char *reason;
1.64 markus 576: int r, ret = 0, found_principal = 0, use_authorized_principals;
1.21 djm 577:
1.64 markus 578: if (!sshkey_is_cert(key) || options.trusted_user_ca_keys == NULL)
1.21 djm 579: return 0;
580:
1.46 djm 581: if ((ca_fp = sshkey_fingerprint(key->cert->signature_key,
582: options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
583: return 0;
1.21 djm 584:
1.64 markus 585: if ((r = sshkey_in_file(key->cert->signature_key,
586: options.trusted_user_ca_keys, 1, 0)) != 0) {
587: debug2("%s: CA %s %s is not listed in %s: %s", __func__,
588: sshkey_type(key->cert->signature_key), ca_fp,
589: options.trusted_user_ca_keys, ssh_err(r));
1.21 djm 590: goto out;
591: }
1.24 djm 592: /*
593: * If AuthorizedPrincipals is in use, then compare the certificate
594: * principals against the names in that file rather than matching
595: * against the username.
596: */
597: if ((principals_file = authorized_principals_file(pw)) != NULL) {
1.51 djm 598: if (match_principals_file(principals_file, pw, key->cert))
599: found_principal = 1;
600: }
601: /* Try querying command if specified */
1.56 djm 602: if (!found_principal && match_principals_command(pw, key))
1.51 djm 603: found_principal = 1;
1.53 jsing 604: /* If principals file or command is specified, then require a match */
605: use_authorized_principals = principals_file != NULL ||
606: options.authorized_principals_command != NULL;
607: if (!found_principal && use_authorized_principals) {
1.51 djm 608: reason = "Certificate does not contain an authorized principal";
1.24 djm 609: fail_reason:
1.51 djm 610: error("%s", reason);
611: auth_debug_add("%s", reason);
612: goto out;
1.21 djm 613: }
1.64 markus 614: if (sshkey_cert_check_authority(key, 0, 1,
1.53 jsing 615: use_authorized_principals ? NULL : pw->pw_name, &reason) != 0)
1.24 djm 616: goto fail_reason;
1.60 djm 617: if (auth_cert_options(key, pw, &reason) != 0)
618: goto fail_reason;
1.21 djm 619:
1.54 djm 620: verbose("Accepted certificate ID \"%s\" (serial %llu) signed by "
621: "%s CA %s via %s", key->cert->key_id,
622: (unsigned long long)key->cert->serial,
1.64 markus 623: sshkey_type(key->cert->signature_key), ca_fp,
1.22 djm 624: options.trusted_user_ca_keys);
1.21 djm 625: ret = 1;
626:
627: out:
1.36 djm 628: free(principals_file);
629: free(ca_fp);
1.21 djm 630: return ret;
631: }
632:
1.31 djm 633: /*
634: * Checks whether key is allowed in file.
635: * returns 1 if the key is allowed or 0 otherwise.
636: */
637: static int
1.63 markus 638: user_key_allowed2(struct passwd *pw, struct sshkey *key, char *file)
1.31 djm 639: {
640: FILE *f;
641: int found_key = 0;
642:
643: /* Temporarily use the user's uid. */
644: temporarily_use_uid(pw);
645:
646: debug("trying public key file %s", file);
647: if ((f = auth_openkeyfile(file, pw, options.strict_modes)) != NULL) {
648: found_key = check_authkeys_file(f, file, key, pw);
649: fclose(f);
650: }
651:
652: restore_uid();
653: return found_key;
654: }
655:
656: /*
657: * Checks whether key is allowed in output of command.
658: * returns 1 if the key is allowed or 0 otherwise.
659: */
660: static int
1.63 markus 661: user_key_command_allowed2(struct passwd *user_pw, struct sshkey *key)
1.31 djm 662: {
1.50 djm 663: FILE *f = NULL;
664: int r, ok, found_key = 0;
1.31 djm 665: struct passwd *pw;
1.50 djm 666: int i, uid_swapped = 0, ac = 0;
1.31 djm 667: pid_t pid;
1.50 djm 668: char *username = NULL, *key_fp = NULL, *keytext = NULL;
669: char *tmp, *command = NULL, **av = NULL;
670: void (*osigchld)(int);
1.31 djm 671:
1.50 djm 672: if (options.authorized_keys_command == NULL)
1.31 djm 673: return 0;
1.32 djm 674: if (options.authorized_keys_command_user == NULL) {
675: error("No user for AuthorizedKeysCommand specified, skipping");
676: return 0;
677: }
678:
1.50 djm 679: /*
680: * NB. all returns later this function should go via "out" to
681: * ensure the original SIGCHLD handler is restored properly.
