Annotation of src/usr.bin/ssh/monitor_wrap.c, Revision 1.26
1.1 provos 1: /*
2: * Copyright 2002 Niels Provos <provos@citi.umich.edu>
3: * Copyright 2002 Markus Friedl <markus@openbsd.org>
4: * All rights reserved.
5: *
6: * Redistribution and use in source and binary forms, with or without
7: * modification, are permitted provided that the following conditions
8: * are met:
9: * 1. Redistributions of source code must retain the above copyright
10: * notice, this list of conditions and the following disclaimer.
11: * 2. Redistributions in binary form must reproduce the above copyright
12: * notice, this list of conditions and the following disclaimer in the
13: * documentation and/or other materials provided with the distribution.
14: *
15: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25: */
26:
27: #include "includes.h"
1.26 ! markus 28: RCSID("$OpenBSD: monitor_wrap.c,v 1.25 2003/04/02 09:48:07 markus Exp $");
1.1 provos 29:
30: #include <openssl/bn.h>
31: #include <openssl/dh.h>
32:
33: #include "ssh.h"
34: #include "dh.h"
35: #include "kex.h"
36: #include "auth.h"
1.22 markus 37: #include "auth-options.h"
1.1 provos 38: #include "buffer.h"
39: #include "bufaux.h"
40: #include "packet.h"
41: #include "mac.h"
42: #include "log.h"
43: #include "zlib.h"
44: #include "monitor.h"
45: #include "monitor_wrap.h"
46: #include "xmalloc.h"
47: #include "atomicio.h"
48: #include "monitor_fdpass.h"
49: #include "getput.h"
50:
51: #include "auth.h"
52: #include "channels.h"
53: #include "session.h"
54:
55: /* Imports */
56: extern int compat20;
57: extern Newkeys *newkeys[];
58: extern z_stream incoming_stream;
59: extern z_stream outgoing_stream;
1.7 mouring 60: extern struct monitor *pmonitor;
1.1 provos 61: extern Buffer input, output;
62:
63: void
64: mm_request_send(int socket, enum monitor_reqtype type, Buffer *m)
65: {
1.13 deraadt 66: u_int mlen = buffer_len(m);
1.1 provos 67: u_char buf[5];
68:
1.8 markus 69: debug3("%s entering: type %d", __func__, type);
1.1 provos 70:
71: PUT_32BIT(buf, mlen + 1);
1.10 deraadt 72: buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */
1.1 provos 73: if (atomicio(write, socket, buf, sizeof(buf)) != sizeof(buf))
1.8 markus 74: fatal("%s: write", __func__);
1.1 provos 75: if (atomicio(write, socket, buffer_ptr(m), mlen) != mlen)
1.8 markus 76: fatal("%s: write", __func__);
1.1 provos 77: }
78:
79: void
80: mm_request_receive(int socket, Buffer *m)
81: {
82: u_char buf[4];
1.13 deraadt 83: u_int msg_len;
1.1 provos 84: ssize_t res;
85:
1.8 markus 86: debug3("%s entering", __func__);
1.1 provos 87:
88: res = atomicio(read, socket, buf, sizeof(buf));
89: if (res != sizeof(buf)) {
90: if (res == 0)
91: fatal_cleanup();
1.8 markus 92: fatal("%s: read: %ld", __func__, (long)res);
1.1 provos 93: }
94: msg_len = GET_32BIT(buf);
95: if (msg_len > 256 * 1024)
1.8 markus 96: fatal("%s: read: bad msg_len %d", __func__, msg_len);
1.1 provos 97: buffer_clear(m);
98: buffer_append_space(m, msg_len);
99: res = atomicio(read, socket, buffer_ptr(m), msg_len);
100: if (res != msg_len)
1.8 markus 101: fatal("%s: read: %ld != msg_len", __func__, (long)res);
1.1 provos 102: }
103:
104: void
105: mm_request_receive_expect(int socket, enum monitor_reqtype type, Buffer *m)
106: {
107: u_char rtype;
108:
1.8 markus 109: debug3("%s entering: type %d", __func__, type);
1.1 provos 110:
111: mm_request_receive(socket, m);
112: rtype = buffer_get_char(m);
113: if (rtype != type)
1.8 markus 114: fatal("%s: read: rtype %d != type %d", __func__,
1.1 provos 115: rtype, type);
116: }
117:
118: DH *
119: mm_choose_dh(int min, int nbits, int max)
120: {
121: BIGNUM *p, *g;
122: int success = 0;
123: Buffer m;
124:
125: buffer_init(&m);
126: buffer_put_int(&m, min);
127: buffer_put_int(&m, nbits);
128: buffer_put_int(&m, max);
129:
1.7 mouring 130: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_MODULI, &m);
1.1 provos 131:
1.8 markus 132: debug3("%s: waiting for MONITOR_ANS_MODULI", __func__);
1.7 mouring 133: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_MODULI, &m);
1.1 provos 134:
135: success = buffer_get_char(&m);
136: if (success == 0)
1.8 markus 137: fatal("%s: MONITOR_ANS_MODULI failed", __func__);
1.1 provos 138:
139: if ((p = BN_new()) == NULL)
1.8 markus 140: fatal("%s: BN_new failed", __func__);
1.3 markus 141: if ((g = BN_new()) == NULL)
1.8 markus 142: fatal("%s: BN_new failed", __func__);
1.1 provos 143: buffer_get_bignum2(&m, p);
144: buffer_get_bignum2(&m, g);
145:
1.8 markus 146: debug3("%s: remaining %d", __func__, buffer_len(&m));
1.1 provos 147: buffer_free(&m);
148:
149: return (dh_new_group(g, p));
150: }
151:
152: int
153: mm_key_sign(Key *key, u_char **sigp, u_int *lenp, u_char *data, u_int datalen)
154: {
1.7 mouring 155: Kex *kex = *pmonitor->m_pkex;
1.1 provos 156: Buffer m;
157:
1.8 markus 158: debug3("%s entering", __func__);
1.1 provos 159:
160: buffer_init(&m);
161: buffer_put_int(&m, kex->host_key_index(key));
162: buffer_put_string(&m, data, datalen);
163:
1.7 mouring 164: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, &m);
1.1 provos 165:
1.8 markus 166: debug3("%s: waiting for MONITOR_ANS_SIGN", __func__);
1.7 mouring 167: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SIGN, &m);
1.1 provos 168: *sigp = buffer_get_string(&m, lenp);
169: buffer_free(&m);
170:
171: return (0);
172: }
173:
174: struct passwd *
175: mm_getpwnamallow(const char *login)
176: {
177: Buffer m;
178: struct passwd *pw;
179: u_int pwlen;
180:
1.8 markus 181: debug3("%s entering", __func__);
1.1 provos 182:
183: buffer_init(&m);
184: buffer_put_cstring(&m, login);
185:
1.7 mouring 186: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, &m);
1.1 provos 187:
1.8 markus 188: debug3("%s: waiting for MONITOR_ANS_PWNAM", __func__);
1.7 mouring 189: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, &m);
1.1 provos 190:
191: if (buffer_get_char(&m) == 0) {
192: buffer_free(&m);
193: return (NULL);
194: }
195: pw = buffer_get_string(&m, &pwlen);
196: if (pwlen != sizeof(struct passwd))
1.8 markus 197: fatal("%s: struct passwd size mismatch", __func__);
1.1 provos 198: pw->pw_name = buffer_get_string(&m, NULL);
199: pw->pw_passwd = buffer_get_string(&m, NULL);
200: pw->pw_gecos = buffer_get_string(&m, NULL);
201: pw->pw_class = buffer_get_string(&m, NULL);
202: pw->pw_dir = buffer_get_string(&m, NULL);
203: pw->pw_shell = buffer_get_string(&m, NULL);
204: buffer_free(&m);
205:
206: return (pw);
1.6 djm 207: }
208:
1.14 deraadt 209: char *mm_auth2_read_banner(void)
1.6 djm 210: {
211: Buffer m;
212: char *banner;
213:
1.8 markus 214: debug3("%s entering", __func__);
1.6 djm 215:
216: buffer_init(&m);
1.7 mouring 217: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, &m);
1.6 djm 218: buffer_clear(&m);
219:
1.7 mouring 220: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTH2_READ_BANNER, &m);
1.6 djm 221: banner = buffer_get_string(&m, NULL);
222: buffer_free(&m);
1.10 deraadt 223:
1.6 djm 224: return (banner);
1.1 provos 225: }
226:
227: /* Inform the privileged process about service and style */
228:
229: void
230: mm_inform_authserv(char *service, char *style)
231: {
232: Buffer m;
233:
1.8 markus 234: debug3("%s entering", __func__);
1.1 provos 235:
236: buffer_init(&m);
237: buffer_put_cstring(&m, service);
238: buffer_put_cstring(&m, style ? style : "");
239:
1.7 mouring 240: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m);
1.1 provos 241:
242: buffer_free(&m);
243: }
244:
245: /* Do the password authentication */
246: int
247: mm_auth_password(Authctxt *authctxt, char *password)
248: {
249: Buffer m;
250: int authenticated = 0;
251:
1.8 markus 252: debug3("%s entering", __func__);
1.1 provos 253:
254: buffer_init(&m);
255: buffer_put_cstring(&m, password);
1.7 mouring 256: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHPASSWORD, &m);
1.1 provos 257:
1.8 markus 258: debug3("%s: waiting for MONITOR_ANS_AUTHPASSWORD", __func__);
1.7 mouring 259: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTHPASSWORD, &m);
1.1 provos 260:
261: authenticated = buffer_get_int(&m);
262:
263: buffer_free(&m);
264:
1.3 markus 265: debug3("%s: user %sauthenticated",
1.8 markus 266: __func__, authenticated ? "" : "not ");
1.1 provos 267: return (authenticated);
268: }
269:
270: int
271: mm_user_key_allowed(struct passwd *pw, Key *key)
272: {
273: return (mm_key_allowed(MM_USERKEY, NULL, NULL, key));
274: }
275:
276: int
277: mm_hostbased_key_allowed(struct passwd *pw, char *user, char *host,
278: Key *key)
279: {
280: return (mm_key_allowed(MM_HOSTKEY, user, host, key));
281: }
282:
283: int
284: mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user,
285: char *host, Key *key)
286: {
287: int ret;
288:
289: key->type = KEY_RSA; /* XXX hack for key_to_blob */
290: ret = mm_key_allowed(MM_RSAHOSTKEY, user, host, key);
291: key->type = KEY_RSA1;
292: return (ret);
293: }
294:
1.2 markus 295: static void
1.1 provos 296: mm_send_debug(Buffer *m)
297: {
298: char *msg;
299:
300: while (buffer_len(m)) {
301: msg = buffer_get_string(m, NULL);
1.8 markus 302: debug3("%s: Sending debug: %s", __func__, msg);
1.1 provos 303: packet_send_debug("%s", msg);
304: xfree(msg);
305: }
306: }
307:
308: int
309: mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key)
310: {
311: Buffer m;
312: u_char *blob;
313: u_int len;
1.22 markus 314: int allowed = 0, have_forced = 0;
1.1 provos 315:
1.8 markus 316: debug3("%s entering", __func__);
1.1 provos 317:
318: /* Convert the key to a blob and the pass it over */
319: if (!key_to_blob(key, &blob, &len))
320: return (0);
321:
322: buffer_init(&m);
323: buffer_put_int(&m, type);
324: buffer_put_cstring(&m, user ? user : "");
325: buffer_put_cstring(&m, host ? host : "");
326: buffer_put_string(&m, blob, len);
327: xfree(blob);
328:
1.7 mouring 329: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, &m);
1.1 provos 330:
1.8 markus 331: debug3("%s: waiting for MONITOR_ANS_KEYALLOWED", __func__);
1.7 mouring 332: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYALLOWED, &m);
1.1 provos 333:
334: allowed = buffer_get_int(&m);
335:
1.22 markus 336: /* fake forced command */
337: auth_clear_options();
338: have_forced = buffer_get_int(&m);
339: forced_command = have_forced ? xstrdup("true") : NULL;
340:
1.1 provos 341: /* Send potential debug messages */
342: mm_send_debug(&m);
343:
344: buffer_free(&m);
345:
346: return (allowed);
347: }
348:
1.3 markus 349: /*
1.1 provos 350: * This key verify needs to send the key type along, because the
351: * privileged parent makes the decision if the key is allowed
352: * for authentication.
353: */
354:
355: int
356: mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
357: {
358: Buffer m;
359: u_char *blob;
360: u_int len;
361: int verified = 0;
362:
1.8 markus 363: debug3("%s entering", __func__);
1.1 provos 364:
365: /* Convert the key to a blob and the pass it over */
366: if (!key_to_blob(key, &blob, &len))
367: return (0);
368:
369: buffer_init(&m);
370: buffer_put_string(&m, blob, len);
371: buffer_put_string(&m, sig, siglen);
372: buffer_put_string(&m, data, datalen);
373: xfree(blob);
374:
1.7 mouring 375: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, &m);
1.1 provos 376:
1.8 markus 377: debug3("%s: waiting for MONITOR_ANS_KEYVERIFY", __func__);
1.7 mouring 378: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYVERIFY, &m);
1.1 provos 379:
380: verified = buffer_get_int(&m);
381:
382: buffer_free(&m);
383:
384: return (verified);
385: }
386:
387: /* Export key state after authentication */
388: Newkeys *
389: mm_newkeys_from_blob(u_char *blob, int blen)
390: {
391: Buffer b;
392: u_int len;
393: Newkeys *newkey = NULL;
394: Enc *enc;
395: Mac *mac;
396: Comp *comp;
397:
1.8 markus 398: debug3("%s: %p(%d)", __func__, blob, blen);
1.1 provos 399: #ifdef DEBUG_PK
400: dump_base64(stderr, blob, blen);
401: #endif
402: buffer_init(&b);
403: buffer_append(&b, blob, blen);
404:
405: newkey = xmalloc(sizeof(*newkey));
406: enc = &newkey->enc;
407: mac = &newkey->mac;
408: comp = &newkey->comp;
409:
410: /* Enc structure */
411: enc->name = buffer_get_string(&b, NULL);
412: buffer_get(&b, &enc->cipher, sizeof(enc->cipher));
413: enc->enabled = buffer_get_int(&b);
414: enc->block_size = buffer_get_int(&b);
415: enc->key = buffer_get_string(&b, &enc->key_len);
416: enc->iv = buffer_get_string(&b, &len);
417: if (len != enc->block_size)
1.12 deraadt 418: fatal("%s: bad ivlen: expected %u != %u", __func__,
1.1 provos 419: enc->block_size, len);
420:
421: if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher)
1.8 markus 422: fatal("%s: bad cipher name %s or pointer %p", __func__,
1.1 provos 423: enc->name, enc->cipher);
424:
425: /* Mac structure */
426: mac->name = buffer_get_string(&b, NULL);
427: if (mac->name == NULL || mac_init(mac, mac->name) == -1)
1.8 markus 428: fatal("%s: can not init mac %s", __func__, mac->name);
1.1 provos 429: mac->enabled = buffer_get_int(&b);
430: mac->key = buffer_get_string(&b, &len);
431: if (len > mac->key_len)
1.12 deraadt 432: fatal("%s: bad mac key length: %u > %d", __func__, len,
1.1 provos 433: mac->key_len);
434: mac->key_len = len;
435:
436: /* Comp structure */
437: comp->type = buffer_get_int(&b);
438: comp->enabled = buffer_get_int(&b);
439: comp->name = buffer_get_string(&b, NULL);
440:
441: len = buffer_len(&b);
442: if (len != 0)
1.12 deraadt 443: error("newkeys_from_blob: remaining bytes in blob %u", len);
1.1 provos 444: buffer_free(&b);
445: return (newkey);
446: }
447:
448: int
449: mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
450: {
451: Buffer b;
452: int len;
453: Enc *enc;
454: Mac *mac;
455: Comp *comp;
456: Newkeys *newkey = newkeys[mode];
457:
1.8 markus 458: debug3("%s: converting %p", __func__, newkey);
1.1 provos 459:
460: if (newkey == NULL) {
1.8 markus 461: error("%s: newkey == NULL", __func__);
1.1 provos 462: return 0;
463: }
464: enc = &newkey->enc;
465: mac = &newkey->mac;
466: comp = &newkey->comp;
467:
468: buffer_init(&b);
469: /* Enc structure */
470: buffer_put_cstring(&b, enc->name);
471: /* The cipher struct is constant and shared, you export pointer */
472: buffer_append(&b, &enc->cipher, sizeof(enc->cipher));
473: buffer_put_int(&b, enc->enabled);
474: buffer_put_int(&b, enc->block_size);
475: buffer_put_string(&b, enc->key, enc->key_len);
476: packet_get_keyiv(mode, enc->iv, enc->block_size);
477: buffer_put_string(&b, enc->iv, enc->block_size);
478:
479: /* Mac structure */
480: buffer_put_cstring(&b, mac->name);
481: buffer_put_int(&b, mac->enabled);
482: buffer_put_string(&b, mac->key, mac->key_len);
483:
484: /* Comp structure */
485: buffer_put_int(&b, comp->type);
486: buffer_put_int(&b, comp->enabled);
487: buffer_put_cstring(&b, comp->name);
488:
489: len = buffer_len(&b);
1.16 markus 490: if (lenp != NULL)
491: *lenp = len;
492: if (blobp != NULL) {
493: *blobp = xmalloc(len);
494: memcpy(*blobp, buffer_ptr(&b), len);
495: }
1.1 provos 496: memset(buffer_ptr(&b), 0, len);
497: buffer_free(&b);
498: return len;
499: }
500:
1.2 markus 501: static void
1.1 provos 502: mm_send_kex(Buffer *m, Kex *kex)
503: {
504: buffer_put_string(m, kex->session_id, kex->session_id_len);
505: buffer_put_int(m, kex->we_need);
506: buffer_put_int(m, kex->hostkey_type);
507: buffer_put_int(m, kex->kex_type);
508: buffer_put_string(m, buffer_ptr(&kex->my), buffer_len(&kex->my));
509: buffer_put_string(m, buffer_ptr(&kex->peer), buffer_len(&kex->peer));
510: buffer_put_int(m, kex->flags);
511: buffer_put_cstring(m, kex->client_version_string);
512: buffer_put_cstring(m, kex->server_version_string);
513: }
514:
515: void
1.7 mouring 516: mm_send_keystate(struct monitor *pmonitor)
1.1 provos 517: {
518: Buffer m;
519: u_char *blob, *p;
520: u_int bloblen, plen;
1.25 markus 521: u_int32_t seqnr, packets;
522: u_int64_t blocks;
1.1 provos 523:
524: buffer_init(&m);
525:
526: if (!compat20) {
527: u_char iv[24];
1.11 markus 528: u_char *key;
529: u_int ivlen, keylen;
1.1 provos 530:
531: buffer_put_int(&m, packet_get_protocol_flags());
532:
533: buffer_put_int(&m, packet_get_ssh1_cipher());
534:
1.11 markus 535: debug3("%s: Sending ssh1 KEY+IV", __func__);
536: keylen = packet_get_encryption_key(NULL);
537: key = xmalloc(keylen+1); /* add 1 if keylen == 0 */
538: keylen = packet_get_encryption_key(key);
539: buffer_put_string(&m, key, keylen);
540: memset(key, 0, keylen);
541: xfree(key);
542:
1.1 provos 543: ivlen = packet_get_keyiv_len(MODE_OUT);
544: packet_get_keyiv(MODE_OUT, iv, ivlen);
545: buffer_put_string(&m, iv, ivlen);
546: ivlen = packet_get_keyiv_len(MODE_OUT);
547: packet_get_keyiv(MODE_IN, iv, ivlen);
548: buffer_put_string(&m, iv, ivlen);
549: goto skip;
550: } else {
551: /* Kex for rekeying */
1.7 mouring 552: mm_send_kex(&m, *pmonitor->m_pkex);
1.1 provos 553: }
554:
555: debug3("%s: Sending new keys: %p %p",
1.8 markus 556: __func__, newkeys[MODE_OUT], newkeys[MODE_IN]);
1.1 provos 557:
558: /* Keys from Kex */
559: if (!mm_newkeys_to_blob(MODE_OUT, &blob, &bloblen))
1.8 markus 560: fatal("%s: conversion of newkeys failed", __func__);
1.1 provos 561:
562: buffer_put_string(&m, blob, bloblen);
563: xfree(blob);
564:
565: if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
1.8 markus 566: fatal("%s: conversion of newkeys failed", __func__);
1.1 provos 567:
568: buffer_put_string(&m, blob, bloblen);
569: xfree(blob);
570:
1.25 markus 571: packet_get_state(MODE_OUT, &seqnr, &blocks, &packets);
572: buffer_put_int(&m, seqnr);
573: buffer_put_int64(&m, blocks);
574: buffer_put_int(&m, packets);
1.26 ! markus 575: packet_get_state(MODE_IN, &seqnr, &blocks, &packets);
1.25 markus 576: buffer_put_int(&m, seqnr);
577: buffer_put_int64(&m, blocks);
578: buffer_put_int(&m, packets);
1.1 provos 579:
1.8 markus 580: debug3("%s: New keys have been sent", __func__);
1.1 provos 581: skip:
582: /* More key context */
583: plen = packet_get_keycontext(MODE_OUT, NULL);
584: p = xmalloc(plen+1);
585: packet_get_keycontext(MODE_OUT, p);
586: buffer_put_string(&m, p, plen);
587: xfree(p);
588:
589: plen = packet_get_keycontext(MODE_IN, NULL);
590: p = xmalloc(plen+1);
591: packet_get_keycontext(MODE_IN, p);
592: buffer_put_string(&m, p, plen);
593: xfree(p);
594:
595: /* Compression state */
1.8 markus 596: debug3("%s: Sending compression state", __func__);
1.1 provos 597: buffer_put_string(&m, &outgoing_stream, sizeof(outgoing_stream));
598: buffer_put_string(&m, &incoming_stream, sizeof(incoming_stream));
599:
600: /* Network I/O buffers */
601: buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input));
602: buffer_put_string(&m, buffer_ptr(&output), buffer_len(&output));
603:
1.7 mouring 604: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
1.8 markus 605: debug3("%s: Finished sending state", __func__);
1.1 provos 606:
607: buffer_free(&m);
608: }
609:
610: int
611: mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
612: {
613: Buffer m;
1.18 markus 614: char *p;
1.1 provos 615: int success = 0;
616:
617: buffer_init(&m);
1.7 mouring 618: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m);
1.1 provos 619:
1.8 markus 620: debug3("%s: waiting for MONITOR_ANS_PTY", __func__);
1.7 mouring 621: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PTY, &m);
1.1 provos 622:
623: success = buffer_get_int(&m);
624: if (success == 0) {
1.8 markus 625: debug3("%s: pty alloc failed", __func__);
1.1 provos 626: buffer_free(&m);
627: return (0);
628: }
629: p = buffer_get_string(&m, NULL);
630: buffer_free(&m);
631:
632: strlcpy(namebuf, p, namebuflen); /* Possible truncation */
633: xfree(p);
634:
1.7 mouring 635: *ptyfd = mm_receive_fd(pmonitor->m_recvfd);
636: *ttyfd = mm_receive_fd(pmonitor->m_recvfd);
1.1 provos 637:
638: /* Success */
639: return (1);
640: }
641:
642: void
643: mm_session_pty_cleanup2(void *session)
644: {
645: Session *s = session;
646: Buffer m;
647:
648: if (s->ttyfd == -1)
649: return;
650: buffer_init(&m);
651: buffer_put_cstring(&m, s->tty);
1.7 mouring 652: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTYCLEANUP, &m);
1.1 provos 653: buffer_free(&m);
1.3 markus 654:
1.1 provos 655: /* closed dup'ed master */
656: if (close(s->ptymaster) < 0)
657: error("close(s->ptymaster): %s", strerror(errno));
658:
659: /* unlink pty from session */
660: s->ttyfd = -1;
661: }
662:
663: /* Request process termination */
664:
665: void
666: mm_terminate(void)
667: {
668: Buffer m;
669:
670: buffer_init(&m);
1.7 mouring 671: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_TERM, &m);
1.1 provos 672: buffer_free(&m);
673: }
674:
675: int
676: mm_ssh1_session_key(BIGNUM *num)
677: {
678: int rsafail;
679: Buffer m;
680:
681: buffer_init(&m);
682: buffer_put_bignum2(&m, num);
1.7 mouring 683: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSKEY, &m);
1.1 provos 684:
1.7 mouring 685: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SESSKEY, &m);
1.1 provos 686:
687: rsafail = buffer_get_int(&m);
688: buffer_get_bignum2(&m, num);
689:
690: buffer_free(&m);
691:
692: return (rsafail);
693: }
694:
1.2 markus 695: static void
1.1 provos 696: mm_chall_setup(char **name, char **infotxt, u_int *numprompts,
697: char ***prompts, u_int **echo_on)
698: {
1.10 deraadt 699: *name = xstrdup("");
700: *infotxt = xstrdup("");
1.1 provos 701: *numprompts = 1;
1.14 deraadt 702: *prompts = xmalloc(*numprompts * sizeof(char *));
1.1 provos 703: *echo_on = xmalloc(*numprompts * sizeof(u_int));
704: (*echo_on)[0] = 0;
705: }
706:
707: int
708: mm_bsdauth_query(void *ctx, char **name, char **infotxt,
709: u_int *numprompts, char ***prompts, u_int **echo_on)
710: {
711: Buffer m;
1.21 markus 712: u_int success;
1.1 provos 713: char *challenge;
714:
1.8 markus 715: debug3("%s: entering", __func__);
1.1 provos 716:
717: buffer_init(&m);
1.7 mouring 718: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHQUERY, &m);
1.1 provos 719:
1.7 mouring 720: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_BSDAUTHQUERY,
1.1 provos 721: &m);
1.21 markus 722: success = buffer_get_int(&m);
723: if (success == 0) {
1.8 markus 724: debug3("%s: no challenge", __func__);
1.1 provos 725: buffer_free(&m);
726: return (-1);
727: }
728:
729: /* Get the challenge, and format the response */
730: challenge = buffer_get_string(&m, NULL);
731: buffer_free(&m);
732:
733: mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
734: (*prompts)[0] = challenge;
735:
1.8 markus 736: debug3("%s: received challenge: %s", __func__, challenge);
1.1 provos 737:
738: return (0);
739: }
740:
741: int
742: mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses)
743: {
744: Buffer m;
745: int authok;
746:
1.8 markus 747: debug3("%s: entering", __func__);
1.1 provos 748: if (numresponses != 1)
749: return (-1);
750:
751: buffer_init(&m);
752: buffer_put_cstring(&m, responses[0]);
1.7 mouring 753: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHRESPOND, &m);
1.1 provos 754:
1.7 mouring 755: mm_request_receive_expect(pmonitor->m_recvfd,
1.1 provos 756: MONITOR_ANS_BSDAUTHRESPOND, &m);
757:
758: authok = buffer_get_int(&m);
759: buffer_free(&m);
760:
761: return ((authok == 0) ? -1 : 0);
762: }
763:
764: int
765: mm_skey_query(void *ctx, char **name, char **infotxt,
766: u_int *numprompts, char ***prompts, u_int **echo_on)
767: {
768: Buffer m;
1.21 markus 769: int len;
770: u_int success;
1.1 provos 771: char *p, *challenge;
772:
1.8 markus 773: debug3("%s: entering", __func__);
1.1 provos 774:
775: buffer_init(&m);
1.7 mouring 776: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYQUERY, &m);
1.1 provos 777:
1.7 mouring 778: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SKEYQUERY,
1.1 provos 779: &m);
1.21 markus 780: success = buffer_get_int(&m);
781: if (success == 0) {
1.8 markus 782: debug3("%s: no challenge", __func__);
1.1 provos 783: buffer_free(&m);
784: return (-1);
785: }
786:
787: /* Get the challenge, and format the response */
788: challenge = buffer_get_string(&m, NULL);
789: buffer_free(&m);
790:
1.8 markus 791: debug3("%s: received challenge: %s", __func__, challenge);
1.1 provos 792:
793: mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
794:
795: len = strlen(challenge) + strlen(SKEY_PROMPT) + 1;
796: p = xmalloc(len);
797: strlcpy(p, challenge, len);
798: strlcat(p, SKEY_PROMPT, len);
799: (*prompts)[0] = p;
800: xfree(challenge);
801:
802: return (0);
803: }
804:
805: int
806: mm_skey_respond(void *ctx, u_int numresponses, char **responses)
807: {
808: Buffer m;
809: int authok;
810:
1.8 markus 811: debug3("%s: entering", __func__);
1.1 provos 812: if (numresponses != 1)
813: return (-1);
814:
815: buffer_init(&m);
816: buffer_put_cstring(&m, responses[0]);
1.7 mouring 817: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYRESPOND, &m);
1.1 provos 818:
1.7 mouring 819: mm_request_receive_expect(pmonitor->m_recvfd,
1.1 provos 820: MONITOR_ANS_SKEYRESPOND, &m);
821:
822: authok = buffer_get_int(&m);
823: buffer_free(&m);
824:
825: return ((authok == 0) ? -1 : 0);
826: }
827:
828: void
829: mm_ssh1_session_id(u_char session_id[16])
830: {
831: Buffer m;
832: int i;
833:
1.8 markus 834: debug3("%s entering", __func__);
1.1 provos 835:
836: buffer_init(&m);
837: for (i = 0; i < 16; i++)
838: buffer_put_char(&m, session_id[i]);
839:
1.7 mouring 840: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSID, &m);
1.1 provos 841: buffer_free(&m);
842: }
843:
844: int
845: mm_auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
846: {
847: Buffer m;
848: Key *key;
849: u_char *blob;
850: u_int blen;
1.22 markus 851: int allowed = 0, have_forced = 0;
1.1 provos 852:
1.8 markus 853: debug3("%s entering", __func__);
1.1 provos 854:
855: buffer_init(&m);
856: buffer_put_bignum2(&m, client_n);
857:
1.7 mouring 858: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSAKEYALLOWED, &m);
859: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSAKEYALLOWED, &m);
1.1 provos 860:
861: allowed = buffer_get_int(&m);
1.22 markus 862:
863: /* fake forced command */
864: auth_clear_options();
865: have_forced = buffer_get_int(&m);
866: forced_command = have_forced ? xstrdup("true") : NULL;
1.1 provos 867:
868: if (allowed && rkey != NULL) {
869: blob = buffer_get_string(&m, &blen);
870: if ((key = key_from_blob(blob, blen)) == NULL)
1.8 markus 871: fatal("%s: key_from_blob failed", __func__);
1.1 provos 872: *rkey = key;
873: xfree(blob);
874: }
875: mm_send_debug(&m);
876: buffer_free(&m);
877:
878: return (allowed);
879: }
880:
881: BIGNUM *
882: mm_auth_rsa_generate_challenge(Key *key)
883: {
884: Buffer m;
885: BIGNUM *challenge;
886: u_char *blob;
887: u_int blen;
888:
1.8 markus 889: debug3("%s entering", __func__);
1.1 provos 890:
891: if ((challenge = BN_new()) == NULL)
1.8 markus 892: fatal("%s: BN_new failed", __func__);
1.1 provos 893:
894: key->type = KEY_RSA; /* XXX cheat for key_to_blob */
895: if (key_to_blob(key, &blob, &blen) == 0)
1.8 markus 896: fatal("%s: key_to_blob failed", __func__);
1.1 provos 897: key->type = KEY_RSA1;
898:
899: buffer_init(&m);
900: buffer_put_string(&m, blob, blen);
901: xfree(blob);
902:
1.7 mouring 903: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSACHALLENGE, &m);
904: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSACHALLENGE, &m);
1.1 provos 905:
906: buffer_get_bignum2(&m, challenge);
907: buffer_free(&m);
908:
909: return (challenge);
910: }
911:
912: int
913: mm_auth_rsa_verify_response(Key *key, BIGNUM *p, u_char response[16])
914: {
915: Buffer m;
916: u_char *blob;
917: u_int blen;
918: int success = 0;
919:
1.8 markus 920: debug3("%s entering", __func__);
1.1 provos 921:
922: key->type = KEY_RSA; /* XXX cheat for key_to_blob */
923: if (key_to_blob(key, &blob, &blen) == 0)
1.8 markus 924: fatal("%s: key_to_blob failed", __func__);
1.1 provos 925: key->type = KEY_RSA1;
926:
927: buffer_init(&m);
928: buffer_put_string(&m, blob, blen);
929: buffer_put_string(&m, response, 16);
930: xfree(blob);
931:
1.7 mouring 932: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSARESPONSE, &m);
933: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSARESPONSE, &m);
1.1 provos 934:
935: success = buffer_get_int(&m);
936: buffer_free(&m);
937:
938: return (success);
939: }
1.19 markus 940:
941: #ifdef KRB4
942: int
943: mm_auth_krb4(Authctxt *authctxt, void *_auth, char **client, void *_reply)
944: {
945: KTEXT auth, reply;
946: Buffer m;
947: u_int rlen;
948: int success = 0;
949: char *p;
950:
951: debug3("%s entering", __func__);
952: auth = _auth;
953: reply = _reply;
954:
955: buffer_init(&m);
956: buffer_put_string(&m, auth->dat, auth->length);
957:
958: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB4, &m);
959: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB4, &m);
960:
961: success = buffer_get_int(&m);
962: if (success) {
963: *client = buffer_get_string(&m, NULL);
964: p = buffer_get_string(&m, &rlen);
965: if (rlen >= MAX_KTXT_LEN)
966: fatal("%s: reply from monitor too large", __func__);
967: reply->length = rlen;
968: memcpy(reply->dat, p, rlen);
969: memset(p, 0, rlen);
970: xfree(p);
971: }
972: buffer_free(&m);
1.20 deraadt 973: return (success);
1.19 markus 974: }
975: #endif
1.17 itojun 976:
977: #ifdef KRB5
978: int
979: mm_auth_krb5(void *ctx, void *argp, char **userp, void *resp)
980: {
981: krb5_data *tkt, *reply;
982: Buffer m;
983: int success;
984:
985: debug3("%s entering", __func__);
986: tkt = (krb5_data *) argp;
987: reply = (krb5_data *) resp;
988:
989: buffer_init(&m);
990: buffer_put_string(&m, tkt->data, tkt->length);
991:
992: mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB5, &m);
993: mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB5, &m);
994:
995: success = buffer_get_int(&m);
996: if (success) {
997: u_int len;
998:
999: *userp = buffer_get_string(&m, NULL);
1000: reply->data = buffer_get_string(&m, &len);
1001: reply->length = len;
1002: } else {
1003: memset(reply, 0, sizeof(*reply));
1004: *userp = NULL;
1005: }
1006:
1007: buffer_free(&m);
1008: return (success);
1009: }
1010: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to monitor_wrap.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh