Annotation of src/usr.bin/ssh/monitor_wrap.c, Revision 1.24
1.1 provos 1: /*
2: * Copyright 2002 Niels Provos <provos@citi.umich.edu>
3: * Copyright 2002 Markus Friedl <markus@openbsd.org>
4: * All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
27: #include "includes.h"
1.24 ! markus 28: RCSID("$OpenBSD: monitor_wrap.c,v 1.23 2003/04/01 10:10:23 markus Exp $");
1.1 provos 29:
30: #include <openssl/bn.h>
31: #include <openssl/dh.h>
32:
33: #include "ssh.h"
34: #include "dh.h"
35: #include "kex.h"
36: #include "auth.h"
1.22 markus 37: #include "auth-options.h"
1.1 provos 38: #include "buffer.h"
39: #include "bufaux.h"
40: #include "packet.h"
41: #include "mac.h"
42: #include "log.h"
43: #include "zlib.h"
44: #include "monitor.h"
45: #include "monitor_wrap.h"
46: #include "xmalloc.h"
47: #include "atomicio.h"
48: #include "monitor_fdpass.h"
49: #include "getput.h"
50:
51: #include "auth.h"
52: #include "channels.h"
53: #include "session.h"
54:
55: /* Imports */
56: extern int compat20;
57: extern Newkeys *newkeys[];
58: extern z_stream incoming_stream;
59: extern z_stream outgoing_stream;
1.7 mouring 60: extern struct monitor *pmonitor;
1.1 provos 61: extern Buffer input, output;
62:
63: void
64: mm_request_send(int socket, enum monitor_reqtype type, Buffer *m)
65: {
1.13 deraadt 66: u_int mlen = buffer_len(m);
1.1 provos 67: u_char buf[5];
68:
1.8 markus 69: debug3("%s entering: type %d", __func__, type);
1.1 provos 70:
71: PUT_32BIT(buf, mlen + 1);
1.10 deraadt 72: buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */
1.1 provos 73: if (atomicio(write, socket, buf, sizeof(buf)) != sizeof(buf))
1.8 markus 74: fatal("%s: write", __func__);
1.1 provos 75: if (atomicio(write, socket, buffer_ptr(m), mlen) != mlen)
1.8 markus 76: fatal("%s: write", __func__);
1.1 provos 77: }
78:
79: void
80: mm_request_receive(int socket, Buffer *m)
81: {
82: u_char buf[4];
1.13 deraadt 83: u_int msg_len;
1.1 provos 84: ssize_t res;
85:
1.8 markus 86: debug3("%s entering", __func__);
1.1 provos 87:
88: res = atomicio(read, socket, buf, sizeof(buf));
89: if (res != sizeof(buf)) {
90: if (res == 0)
91: fatal_cleanup();
1.8 markus 92: fatal("%s: read: %ld", __func__, (long)res);
1.1 provos 93: }
94: msg_len = GET_32BIT(buf);
95: if (msg_len > 256 * 1024)
1.8 markus 96: fatal("%s: read: bad msg_len %d", __func__, msg_len);
1.1 provos 97: buffer_clear(m);
98: buffer_append_space(m, msg_len);
99: res = atomicio(read, socket, buffer_ptr(m), msg_len);
100: if (res != msg_len)
1.8 markus 101: fatal("%s: read: %ld != msg_len", __func__, (long)res);
1.1 provos 102: }
103:
104: void
105: mm_request_receive_expect(int socket, enum monitor_reqtype type, Buffer *m)
106: {
107: u_char rtype;
108:
1.8 markus 109: debug3("%s entering: type %d", __func__, type);
1.1 provos 110:
111: mm_request_receive(socket, m);
112: rtype = buffer_get_char(m);
113: if (rtype != type)
1.8 markus 114: fatal("%s: read: rtype %d != type %d", __func__,
1.1 provos 115: rtype, type);
116: }
117:
118: DH *
119: mm_choose_dh(int min, int nbits, int max)
120: {
121: BIGNUM *p, *g;
122: int success = 0;
123: Buffer m;
124:
125: buffer_init(&m);
126: buffer_put_int(&m, min);
127: buffer_put_int(&m, nbits);
128: buffer_put_int(&m, max);
129:
1.7 mouring 130: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_MODULI, &m);
1.1 provos 131:
1.8 markus 132: debug3("%s: waiting for MONITOR_ANS_MODULI", __func__);
1.7 mouring 133: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_MODULI, &m);
1.1 provos 134:
135: success = buffer_get_char(&m);
136: if (success == 0)
1.8 markus 137: fatal("%s: MONITOR_ANS_MODULI failed", __func__);
1.1 provos 138:
139: if ((p = BN_new()) == NULL)
1.8 markus 140: fatal("%s: BN_new failed", __func__);
1.3 markus 141: if ((g = BN_new()) == NULL)
1.8 markus 142: fatal("%s: BN_new failed", __func__);
1.1 provos 143: buffer_get_bignum2(&m, p);
144: buffer_get_bignum2(&m, g);
145:
1.8 markus 146: debug3("%s: remaining %d", __func__, buffer_len(&m));
1.1 provos 147: buffer_free(&m);
148:
149: return (dh_new_group(g, p));
150: }
151:
152: int
153: mm_key_sign(Key *key, u_char **sigp, u_int *lenp, u_char *data, u_int datalen)
154: {
1.7 mouring 155: Kex *kex = *pmonitor->m_pkex;
1.1 provos 156: Buffer m;
157:
1.8 markus 158: debug3("%s entering", __func__);
1.1 provos 159:
160: buffer_init(&m);
161: buffer_put_int(&m, kex->host_key_index(key));
162: buffer_put_string(&m, data, datalen);
163:
1.7 mouring 164: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, &m);
1.1 provos 165:
1.8 markus 166: debug3("%s: waiting for MONITOR_ANS_SIGN", __func__);
1.7 mouring 167: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SIGN, &m);
1.1 provos 168: *sigp = buffer_get_string(&m, lenp);
169: buffer_free(&m);
170:
171: return (0);
172: }
173:
174: struct passwd *
175: mm_getpwnamallow(const char *login)
176: {
177: Buffer m;
178: struct passwd *pw;
179: u_int pwlen;
180:
1.8 markus 181: debug3("%s entering", __func__);
1.1 provos 182:
183: buffer_init(&m);
184: buffer_put_cstring(&m, login);
185:
1.7 mouring 186: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, &m);
1.1 provos 187:
1.8 markus 188: debug3("%s: waiting for MONITOR_ANS_PWNAM", __func__);
1.7 mouring 189: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, &m);
1.1 provos 190:
191: if (buffer_get_char(&m) == 0) {
192: buffer_free(&m);
193: return (NULL);
194: }
195: pw = buffer_get_string(&m, &pwlen);
196: if (pwlen != sizeof(struct passwd))
1.8 markus 197: fatal("%s: struct passwd size mismatch", __func__);
1.1 provos 198: pw->pw_name = buffer_get_string(&m, NULL);
199: pw->pw_passwd = buffer_get_string(&m, NULL);
200: pw->pw_gecos = buffer_get_string(&m, NULL);
201: pw->pw_class = buffer_get_string(&m, NULL);
202: pw->pw_dir = buffer_get_string(&m, NULL);
203: pw->pw_shell = buffer_get_string(&m, NULL);
204: buffer_free(&m);
205:
206: return (pw);
1.6 djm 207: }
208:
1.14 deraadt 209: char *mm_auth2_read_banner(void)
1.6 djm 210: {
211: Buffer m;
212: char *banner;
213:
1.8 markus 214: debug3("%s entering", __func__);
1.6 djm 215:
216: buffer_init(&m);
1.7 mouring 217: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, &m);
1.6 djm 218: buffer_clear(&m);
219:
1.7 mouring 220: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTH2_READ_BANNER, &m);
1.6 djm 221: banner = buffer_get_string(&m, NULL);
222: buffer_free(&m);
1.10 deraadt 223:
1.6 djm 224: return (banner);
1.1 provos 225: }
226:
227: /* Inform the privileged process about service and style */
228:
229: void
230: mm_inform_authserv(char *service, char *style)
231: {
232: Buffer m;
233:
1.8 markus 234: debug3("%s entering", __func__);
1.1 provos 235:
236: buffer_init(&m);
237: buffer_put_cstring(&m, service);
238: buffer_put_cstring(&m, style ? style : "");
239:
1.7 mouring 240: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m);
1.1 provos 241:
242: buffer_free(&m);
243: }
244:
245: /* Do the password authentication */
246: int
247: mm_auth_password(Authctxt *authctxt, char *password)
248: {
249: Buffer m;
250: int authenticated = 0;
251:
1.8 markus 252: debug3("%s entering", __func__);
1.1 provos 253:
254: buffer_init(&m);
255: buffer_put_cstring(&m, password);
1.7 mouring 256: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHPASSWORD, &m);
1.1 provos 257:
1.8 markus 258: debug3("%s: waiting for MONITOR_ANS_AUTHPASSWORD", __func__);
1.7 mouring 259: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTHPASSWORD, &m);
1.1 provos 260:
261: authenticated = buffer_get_int(&m);
262:
263: buffer_free(&m);
264:
1.3 markus 265: debug3("%s: user %sauthenticated",
1.8 markus 266: __func__, authenticated ? "" : "not ");
1.1 provos 267: return (authenticated);
268: }
269:
270: int
271: mm_user_key_allowed(struct passwd *pw, Key *key)
272: {
273: return (mm_key_allowed(MM_USERKEY, NULL, NULL, key));
274: }
275:
276: int
277: mm_hostbased_key_allowed(struct passwd *pw, char *user, char *host,
278: Key *key)
279: {
280: return (mm_key_allowed(MM_HOSTKEY, user, host, key));
281: }
282:
283: int
284: mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user,
285: char *host, Key *key)
286: {
287: int ret;
288:
289: key->type = KEY_RSA; /* XXX hack for key_to_blob */
290: ret = mm_key_allowed(MM_RSAHOSTKEY, user, host, key);
291: key->type = KEY_RSA1;
292: return (ret);
293: }
294:
1.2 markus 295: static void
1.1 provos 296: mm_send_debug(Buffer *m)
297: {
298: char *msg;
299:
300: while (buffer_len(m)) {
301: msg = buffer_get_string(m, NULL);
1.8 markus 302: debug3("%s: Sending debug: %s", __func__, msg);
1.1 provos 303: packet_send_debug("%s", msg);
304: xfree(msg);
305: }
306: }
307:
308: int
309: mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key)
310: {
311: Buffer m;
312: u_char *blob;
313: u_int len;
1.22 markus 314: int allowed = 0, have_forced = 0;
1.1 provos 315:
1.8 markus 316: debug3("%s entering", __func__);
1.1 provos 317:
318: /* Convert the key to a blob and the pass it over */
319: if (!key_to_blob(key, &blob, &len))
320: return (0);
321:
322: buffer_init(&m);
323: buffer_put_int(&m, type);
324: buffer_put_cstring(&m, user ? user : "");
325: buffer_put_cstring(&m, host ? host : "");
326: buffer_put_string(&m, blob, len);
327: xfree(blob);
328:
1.7 mouring 329: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, &m);
1.1 provos 330:
1.8 markus 331: debug3("%s: waiting for MONITOR_ANS_KEYALLOWED", __func__);
1.7 mouring 332: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYALLOWED, &m);
1.1 provos 333:
334: allowed = buffer_get_int(&m);
335:
1.22 markus 336: /* fake forced command */
337: auth_clear_options();
338: have_forced = buffer_get_int(&m);
339: forced_command = have_forced ? xstrdup("true") : NULL;
340:
1.1 provos 341: /* Send potential debug messages */
342: mm_send_debug(&m);
343:
344: buffer_free(&m);
345:
346: return (allowed);
347: }
348:
1.3 markus 349: /*
1.1 provos 350: * This key verify needs to send the key type along, because the
351: * privileged parent makes the decision if the key is allowed
352: * for authentication.
353: */
354:
355: int
356: mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
357: {
358: Buffer m;
359: u_char *blob;
360: u_int len;
361: int verified = 0;
362:
1.8 markus 363: debug3("%s entering", __func__);
1.1 provos 364:
365: /* Convert the key to a blob and the pass it over */
366: if (!key_to_blob(key, &blob, &len))
367: return (0);
368:
369: buffer_init(&m);
370: buffer_put_string(&m, blob, len);
371: buffer_put_string(&m, sig, siglen);
372: buffer_put_string(&m, data, datalen);
373: xfree(blob);
374:
1.7 mouring 375: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, &m);
1.1 provos 376:
1.8 markus 377: debug3("%s: waiting for MONITOR_ANS_KEYVERIFY", __func__);
1.7 mouring 378: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYVERIFY, &m);
1.1 provos 379:
380: verified = buffer_get_int(&m);
381:
382: buffer_free(&m);
383:
384: return (verified);
385: }
386:
387: /* Export key state after authentication */
388: Newkeys *
389: mm_newkeys_from_blob(u_char *blob, int blen)
390: {
391: Buffer b;
392: u_int len;
393: Newkeys *newkey = NULL;
394: Enc *enc;
395: Mac *mac;
396: Comp *comp;
397:
1.8 markus 398: debug3("%s: %p(%d)", __func__, blob, blen);
1.1 provos 399: #ifdef DEBUG_PK
400: dump_base64(stderr, blob, blen);
401: #endif
402: buffer_init(&b);
403: buffer_append(&b, blob, blen);
404:
405: newkey = xmalloc(sizeof(*newkey));
406: enc = &newkey->enc;
407: mac = &newkey->mac;
408: comp = &newkey->comp;
409:
410: /* Enc structure */
411: enc->name = buffer_get_string(&b, NULL);
412: buffer_get(&b, &enc->cipher, sizeof(enc->cipher));
413: enc->enabled = buffer_get_int(&b);
414: enc->block_size = buffer_get_int(&b);
415: enc->key = buffer_get_string(&b, &enc->key_len);
416: enc->iv = buffer_get_string(&b, &len);
417: if (len != enc->block_size)
1.12 deraadt 418: fatal("%s: bad ivlen: expected %u != %u", __func__,
1.1 provos 419: enc->block_size, len);
420:
421: if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher)
1.8 markus 422: fatal("%s: bad cipher name %s or pointer %p", __func__,
1.1 provos 423: enc->name, enc->cipher);
424:
425: /* Mac structure */
426: mac->name = buffer_get_string(&b, NULL);
427: if (mac->name == NULL || mac_init(mac, mac->name) == -1)
1.8 markus 428: fatal("%s: can not init mac %s", __func__, mac->name);
1.1 provos 429: mac->enabled = buffer_get_int(&b);
430: mac->key = buffer_get_string(&b, &len);
431: if (len > mac->key_len)
1.12 deraadt 432: fatal("%s: bad mac key length: %u > %d", __func__, len,
1.1 provos 433: mac->key_len);
434: mac->key_len = len;
435:
436: /* Comp structure */
437: comp->type = buffer_get_int(&b);
438: comp->enabled = buffer_get_int(&b);
439: comp->name = buffer_get_string(&b, NULL);
440:
441: len = buffer_len(&b);
442: if (len != 0)
1.12 deraadt 443: error("newkeys_from_blob: remaining bytes in blob %u", len);
1.1 provos 444: buffer_free(&b);
445: return (newkey);
446: }
447:
448: int
449: mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
450: {
451: Buffer b;
452: int len;
453: Enc *enc;
454: Mac *mac;
455: Comp *comp;
456: Newkeys *newkey = newkeys[mode];
457:
1.8 markus 458: debug3("%s: converting %p", __func__, newkey);
1.1 provos 459:
460: if (newkey == NULL) {
1.8 markus 461: error("%s: newkey == NULL", __func__);
1.1 provos 462: return 0;
463: }
464: enc = &newkey->enc;
465: mac = &newkey->mac;
466: comp = &newkey->comp;
467:
468: buffer_init(&b);
469: /* Enc structure */
470: buffer_put_cstring(&b, enc->name);
471: /* The cipher struct is constant and shared, you export pointer */
472: buffer_append(&b, &enc->cipher, sizeof(enc->cipher));
473: buffer_put_int(&b, enc->enabled);
474: buffer_put_int(&b, enc->block_size);
475: buffer_put_string(&b, enc->key, enc->key_len);
476: packet_get_keyiv(mode, enc->iv, enc->block_size);
477: buffer_put_string(&b, enc->iv, enc->block_size);
478:
479: /* Mac structure */
480: buffer_put_cstring(&b, mac->name);
481: buffer_put_int(&b, mac->enabled);
482: buffer_put_string(&b, mac->key, mac->key_len);
483:
484: /* Comp structure */
485: buffer_put_int(&b, comp->type);
486: buffer_put_int(&b, comp->enabled);
487: buffer_put_cstring(&b, comp->name);
488:
489: len = buffer_len(&b);
1.16 markus 490: if (lenp != NULL)
491: *lenp = len;
492: if (blobp != NULL) {
493: *blobp = xmalloc(len);
494: memcpy(*blobp, buffer_ptr(&b), len);
495: }
1.1 provos 496: memset(buffer_ptr(&b), 0, len);
497: buffer_free(&b);
498: return len;
499: }
500:
1.2 markus 501: static void
1.1 provos 502: mm_send_kex(Buffer *m, Kex *kex)
503: {
504: buffer_put_string(m, kex->session_id, kex->session_id_len);
505: buffer_put_int(m, kex->we_need);
506: buffer_put_int(m, kex->hostkey_type);
507: buffer_put_int(m, kex->kex_type);
508: buffer_put_string(m, buffer_ptr(&kex->my), buffer_len(&kex->my));
509: buffer_put_string(m, buffer_ptr(&kex->peer), buffer_len(&kex->peer));
510: buffer_put_int(m, kex->flags);
511: buffer_put_cstring(m, kex->client_version_string);
512: buffer_put_cstring(m, kex->server_version_string);
513: }
514:
515: void
1.7 mouring 516: mm_send_keystate(struct monitor *pmonitor)
1.1 provos 517: {
518: Buffer m;
519: u_char *blob, *p;
520: u_int bloblen, plen;
521:
522: buffer_init(&m);
523:
524: if (!compat20) {
525: u_char iv[24];
1.11 markus 526: u_char *key;
527: u_int ivlen, keylen;
1.1 provos 528:
529: buffer_put_int(&m, packet_get_protocol_flags());
530:
531: buffer_put_int(&m, packet_get_ssh1_cipher());
532:
1.11 markus 533: debug3("%s: Sending ssh1 KEY+IV", __func__);
534: keylen = packet_get_encryption_key(NULL);
535: key = xmalloc(keylen+1); /* add 1 if keylen == 0 */
536: keylen = packet_get_encryption_key(key);
537: buffer_put_string(&m, key, keylen);
538: memset(key, 0, keylen);
539: xfree(key);
540:
1.1 provos 541: ivlen = packet_get_keyiv_len(MODE_OUT);
542: packet_get_keyiv(MODE_OUT, iv, ivlen);
543: buffer_put_string(&m, iv, ivlen);
544: ivlen = packet_get_keyiv_len(MODE_OUT);
545: packet_get_keyiv(MODE_IN, iv, ivlen);
546: buffer_put_string(&m, iv, ivlen);
547: goto skip;
548: } else {
549: /* Kex for rekeying */
1.7 mouring 550: mm_send_kex(&m, *pmonitor->m_pkex);
1.1 provos 551: }
552:
553: debug3("%s: Sending new keys: %p %p",
1.8 markus 554: __func__, newkeys[MODE_OUT], newkeys[MODE_IN]);
1.1 provos 555:
556: /* Keys from Kex */
557: if (!mm_newkeys_to_blob(MODE_OUT, &blob, &bloblen))
1.8 markus 558: fatal("%s: conversion of newkeys failed", __func__);
1.1 provos 559:
560: buffer_put_string(&m, blob, bloblen);
561: xfree(blob);
562:
563: if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
1.8 markus 564: fatal("%s: conversion of newkeys failed", __func__);
1.1 provos 565:
566: buffer_put_string(&m, blob, bloblen);
567: xfree(blob);
568:
1.24 ! markus 569: buffer_put_int(&m, packet_get_seqnr(MODE_OUT));
! 570: buffer_put_int(&m, packet_get_seqnr(MODE_IN));
1.1 provos 571:
1.8 markus 572: debug3("%s: New keys have been sent", __func__);
1.1 provos 573: skip:
574: /* More key context */
575: plen = packet_get_keycontext(MODE_OUT, NULL);
576: p = xmalloc(plen+1);
577: packet_get_keycontext(MODE_OUT, p);
578: buffer_put_string(&m, p, plen);
579: xfree(p);
580:
581: plen = packet_get_keycontext(MODE_IN, NULL);
582: p = xmalloc(plen+1);
583: packet_get_keycontext(MODE_IN, p);
584: buffer_put_string(&m, p, plen);
585: xfree(p);
586:
587: /* Compression state */
1.8 markus 588: debug3("%s: Sending compression state", __func__);
1.1 provos 589: buffer_put_string(&m, &outgoing_stream, sizeof(outgoing_stream));
590: buffer_put_string(&m, &incoming_stream, sizeof(incoming_stream));
591:
592: /* Network I/O buffers */
593: buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input));
594: buffer_put_string(&m, buffer_ptr(&output), buffer_len(&output));
595:
1.7 mouring 596: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
1.8 markus 597: debug3("%s: Finished sending state", __func__);
1.1 provos 598:
599: buffer_free(&m);
600: }
601:
602: int
603: mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
604: {
605: Buffer m;
1.18 markus 606: char *p;
1.1 provos 607: int success = 0;
608:
609: buffer_init(&m);
1.7 mouring 610: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m);
1.1 provos 611:
1.8 markus 612: debug3("%s: waiting for MONITOR_ANS_PTY", __func__);
1.7 mouring 613: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PTY, &m);
1.1 provos 614:
615: success = buffer_get_int(&m);
616: if (success == 0) {
1.8 markus 617: debug3("%s: pty alloc failed", __func__);
1.1 provos 618: buffer_free(&m);
619: return (0);
620: }
621: p = buffer_get_string(&m, NULL);
622: buffer_free(&m);
623:
624: strlcpy(namebuf, p, namebuflen); /* Possible truncation */
625: xfree(p);
626:
1.7 mouring 627: *ptyfd = mm_receive_fd(pmonitor->m_recvfd);
628: *ttyfd = mm_receive_fd(pmonitor->m_recvfd);
1.1 provos 629:
630: /* Success */
631: return (1);
632: }
633:
634: void
635: mm_session_pty_cleanup2(void *session)
636: {
637: Session *s = session;
638: Buffer m;
639:
640: if (s->ttyfd == -1)
641: return;
642: buffer_init(&m);
643: buffer_put_cstring(&m, s->tty);
1.7 mouring 644: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTYCLEANUP, &m);
1.1 provos 645: buffer_free(&m);
1.3 markus 646:
1.1 provos 647: /* closed dup'ed master */
648: if (close(s->ptymaster) < 0)
649: error("close(s->ptymaster): %s", strerror(errno));
650:
651: /* unlink pty from session */
652: s->ttyfd = -1;
653: }
654:
655: /* Request process termination */
656:
657: void
658: mm_terminate(void)
659: {
660: Buffer m;
661:
662: buffer_init(&m);
1.7 mouring 663: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_TERM, &m);
1.1 provos 664: buffer_free(&m);
665: }
666:
667: int
668: mm_ssh1_session_key(BIGNUM *num)
669: {
670: int rsafail;
671: Buffer m;
672:
673: buffer_init(&m);
674: buffer_put_bignum2(&m, num);
1.7 mouring 675: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSKEY, &m);
1.1 provos 676:
1.7 mouring 677: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SESSKEY, &m);
1.1 provos 678:
679: rsafail = buffer_get_int(&m);
680: buffer_get_bignum2(&m, num);
681:
682: buffer_free(&m);
683:
684: return (rsafail);
685: }
686:
1.2 markus 687: static void
1.1 provos 688: mm_chall_setup(char **name, char **infotxt, u_int *numprompts,
689: char ***prompts, u_int **echo_on)
690: {
1.10 deraadt 691: *name = xstrdup("");
692: *infotxt = xstrdup("");
1.1 provos 693: *numprompts = 1;
1.14 deraadt 694: *prompts = xmalloc(*numprompts * sizeof(char *));
1.1 provos 695: *echo_on = xmalloc(*numprompts * sizeof(u_int));
696: (*echo_on)[0] = 0;
697: }
698:
699: int
700: mm_bsdauth_query(void *ctx, char **name, char **infotxt,
701: u_int *numprompts, char ***prompts, u_int **echo_on)
702: {
703: Buffer m;
1.21 markus 704: u_int success;
1.1 provos 705: char *challenge;
706:
1.8 markus 707: debug3("%s: entering", __func__);
1.1 provos 708:
709: buffer_init(&m);
1.7 mouring 710: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHQUERY, &m);
1.1 provos 711:
1.7 mouring 712: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_BSDAUTHQUERY,
1.1 provos 713: &m);
1.21 markus 714: success = buffer_get_int(&m);
715: if (success == 0) {
1.8 markus 716: debug3("%s: no challenge", __func__);
1.1 provos 717: buffer_free(&m);
718: return (-1);
719: }
720:
721: /* Get the challenge, and format the response */
722: challenge = buffer_get_string(&m, NULL);
723: buffer_free(&m);
724:
725: mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
726: (*prompts)[0] = challenge;
727:
1.8 markus 728: debug3("%s: received challenge: %s", __func__, challenge);
1.1 provos 729:
730: return (0);
731: }
732:
733: int
734: mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses)
735: {
736: Buffer m;
737: int authok;
738:
1.8 markus 739: debug3("%s: entering", __func__);
1.1 provos 740: if (numresponses != 1)
741: return (-1);
742:
743: buffer_init(&m);
744: buffer_put_cstring(&m, responses[0]);
1.7 mouring 745: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHRESPOND, &m);
1.1 provos 746:
1.7 mouring 747: mm_request_receive_expect(pmonitor->m_recvfd,
1.1 provos 748: MONITOR_ANS_BSDAUTHRESPOND, &m);
749:
750: authok = buffer_get_int(&m);
751: buffer_free(&m);
752:
753: return ((authok == 0) ? -1 : 0);
754: }
755:
756: int
757: mm_skey_query(void *ctx, char **name, char **infotxt,
758: u_int *numprompts, char ***prompts, u_int **echo_on)
759: {
760: Buffer m;
1.21 markus 761: int len;
762: u_int success;
1.1 provos 763: char *p, *challenge;
764:
1.8 markus 765: debug3("%s: entering", __func__);
1.1 provos 766:
767: buffer_init(&m);
1.7 mouring 768: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYQUERY, &m);
1.1 provos 769:
1.7 mouring 770: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SKEYQUERY,
1.1 provos 771: &m);
1.21 markus 772: success = buffer_get_int(&m);
773: if (success == 0) {
1.8 markus 774: debug3("%s: no challenge", __func__);
1.1 provos 775: buffer_free(&m);
776: return (-1);
777: }
778:
779: /* Get the challenge, and format the response */
780: challenge = buffer_get_string(&m, NULL);
781: buffer_free(&m);
782:
1.8 markus 783: debug3("%s: received challenge: %s", __func__, challenge);
1.1 provos 784:
785: mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
786:
787: len = strlen(challenge) + strlen(SKEY_PROMPT) + 1;
788: p = xmalloc(len);
789: strlcpy(p, challenge, len);
790: strlcat(p, SKEY_PROMPT, len);
791: (*prompts)[0] = p;
792: xfree(challenge);
793:
794: return (0);
795: }
796:
797: int
798: mm_skey_respond(void *ctx, u_int numresponses, char **responses)
799: {
800: Buffer m;
801: int authok;
802:
1.8 markus 803: debug3("%s: entering", __func__);
1.1 provos 804: if (numresponses != 1)
805: return (-1);
806:
807: buffer_init(&m);
808: buffer_put_cstring(&m, responses[0]);
1.7 mouring 809: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYRESPOND, &m);
1.1 provos 810:
1.7 mouring 811: mm_request_receive_expect(pmonitor->m_recvfd,
1.1 provos 812: MONITOR_ANS_SKEYRESPOND, &m);
813:
814: authok = buffer_get_int(&m);
815: buffer_free(&m);
816:
817: return ((authok == 0) ? -1 : 0);
818: }
819:
820: void
821: mm_ssh1_session_id(u_char session_id[16])
822: {
823: Buffer m;
824: int i;
825:
1.8 markus 826: debug3("%s entering", __func__);
1.1 provos 827:
828: buffer_init(&m);
829: for (i = 0; i < 16; i++)
830: buffer_put_char(&m, session_id[i]);
831:
1.7 mouring 832: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSID, &m);
1.1 provos 833: buffer_free(&m);
834: }
835:
836: int
837: mm_auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
838: {
839: Buffer m;
840: Key *key;
841: u_char *blob;
842: u_int blen;
1.22 markus 843: int allowed = 0, have_forced = 0;
1.1 provos 844:
1.8 markus 845: debug3("%s entering", __func__);
1.1 provos 846:
847: buffer_init(&m);
848: buffer_put_bignum2(&m, client_n);
849:
1.7 mouring 850: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSAKEYALLOWED, &m);
851: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSAKEYALLOWED, &m);
1.1 provos 852:
853: allowed = buffer_get_int(&m);
1.22 markus 854:
855: /* fake forced command */
856: auth_clear_options();
857: have_forced = buffer_get_int(&m);
858: forced_command = have_forced ? xstrdup("true") : NULL;
1.1 provos 859:
860: if (allowed && rkey != NULL) {
861: blob = buffer_get_string(&m, &blen);
862: if ((key = key_from_blob(blob, blen)) == NULL)
1.8 markus 863: fatal("%s: key_from_blob failed", __func__);
1.1 provos 864: *rkey = key;
865: xfree(blob);
866: }
867: mm_send_debug(&m);
868: buffer_free(&m);
869:
870: return (allowed);
871: }
872:
873: BIGNUM *
874: mm_auth_rsa_generate_challenge(Key *key)
875: {
876: Buffer m;
877: BIGNUM *challenge;
878: u_char *blob;
879: u_int blen;
880:
1.8 markus 881: debug3("%s entering", __func__);
1.1 provos 882:
883: if ((challenge = BN_new()) == NULL)
1.8 markus 884: fatal("%s: BN_new failed", __func__);
1.1 provos 885:
886: key->type = KEY_RSA; /* XXX cheat for key_to_blob */
887: if (key_to_blob(key, &blob, &blen) == 0)
1.8 markus 888: fatal("%s: key_to_blob failed", __func__);
1.1 provos 889: key->type = KEY_RSA1;
890:
891: buffer_init(&m);
892: buffer_put_string(&m, blob, blen);
893: xfree(blob);
894:
1.7 mouring 895: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSACHALLENGE, &m);
896: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSACHALLENGE, &m);
1.1 provos 897:
898: buffer_get_bignum2(&m, challenge);
899: buffer_free(&m);
900:
901: return (challenge);
902: }
903:
904: int
905: mm_auth_rsa_verify_response(Key *key, BIGNUM *p, u_char response[16])
906: {
907: Buffer m;
908: u_char *blob;
909: u_int blen;
910: int success = 0;
911:
1.8 markus 912: debug3("%s entering", __func__);
1.1 provos 913:
914: key->type = KEY_RSA; /* XXX cheat for key_to_blob */
915: if (key_to_blob(key, &blob, &blen) == 0)
1.8 markus 916: fatal("%s: key_to_blob failed", __func__);
1.1 provos 917: key->type = KEY_RSA1;
918:
919: buffer_init(&m);
920: buffer_put_string(&m, blob, blen);
921: buffer_put_string(&m, response, 16);
922: xfree(blob);
923:
1.7 mouring 924: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSARESPONSE, &m);
925: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSARESPONSE, &m);
1.1 provos 926:
927: success = buffer_get_int(&m);
928: buffer_free(&m);
929:
930: return (success);
931: }
1.19 markus 932:
933: #ifdef KRB4
934: int
935: mm_auth_krb4(Authctxt *authctxt, void *_auth, char **client, void *_reply)
936: {
937: KTEXT auth, reply;
938: Buffer m;
939: u_int rlen;
940: int success = 0;
941: char *p;
942:
943: debug3("%s entering", __func__);
944: auth = _auth;
945: reply = _reply;
946:
947: buffer_init(&m);
948: buffer_put_string(&m, auth->dat, auth->length);
949:
950: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB4, &m);
951: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB4, &m);
952:
953: success = buffer_get_int(&m);
954: if (success) {
955: *client = buffer_get_string(&m, NULL);
956: p = buffer_get_string(&m, &rlen);
957: if (rlen >= MAX_KTXT_LEN)
958: fatal("%s: reply from monitor too large", __func__);
959: reply->length = rlen;
960: memcpy(reply->dat, p, rlen);
961: memset(p, 0, rlen);
962: xfree(p);
963: }
964: buffer_free(&m);
1.20 deraadt 965: return (success);
1.19 markus 966: }
967: #endif
1.17 itojun 968:
969: #ifdef KRB5
970: int
971: mm_auth_krb5(void *ctx, void *argp, char **userp, void *resp)
972: {
973: krb5_data *tkt, *reply;
974: Buffer m;
975: int success;
976:
977: debug3("%s entering", __func__);
978: tkt = (krb5_data *) argp;
979: reply = (krb5_data *) resp;
980:
981: buffer_init(&m);
982: buffer_put_string(&m, tkt->data, tkt->length);
983:
984: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB5, &m);
985: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB5, &m);
986:
987: success = buffer_get_int(&m);
988: if (success) {
989: u_int len;
990:
991: *userp = buffer_get_string(&m, NULL);
992: reply->data = buffer_get_string(&m, &len);
993: reply->length = len;
994: } else {
995: memset(reply, 0, sizeof(*reply));
996: *userp = NULL;
997: }
998:
999: buffer_free(&m);
1000: return (success);
1001: }
1002: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to monitor_wrap.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh