summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ssh-keysign.c23
1 files changed, 16 insertions, 7 deletions
diff --git a/ssh-keysign.c b/ssh-keysign.c
index 1dca3e289..4c99609b2 100644
--- a/ssh-keysign.c
+++ b/ssh-keysign.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh-keysign.c,v 1.49 2015/07/03 03:56:25 djm Exp $ */ 1/* $OpenBSD: ssh-keysign.c,v 1.50 2015/11/29 22:18:37 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2002 Markus Friedl. All rights reserved. 3 * Copyright (c) 2002 Markus Friedl. All rights reserved.
4 * 4 *
@@ -34,6 +34,7 @@
34#include <stdlib.h> 34#include <stdlib.h>
35#include <string.h> 35#include <string.h>
36#include <unistd.h> 36#include <unistd.h>
37#include <errno.h>
37 38
38#ifdef WITH_OPENSSL 39#ifdef WITH_OPENSSL
39#include <openssl/evp.h> 40#include <openssl/evp.h>
@@ -59,6 +60,8 @@
59 60
60struct ssh *active_state = NULL; /* XXX needed for linking */ 61struct ssh *active_state = NULL; /* XXX needed for linking */
61 62
63extern char *__progname;
64
62/* XXX readconf.c needs these */ 65/* XXX readconf.c needs these */
63uid_t original_real_uid; 66uid_t original_real_uid;
64 67
@@ -179,6 +182,9 @@ main(int argc, char **argv)
179 u_int32_t rnd[256]; 182 u_int32_t rnd[256];
180#endif 183#endif
181 184
185 if (pledge("stdio rpath getpw dns id", NULL) != 0)
186 fatal("%s: pledge: %s", __progname, strerror(errno));
187
182 /* Ensure that stdin and stdout are connected */ 188 /* Ensure that stdin and stdout are connected */
183 if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2) 189 if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2)
184 exit(1); 190 exit(1);
@@ -245,23 +251,26 @@ main(int argc, char **argv)
245 if (!found) 251 if (!found)
246 fatal("no hostkey found"); 252 fatal("no hostkey found");
247 253
254 if (pledge("stdio dns", NULL) != 0)
255 fatal("%s: pledge: %s", __progname, strerror(errno));
256
248 if ((b = sshbuf_new()) == NULL) 257 if ((b = sshbuf_new()) == NULL)
249 fatal("%s: sshbuf_new failed", __func__); 258 fatal("%s: sshbuf_new failed", __progname);
250 if (ssh_msg_recv(STDIN_FILENO, b) < 0) 259 if (ssh_msg_recv(STDIN_FILENO, b) < 0)
251 fatal("ssh_msg_recv failed"); 260 fatal("ssh_msg_recv failed");
252 if ((r = sshbuf_get_u8(b, &rver)) != 0) 261 if ((r = sshbuf_get_u8(b, &rver)) != 0)
253 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 262 fatal("%s: buffer error: %s", __progname, ssh_err(r));
254 if (rver != version) 263 if (rver != version)
255 fatal("bad version: received %d, expected %d", rver, version); 264 fatal("bad version: received %d, expected %d", rver, version);
256 if ((r = sshbuf_get_u32(b, (u_int *)&fd)) != 0) 265 if ((r = sshbuf_get_u32(b, (u_int *)&fd)) != 0)
257 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 266 fatal("%s: buffer error: %s", __progname, ssh_err(r));
258 if (fd < 0 || fd == STDIN_FILENO || fd == STDOUT_FILENO) 267 if (fd < 0 || fd == STDIN_FILENO || fd == STDOUT_FILENO)
259 fatal("bad fd"); 268 fatal("bad fd");
260 if ((host = get_local_name(fd)) == NULL) 269 if ((host = get_local_name(fd)) == NULL)
261 fatal("cannot get local name for fd"); 270 fatal("cannot get local name for fd");
262 271
263 if ((r = sshbuf_get_string(b, &data, &dlen)) != 0) 272 if ((r = sshbuf_get_string(b, &data, &dlen)) != 0)
264 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 273 fatal("%s: buffer error: %s", __progname, ssh_err(r));
265 if (valid_request(pw, host, &key, data, dlen) < 0) 274 if (valid_request(pw, host, &key, data, dlen) < 0)
266 fatal("not a valid request"); 275 fatal("not a valid request");
267 free(host); 276 free(host);
@@ -277,7 +286,7 @@ main(int argc, char **argv)
277 if (!found) { 286 if (!found) {
278 if ((fp = sshkey_fingerprint(key, options.fingerprint_hash, 287 if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
279 SSH_FP_DEFAULT)) == NULL) 288 SSH_FP_DEFAULT)) == NULL)
280 fatal("%s: sshkey_fingerprint failed", __func__); 289 fatal("%s: sshkey_fingerprint failed", __progname);
281 fatal("no matching hostkey found for key %s %s", 290 fatal("no matching hostkey found for key %s %s",
282 sshkey_type(key), fp ? fp : ""); 291 sshkey_type(key), fp ? fp : "");
283 } 292 }
@@ -289,7 +298,7 @@ main(int argc, char **argv)
289 /* send reply */ 298 /* send reply */
290 sshbuf_reset(b); 299 sshbuf_reset(b);
291 if ((r = sshbuf_put_string(b, signature, slen)) != 0) 300 if ((r = sshbuf_put_string(b, signature, slen)) != 0)
292 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 301 fatal("%s: buffer error: %s", __progname, ssh_err(r));
293 if (ssh_msg_send(STDOUT_FILENO, version, b) == -1) 302 if (ssh_msg_send(STDOUT_FILENO, version, b) == -1)
294 fatal("ssh_msg_send failed"); 303 fatal("ssh_msg_send failed");
295 304