diff options
author | Damien Miller <djm@mindrot.org> | 2000-08-23 10:46:23 +1000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2000-08-23 10:46:23 +1000 |
commit | ad833b3e65c1887674714d514eb818d862bb499a (patch) | |
tree | 16fa75fe42aede072c5d3edac562c2870d1bb0e5 /authfd.c | |
parent | b078567bf5de1dcf12d265d98acb4dc9eba8b325 (diff) |
- (djm) Pick up LOGIN_PROGRAM from environment or PATH if not set by headers
- (djm) OpenBSD CVS updates:
- deraadt@cvs.openbsd.org 2000/08/18 20:07:23
[ssh.c]
accept remsh as a valid name as well; roman@buildpoint.com
- deraadt@cvs.openbsd.org 2000/08/18 20:17:13
[deattack.c crc32.c packet.c]
rename crc32() to ssh_crc32() to avoid zlib name clash. do not move to
libz crc32 function yet, because it has ugly "long"'s in it;
oneill@cs.sfu.ca
- deraadt@cvs.openbsd.org 2000/08/18 20:26:08
[scp.1 scp.c]
-S prog support; tv@debian.org
- deraadt@cvs.openbsd.org 2000/08/18 20:50:07
[scp.c]
knf
- deraadt@cvs.openbsd.org 2000/08/18 20:57:33
[log-client.c]
shorten
- markus@cvs.openbsd.org 2000/08/19 12:48:11
[channels.c channels.h clientloop.c ssh.c ssh.h]
support for ~. in ssh2
- deraadt@cvs.openbsd.org 2000/08/19 15:29:40
[crc32.h]
proper prototype
- markus@cvs.openbsd.org 2000/08/19 15:34:44
[authfd.c authfd.h key.c key.h ssh-add.1 ssh-add.c ssh-agent.1]
[ssh-agent.c ssh-keygen.c sshconnect1.c sshconnect2.c Makefile]
[fingerprint.c fingerprint.h]
add SSH2/DSA support to the agent and some other DSA related cleanups.
(note that we cannot talk to ssh.com's ssh2 agents)
- markus@cvs.openbsd.org 2000/08/19 15:55:52
[channels.c channels.h clientloop.c]
more ~ support for ssh2
- markus@cvs.openbsd.org 2000/08/19 16:21:19
[clientloop.c]
oops
- millert@cvs.openbsd.org 2000/08/20 12:25:53
[session.c]
We have to stash the result of get_remote_name_or_ip() before we
close our socket or getpeername() will get EBADF and the process
will exit. Only a problem for "UseLogin yes".
- millert@cvs.openbsd.org 2000/08/20 12:30:59
[session.c]
Only check /etc/nologin if "UseLogin no" since login(1) may have its
own policy on determining who is allowed to login when /etc/nologin
is present. Also use the _PATH_NOLOGIN define.
- millert@cvs.openbsd.org 2000/08/20 12:42:43
[auth1.c auth2.c session.c ssh.c]
Add calls to setusercontext() and login_get*(). We basically call
setusercontext() in most places where previously we did a setlogin().
Add default login.conf file and put root in the "daemon" login class.
- millert@cvs.openbsd.org 2000/08/21 10:23:31
[session.c]
Fix incorrect PATH setting; noted by Markus.
Diffstat (limited to 'authfd.c')
-rw-r--r-- | authfd.c | 235 |
1 files changed, 155 insertions, 80 deletions
@@ -11,10 +11,13 @@ | |||
11 | * | 11 | * |
12 | * Functions for connecting the local authentication agent. | 12 | * Functions for connecting the local authentication agent. |
13 | * | 13 | * |
14 | * SSH2 implementation, | ||
15 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | ||
16 | * | ||
14 | */ | 17 | */ |
15 | 18 | ||
16 | #include "includes.h" | 19 | #include "includes.h" |
17 | RCSID("$OpenBSD: authfd.c,v 1.24 2000/08/15 19:20:46 markus Exp $"); | 20 | RCSID("$OpenBSD: authfd.c,v 1.25 2000/08/19 21:34:42 markus Exp $"); |
18 | 21 | ||
19 | #include "ssh.h" | 22 | #include "ssh.h" |
20 | #include "rsa.h" | 23 | #include "rsa.h" |
@@ -29,6 +32,7 @@ RCSID("$OpenBSD: authfd.c,v 1.24 2000/08/15 19:20:46 markus Exp $"); | |||
29 | #include "key.h" | 32 | #include "key.h" |
30 | #include "authfd.h" | 33 | #include "authfd.h" |
31 | #include "kex.h" | 34 | #include "kex.h" |
35 | #include "dsa.h" | ||
32 | 36 | ||
33 | /* helper */ | 37 | /* helper */ |
34 | int decode_reply(int type); | 38 | int decode_reply(int type); |
@@ -71,8 +75,7 @@ ssh_get_authentication_socket() | |||
71 | } | 75 | } |
72 | 76 | ||
73 | int | 77 | int |
74 | ssh_request_reply(AuthenticationConnection *auth, | 78 | ssh_request_reply(AuthenticationConnection *auth, Buffer *request, Buffer *reply) |
75 | Buffer *request, Buffer *reply) | ||
76 | { | 79 | { |
77 | int l, len; | 80 | int l, len; |
78 | char buf[1024]; | 81 | char buf[1024]; |
@@ -162,7 +165,6 @@ ssh_get_authentication_connection() | |||
162 | 165 | ||
163 | auth = xmalloc(sizeof(*auth)); | 166 | auth = xmalloc(sizeof(*auth)); |
164 | auth->fd = sock; | 167 | auth->fd = sock; |
165 | buffer_init(&auth->packet); | ||
166 | buffer_init(&auth->identities); | 168 | buffer_init(&auth->identities); |
167 | auth->howmany = 0; | 169 | auth->howmany = 0; |
168 | 170 | ||
@@ -175,46 +177,57 @@ ssh_get_authentication_connection() | |||
175 | */ | 177 | */ |
176 | 178 | ||
177 | void | 179 | void |
178 | ssh_close_authentication_connection(AuthenticationConnection *ac) | 180 | ssh_close_authentication_connection(AuthenticationConnection *auth) |
179 | { | 181 | { |
180 | buffer_free(&ac->packet); | 182 | buffer_free(&auth->identities); |
181 | buffer_free(&ac->identities); | 183 | close(auth->fd); |
182 | close(ac->fd); | 184 | xfree(auth); |
183 | xfree(ac); | ||
184 | } | 185 | } |
185 | 186 | ||
186 | /* | 187 | /* |
187 | * Returns the first authentication identity held by the agent. | 188 | * Returns the first authentication identity held by the agent. |
188 | * Returns true if an identity is available, 0 otherwise. | ||
189 | * The caller must initialize the integers before the call, and free the | ||
190 | * comment after a successful call (before calling ssh_get_next_identity). | ||
191 | */ | 189 | */ |
192 | 190 | ||
193 | int | 191 | Key * |
194 | ssh_get_first_identity(AuthenticationConnection *auth, | 192 | ssh_get_first_identity(AuthenticationConnection *auth, char **comment, int version) |
195 | BIGNUM *e, BIGNUM *n, char **comment) | ||
196 | { | 193 | { |
194 | int type, code1 = 0, code2 = 0; | ||
197 | Buffer request; | 195 | Buffer request; |
198 | int type; | 196 | |
197 | switch(version){ | ||
198 | case 1: | ||
199 | code1 = SSH_AGENTC_REQUEST_RSA_IDENTITIES; | ||
200 | code2 = SSH_AGENT_RSA_IDENTITIES_ANSWER; | ||
201 | break; | ||
202 | case 2: | ||
203 | code1 = SSH2_AGENTC_REQUEST_IDENTITIES; | ||
204 | code2 = SSH2_AGENT_IDENTITIES_ANSWER; | ||
205 | break; | ||
206 | default: | ||
207 | return NULL; | ||
208 | } | ||
199 | 209 | ||
200 | /* | 210 | /* |
201 | * Send a message to the agent requesting for a list of the | 211 | * Send a message to the agent requesting for a list of the |
202 | * identities it can represent. | 212 | * identities it can represent. |
203 | */ | 213 | */ |
204 | buffer_init(&request); | 214 | buffer_init(&request); |
205 | buffer_put_char(&request, SSH_AGENTC_REQUEST_RSA_IDENTITIES); | 215 | buffer_put_char(&request, code1); |
206 | 216 | ||
207 | buffer_clear(&auth->identities); | 217 | buffer_clear(&auth->identities); |
208 | if (ssh_request_reply(auth, &request, &auth->identities) == 0) { | 218 | if (ssh_request_reply(auth, &request, &auth->identities) == 0) { |
209 | buffer_free(&request); | 219 | buffer_free(&request); |
210 | return 0; | 220 | return NULL; |
211 | } | 221 | } |
212 | buffer_free(&request); | 222 | buffer_free(&request); |
213 | 223 | ||
214 | /* Get message type, and verify that we got a proper answer. */ | 224 | /* Get message type, and verify that we got a proper answer. */ |
215 | type = buffer_get_char(&auth->identities); | 225 | type = buffer_get_char(&auth->identities); |
216 | if (type != SSH_AGENT_RSA_IDENTITIES_ANSWER) | 226 | if (type == SSH_AGENT_FAILURE) { |
227 | return NULL; | ||
228 | } else if (type != code2) { | ||
217 | fatal("Bad authentication reply message type: %d", type); | 229 | fatal("Bad authentication reply message type: %d", type); |
230 | } | ||
218 | 231 | ||
219 | /* Get the number of entries in the response and check it for sanity. */ | 232 | /* Get the number of entries in the response and check it for sanity. */ |
220 | auth->howmany = buffer_get_int(&auth->identities); | 233 | auth->howmany = buffer_get_int(&auth->identities); |
@@ -223,43 +236,49 @@ ssh_get_first_identity(AuthenticationConnection *auth, | |||
223 | auth->howmany); | 236 | auth->howmany); |
224 | 237 | ||
225 | /* Return the first entry (if any). */ | 238 | /* Return the first entry (if any). */ |
226 | return ssh_get_next_identity(auth, e, n, comment); | 239 | return ssh_get_next_identity(auth, comment, version); |
227 | } | 240 | } |
228 | 241 | ||
229 | /* | 242 | Key * |
230 | * Returns the next authentication identity for the agent. Other functions | 243 | ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int version) |
231 | * can be called between this and ssh_get_first_identity or two calls of this | ||
232 | * function. This returns 0 if there are no more identities. The caller | ||
233 | * must free comment after a successful return. | ||
234 | */ | ||
235 | |||
236 | int | ||
237 | ssh_get_next_identity(AuthenticationConnection *auth, | ||
238 | BIGNUM *e, BIGNUM *n, char **comment) | ||
239 | { | 244 | { |
240 | unsigned int bits; | 245 | unsigned int bits; |
246 | unsigned char *blob; | ||
247 | unsigned int blen; | ||
248 | Key *key = NULL; | ||
241 | 249 | ||
242 | /* Return failure if no more entries. */ | 250 | /* Return failure if no more entries. */ |
243 | if (auth->howmany <= 0) | 251 | if (auth->howmany <= 0) |
244 | return 0; | 252 | return NULL; |
245 | 253 | ||
246 | /* | 254 | /* |
247 | * Get the next entry from the packet. These will abort with a fatal | 255 | * Get the next entry from the packet. These will abort with a fatal |
248 | * error if the packet is too short or contains corrupt data. | 256 | * error if the packet is too short or contains corrupt data. |
249 | */ | 257 | */ |
250 | bits = buffer_get_int(&auth->identities); | 258 | switch(version){ |
251 | buffer_get_bignum(&auth->identities, e); | 259 | case 1: |
252 | buffer_get_bignum(&auth->identities, n); | 260 | key = key_new(KEY_RSA); |
253 | *comment = buffer_get_string(&auth->identities, NULL); | 261 | bits = buffer_get_int(&auth->identities); |
254 | 262 | buffer_get_bignum(&auth->identities, key->rsa->e); | |
255 | if (bits != BN_num_bits(n)) | 263 | buffer_get_bignum(&auth->identities, key->rsa->n); |
256 | log("Warning: identity keysize mismatch: actual %d, announced %u", | 264 | *comment = buffer_get_string(&auth->identities, NULL); |
257 | BN_num_bits(n), bits); | 265 | if (bits != BN_num_bits(key->rsa->n)) |
258 | 266 | log("Warning: identity keysize mismatch: actual %d, announced %u", | |
267 | BN_num_bits(key->rsa->n), bits); | ||
268 | break; | ||
269 | case 2: | ||
270 | blob = buffer_get_string(&auth->identities, &blen); | ||
271 | *comment = buffer_get_string(&auth->identities, NULL); | ||
272 | key = dsa_key_from_blob(blob, blen); | ||
273 | xfree(blob); | ||
274 | break; | ||
275 | default: | ||
276 | return NULL; | ||
277 | break; | ||
278 | } | ||
259 | /* Decrement the number of remaining entries. */ | 279 | /* Decrement the number of remaining entries. */ |
260 | auth->howmany--; | 280 | auth->howmany--; |
261 | 281 | return key; | |
262 | return 1; | ||
263 | } | 282 | } |
264 | 283 | ||
265 | /* | 284 | /* |
@@ -272,7 +291,7 @@ ssh_get_next_identity(AuthenticationConnection *auth, | |||
272 | 291 | ||
273 | int | 292 | int |
274 | ssh_decrypt_challenge(AuthenticationConnection *auth, | 293 | ssh_decrypt_challenge(AuthenticationConnection *auth, |
275 | BIGNUM* e, BIGNUM *n, BIGNUM *challenge, | 294 | Key* key, BIGNUM *challenge, |
276 | unsigned char session_id[16], | 295 | unsigned char session_id[16], |
277 | unsigned int response_type, | 296 | unsigned int response_type, |
278 | unsigned char response[16]) | 297 | unsigned char response[16]) |
@@ -282,15 +301,17 @@ ssh_decrypt_challenge(AuthenticationConnection *auth, | |||
282 | int i; | 301 | int i; |
283 | int type; | 302 | int type; |
284 | 303 | ||
285 | if (response_type == 0) | 304 | if (key->type != KEY_RSA) |
286 | fatal("Compatibility with ssh protocol version " | 305 | return 0; |
287 | "1.0 no longer supported."); | 306 | if (response_type == 0) { |
288 | 307 | log("Compatibility with ssh protocol version 1.0 no longer supported."); | |
308 | return 0; | ||
309 | } | ||
289 | buffer_init(&buffer); | 310 | buffer_init(&buffer); |
290 | buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE); | 311 | buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE); |
291 | buffer_put_int(&buffer, BN_num_bits(n)); | 312 | buffer_put_int(&buffer, BN_num_bits(key->rsa->n)); |
292 | buffer_put_bignum(&buffer, e); | 313 | buffer_put_bignum(&buffer, key->rsa->e); |
293 | buffer_put_bignum(&buffer, n); | 314 | buffer_put_bignum(&buffer, key->rsa->n); |
294 | buffer_put_bignum(&buffer, challenge); | 315 | buffer_put_bignum(&buffer, challenge); |
295 | buffer_append(&buffer, (char *) session_id, 16); | 316 | buffer_append(&buffer, (char *) session_id, 16); |
296 | buffer_put_int(&buffer, response_type); | 317 | buffer_put_int(&buffer, response_type); |
@@ -318,6 +339,45 @@ ssh_decrypt_challenge(AuthenticationConnection *auth, | |||
318 | return success; | 339 | return success; |
319 | } | 340 | } |
320 | 341 | ||
342 | /* ask agent to sign data, returns -1 on error, 0 on success */ | ||
343 | int | ||
344 | ssh_agent_sign(AuthenticationConnection *auth, | ||
345 | Key *key, | ||
346 | unsigned char **sigp, int *lenp, | ||
347 | unsigned char *data, int datalen) | ||
348 | { | ||
349 | Buffer msg; | ||
350 | unsigned char *blob; | ||
351 | unsigned int blen; | ||
352 | int type; | ||
353 | int ret = -1; | ||
354 | |||
355 | if (dsa_make_key_blob(key, &blob, &blen) == 0) | ||
356 | return -1; | ||
357 | |||
358 | buffer_init(&msg); | ||
359 | buffer_put_char(&msg, SSH2_AGENTC_SIGN_REQUEST); | ||
360 | buffer_put_string(&msg, blob, blen); | ||
361 | buffer_put_string(&msg, data, datalen); | ||
362 | xfree(blob); | ||
363 | |||
364 | if (ssh_request_reply(auth, &msg, &msg) == 0) { | ||
365 | buffer_free(&msg); | ||
366 | return -1; | ||
367 | } | ||
368 | type = buffer_get_char(&msg); | ||
369 | if (type == SSH_AGENT_FAILURE) { | ||
370 | log("Agent admitted failure to sign using the key."); | ||
371 | } else if (type != SSH2_AGENT_SIGN_RESPONSE) { | ||
372 | fatal("Bad authentication response: %d", type); | ||
373 | } else { | ||
374 | ret = 0; | ||
375 | *sigp = buffer_get_string(&msg, lenp); | ||
376 | } | ||
377 | buffer_free(&msg); | ||
378 | return ret; | ||
379 | } | ||
380 | |||
321 | /* Encode key for a message to the agent. */ | 381 | /* Encode key for a message to the agent. */ |
322 | 382 | ||
323 | void | 383 | void |
@@ -358,29 +418,29 @@ ssh_encode_identity_dsa(Buffer *b, DSA *key, const char *comment) | |||
358 | int | 418 | int |
359 | ssh_add_identity(AuthenticationConnection *auth, Key *key, const char *comment) | 419 | ssh_add_identity(AuthenticationConnection *auth, Key *key, const char *comment) |
360 | { | 420 | { |
361 | Buffer buffer; | 421 | Buffer msg; |
362 | int type; | 422 | int type; |
363 | 423 | ||
364 | buffer_init(&buffer); | 424 | buffer_init(&msg); |
365 | 425 | ||
366 | switch (key->type) { | 426 | switch (key->type) { |
367 | case KEY_RSA: | 427 | case KEY_RSA: |
368 | ssh_encode_identity_rsa(&buffer, key->rsa, comment); | 428 | ssh_encode_identity_rsa(&msg, key->rsa, comment); |
369 | break; | 429 | break; |
370 | case KEY_DSA: | 430 | case KEY_DSA: |
371 | ssh_encode_identity_dsa(&buffer, key->dsa, comment); | 431 | ssh_encode_identity_dsa(&msg, key->dsa, comment); |
372 | break; | 432 | break; |
373 | default: | 433 | default: |
374 | buffer_free(&buffer); | 434 | buffer_free(&msg); |
375 | return 0; | 435 | return 0; |
376 | break; | 436 | break; |
377 | } | 437 | } |
378 | if (ssh_request_reply(auth, &buffer, &buffer) == 0) { | 438 | if (ssh_request_reply(auth, &msg, &msg) == 0) { |
379 | buffer_free(&buffer); | 439 | buffer_free(&msg); |
380 | return 0; | 440 | return 0; |
381 | } | 441 | } |
382 | type = buffer_get_char(&buffer); | 442 | type = buffer_get_char(&msg); |
383 | buffer_free(&buffer); | 443 | buffer_free(&msg); |
384 | return decode_reply(type); | 444 | return decode_reply(type); |
385 | } | 445 | } |
386 | 446 | ||
@@ -390,23 +450,35 @@ ssh_add_identity(AuthenticationConnection *auth, Key *key, const char *comment) | |||
390 | */ | 450 | */ |
391 | 451 | ||
392 | int | 452 | int |
393 | ssh_remove_identity(AuthenticationConnection *auth, RSA *key) | 453 | ssh_remove_identity(AuthenticationConnection *auth, Key *key) |
394 | { | 454 | { |
395 | Buffer buffer; | 455 | Buffer msg; |
396 | int type; | 456 | int type; |
397 | 457 | unsigned char *blob; | |
398 | buffer_init(&buffer); | 458 | unsigned int blen; |
399 | buffer_put_char(&buffer, SSH_AGENTC_REMOVE_RSA_IDENTITY); | 459 | |
400 | buffer_put_int(&buffer, BN_num_bits(key->n)); | 460 | buffer_init(&msg); |
401 | buffer_put_bignum(&buffer, key->e); | 461 | |
402 | buffer_put_bignum(&buffer, key->n); | 462 | if (key->type == KEY_RSA) { |
403 | 463 | buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY); | |
404 | if (ssh_request_reply(auth, &buffer, &buffer) == 0) { | 464 | buffer_put_int(&msg, BN_num_bits(key->rsa->n)); |
405 | buffer_free(&buffer); | 465 | buffer_put_bignum(&msg, key->rsa->e); |
466 | buffer_put_bignum(&msg, key->rsa->n); | ||
467 | } else if (key->type == KEY_DSA) { | ||
468 | dsa_make_key_blob(key, &blob, &blen); | ||
469 | buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY); | ||
470 | buffer_put_string(&msg, blob, blen); | ||
471 | xfree(blob); | ||
472 | } else { | ||
473 | buffer_free(&msg); | ||
406 | return 0; | 474 | return 0; |
407 | } | 475 | } |
408 | type = buffer_get_char(&buffer); | 476 | if (ssh_request_reply(auth, &msg, &msg) == 0) { |
409 | buffer_free(&buffer); | 477 | buffer_free(&msg); |
478 | return 0; | ||
479 | } | ||
480 | type = buffer_get_char(&msg); | ||
481 | buffer_free(&msg); | ||
410 | return decode_reply(type); | 482 | return decode_reply(type); |
411 | } | 483 | } |
412 | 484 | ||
@@ -416,20 +488,23 @@ ssh_remove_identity(AuthenticationConnection *auth, RSA *key) | |||
416 | */ | 488 | */ |
417 | 489 | ||
418 | int | 490 | int |
419 | ssh_remove_all_identities(AuthenticationConnection *auth) | 491 | ssh_remove_all_identities(AuthenticationConnection *auth, int version) |
420 | { | 492 | { |
421 | Buffer buffer; | 493 | Buffer msg; |
422 | int type; | 494 | int type; |
495 | int code = (version==1) ? | ||
496 | SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES : | ||
497 | SSH2_AGENTC_REMOVE_ALL_IDENTITIES; | ||
423 | 498 | ||
424 | buffer_init(&buffer); | 499 | buffer_init(&msg); |
425 | buffer_put_char(&buffer, SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES); | 500 | buffer_put_char(&msg, code); |
426 | 501 | ||
427 | if (ssh_request_reply(auth, &buffer, &buffer) == 0) { | 502 | if (ssh_request_reply(auth, &msg, &msg) == 0) { |
428 | buffer_free(&buffer); | 503 | buffer_free(&msg); |
429 | return 0; | 504 | return 0; |
430 | } | 505 | } |
431 | type = buffer_get_char(&buffer); | 506 | type = buffer_get_char(&msg); |
432 | buffer_free(&buffer); | 507 | buffer_free(&msg); |
433 | return decode_reply(type); | 508 | return decode_reply(type); |
434 | } | 509 | } |
435 | 510 | ||