682: */
683: osigchld = signal(SIGCHLD, SIG_DFL);
684:
685: /* Prepare and verify the user for the command */
1.32 djm 686: username = percent_expand(options.authorized_keys_command_user,
687: "u", user_pw->pw_name, (char *)NULL);
688: pw = getpwnam(username);
689: if (pw == NULL) {
1.34 djm 690: error("AuthorizedKeysCommandUser \"%s\" not found: %s",
691: username, strerror(errno));
1.50 djm 692: goto out;
1.31 djm 693: }
694:
1.50 djm 695: /* Prepare AuthorizedKeysCommand */
696: if ((key_fp = sshkey_fingerprint(key, options.fingerprint_hash,
697: SSH_FP_DEFAULT)) == NULL) {
698: error("%s: sshkey_fingerprint failed", __func__);
1.31 djm 699: goto out;
700: }
1.50 djm 701: if ((r = sshkey_to_base64(key, &keytext)) != 0) {
702: error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
1.31 djm 703: goto out;
704: }
705:
1.50 djm 706: /* Turn the command into an argument vector */
1.69 djm 707: if (argv_split(options.authorized_keys_command, &ac, &av) != 0) {
1.50 djm 708: error("AuthorizedKeysCommand \"%s\" contains invalid quotes",
709: command);
710: goto out;
711: }
712: if (ac == 0) {
713: error("AuthorizedKeysCommand \"%s\" yielded no arguments",
714: command);
1.31 djm 715: goto out;
716: }
1.50 djm 717: for (i = 1; i < ac; i++) {
718: tmp = percent_expand(av[i],
719: "u", user_pw->pw_name,
720: "h", user_pw->pw_dir,
721: "t", sshkey_ssh_name(key),
722: "f", key_fp,
723: "k", keytext,
724: (char *)NULL);
725: if (tmp == NULL)
726: fatal("%s: percent_expand failed", __func__);
727: free(av[i]);
728: av[i] = tmp;
729: }
730: /* Prepare a printable command for logs, etc. */
1.69 djm 731: command = argv_assemble(ac, av);
1.31 djm 732:
733: /*
1.50 djm 734: * If AuthorizedKeysCommand was run without arguments
735: * then fall back to the old behaviour of passing the
736: * target username as a single argument.
1.31 djm 737: */
1.50 djm 738: if (ac == 1) {
739: av = xreallocarray(av, ac + 2, sizeof(*av));
740: av[1] = xstrdup(user_pw->pw_name);
741: av[2] = NULL;
742: /* Fix up command too, since it is used in log messages */
743: free(command);
744: xasprintf(&command, "%s %s", av[0], av[1]);
745: }
1.31 djm 746:
1.50 djm 747: if ((pid = subprocess("AuthorizedKeysCommand", pw, command,
1.69 djm 748: ac, av, &f,
749: SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD)) == 0)
1.50 djm 750: goto out;
1.31 djm 751:
1.50 djm 752: uid_swapped = 1;
1.31 djm 753: temporarily_use_uid(pw);
754:
755: ok = check_authkeys_file(f, options.authorized_keys_command, key, pw);
1.61 djm 756:
757: fclose(f);
758: f = NULL;
1.31 djm 759:
1.70 djm 760: if (exited_cleanly(pid, "AuthorizedKeysCommand", command, 0) != 0)
1.31 djm 761: goto out;
1.50 djm 762:
763: /* Read completed successfully */
1.31 djm 764: found_key = ok;
765: out:
1.50 djm 766: if (f != NULL)
767: fclose(f);
768: signal(SIGCHLD, osigchld);
769: for (i = 0; i < ac; i++)
770: free(av[i]);
771: free(av);
772: if (uid_swapped)
773: restore_uid();
774: free(command);
775: free(username);
776: free(key_fp);
777: free(keytext);
1.31 djm 778: return found_key;
779: }
780:
781: /*
782: * Check whether key authenticates and authorises the user.
783: */
1.1 markus 784: int
1.63 markus 785: user_key_allowed(struct passwd *pw, struct sshkey *key, int auth_attempt)
1.1 markus 786: {
1.29 djm 787: u_int success, i;
1.1 markus 788: char *file;
1.21 djm 789:
790: if (auth_key_is_revoked(key))
791: return 0;
1.64 markus 792: if (sshkey_is_cert(key) &&
793: auth_key_is_revoked(key->cert->signature_key))
1.21 djm 794: return 0;
795:
796: success = user_cert_trusted_ca(pw, key);
797: if (success)
798: return success;
1.1 markus 799:
1.31 djm 800: success = user_key_command_allowed2(pw, key);
801: if (success > 0)
802: return success;
803:
1.29 djm 804: for (i = 0; !success && i < options.num_authkeys_files; i++) {
1.31 djm 805:
806: if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
807: continue;
1.29 djm 808: file = expand_authorized_keys(
809: options.authorized_keys_files[i], pw);
1.31 djm 810:
1.29 djm 811: success = user_key_allowed2(pw, key, file);
1.36 djm 812: free(file);
1.29 djm 813: }
1.1 markus 814:
815: return success;
816: }
1.2 markus 817:
818: Authmethod method_pubkey = {
819: "publickey",
820: userauth_pubkey,
821: &options.pubkey_authentication
822: };
![[BACK]](/icons/back.gif){kind=icon}
Return to auth2-pubkey.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh