Context Navigation

source: trunk/third/openssh/monitor.c @ 18763

Visit:

Revision 18763, 41.6 KB checked in by zacheiss, 22 years ago (diff)
Merge openssh 3.5p1.

Line
1	/*
2	* Copyright 2002 Niels Provos <provos@citi.umich.edu>
3	* Copyright 2002 Markus Friedl <markus@openbsd.org>
4	* All rights reserved.
5	*
6	* Redistribution and use in source and binary forms, with or without
7	* modification, are permitted provided that the following conditions
8	* are met:
9	* 1. Redistributions of source code must retain the above copyright
10	* notice, this list of conditions and the following disclaimer.
11	* 2. Redistributions in binary form must reproduce the above copyright
12	* notice, this list of conditions and the following disclaimer in the
13	* documentation and/or other materials provided with the distribution.
14	*
15	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25	*/
26
27	#include "includes.h"
28	RCSID("$OpenBSD: monitor.c,v 1.29 2002/09/26 11:38:43 markus Exp $");
29
30	#include <openssl/dh.h>
31
32	#ifdef SKEY
33	#include <skey.h>
34	#endif
35
36	#include "ssh.h"
37	#include "auth.h"
38	#include "kex.h"
39	#include "dh.h"
40	#include "zlib.h"
41	#include "packet.h"
42	#include "auth-options.h"
43	#include "sshpty.h"
44	#include "channels.h"
45	#include "session.h"
46	#include "sshlogin.h"
47	#include "canohost.h"
48	#include "log.h"
49	#include "servconf.h"
50	#include "monitor.h"
51	#include "monitor_mm.h"
52	#include "monitor_wrap.h"
53	#include "monitor_fdpass.h"
54	#include "xmalloc.h"
55	#include "misc.h"
56	#include "buffer.h"
57	#include "bufaux.h"
58	#include "compat.h"
59	#include "ssh2.h"
60	#include "mpaux.h"
61
62	#ifdef GSSAPI
63	#include "ssh-gss.h"
64	static Gssctxt *gsscontext = NULL;
65	#endif
66
67	/* Imports */
68	extern ServerOptions options;
69	extern u_int utmp_len;
70	extern Newkeys *current_keys[];
71	extern z_stream incoming_stream;
72	extern z_stream outgoing_stream;
73	extern u_char session_id[];
74	extern Buffer input, output;
75	extern Buffer auth_debug;
76	extern int auth_debug_init;
77
78	/* State exported from the child */
79
80	struct {
81	z_stream incoming;
82	z_stream outgoing;
83	u_char *keyin;
84	u_int keyinlen;
85	u_char *keyout;
86	u_int keyoutlen;
87	u_char *ivin;
88	u_int ivinlen;
89	u_char *ivout;
90	u_int ivoutlen;
91	u_char *ssh1key;
92	u_int ssh1keylen;
93	int ssh1cipher;
94	int ssh1protoflags;
95	u_char *input;
96	u_int ilen;
97	u_char *output;
98	u_int olen;
99	} child_state;
100
101	/* Functions on the montior that answer unprivileged requests */
102
103	int mm_answer_moduli(int, Buffer *);
104	int mm_answer_sign(int, Buffer *);
105	int mm_answer_pwnamallow(int, Buffer *);
106	int mm_answer_auth2_read_banner(int, Buffer *);
107	int mm_answer_authserv(int, Buffer *);
108	int mm_answer_authpassword(int, Buffer *);
109	int mm_answer_bsdauthquery(int, Buffer *);
110	int mm_answer_bsdauthrespond(int, Buffer *);
111	int mm_answer_skeyquery(int, Buffer *);
112	int mm_answer_skeyrespond(int, Buffer *);
113	int mm_answer_keyallowed(int, Buffer *);
114	int mm_answer_keyverify(int, Buffer *);
115	int mm_answer_pty(int, Buffer *);
116	int mm_answer_pty_cleanup(int, Buffer *);
117	int mm_answer_term(int, Buffer *);
118	int mm_answer_rsa_keyallowed(int, Buffer *);
119	int mm_answer_rsa_challenge(int, Buffer *);
120	int mm_answer_rsa_response(int, Buffer *);
121	int mm_answer_sesskey(int, Buffer *);
122	int mm_answer_sessid(int, Buffer *);
123
124	#ifdef USE_PAM
125	int mm_answer_pam_start(int, Buffer *);
126	#endif
127
128	#ifdef KRB4
129	int mm_answer_krb4(int, Buffer *);
130	#endif
131	#ifdef KRB5
132	int mm_answer_krb5(int, Buffer *);
133	#endif
134
135	#ifdef GSSAPI
136	int mm_answer_gss_setup_ctx(int, Buffer *);
137	int mm_answer_gss_accept_ctx(int, Buffer *);
138	int mm_answer_gss_userok(int, Buffer *);
139	int mm_answer_gss_sign(int, Buffer *);
140	#endif
141
142	static Authctxt *authctxt;
143	static BIGNUM ssh1_challenge = NULL; / used for ssh1 rsa auth */
144
145	/* local state for key verify */
146	static u_char *key_blob = NULL;
147	static u_int key_bloblen = 0;
148	static int key_blobtype = MM_NOKEY;
149	static char *hostbased_cuser = NULL;
150	static char *hostbased_chost = NULL;
151	static char *auth_method = "unknown";
152	static int session_id2_len = 0;
153	static u_char *session_id2 = NULL;
154
155	struct mon_table {
156	enum monitor_reqtype type;
157	int flags;
158	int (f)(int, Buffer );
159	};
160
161	#define MON_ISAUTH 0x0004 /* Required for Authentication */
162	#define MON_AUTHDECIDE 0x0008 /* Decides Authentication */
163	#define MON_ONCE 0x0010 /* Disable after calling */
164
165	#define MON_AUTH (MON_ISAUTH\|MON_AUTHDECIDE)
166
167	#define MON_PERMIT 0x1000 /* Request is permitted */
168
169	struct mon_table mon_dispatch_proto20[] = {
170	{MONITOR_REQ_MODULI, MON_ONCE, mm_answer_moduli},
171	{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
172	{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
173	{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
174	{MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
175	{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
176	#ifdef USE_PAM
177	{MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start},
178	#endif
179	#ifdef BSD_AUTH
180	{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
181	{MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH,mm_answer_bsdauthrespond},
182	#endif
183	#ifdef SKEY
184	{MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
185	{MONITOR_REQ_SKEYRESPOND, MON_AUTH, mm_answer_skeyrespond},
186	#endif
187	#ifdef GSSAPI
188	{MONITOR_REQ_GSSSETUP, MON_ISAUTH, mm_answer_gss_setup_ctx},
189	{MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
190	{MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign},
191	{MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
192	#endif
193	{MONITOR_REQ_KEYALLOWED, MON_ISAUTH, mm_answer_keyallowed},
194	{MONITOR_REQ_KEYVERIFY, MON_AUTH, mm_answer_keyverify},
195	{0, 0, NULL}
196	};
197
198	struct mon_table mon_dispatch_postauth20[] = {
199	#ifdef GSSAPI
200	{MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx},
201	{MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
202	{MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign},
203	#endif
204	{MONITOR_REQ_MODULI, 0, mm_answer_moduli},
205	{MONITOR_REQ_SIGN, 0, mm_answer_sign},
206	{MONITOR_REQ_PTY, 0, mm_answer_pty},
207	{MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
208	{MONITOR_REQ_TERM, 0, mm_answer_term},
209	{0, 0, NULL}
210	};
211
212	struct mon_table mon_dispatch_proto15[] = {
213	{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
214	{MONITOR_REQ_SESSKEY, MON_ONCE, mm_answer_sesskey},
215	{MONITOR_REQ_SESSID, MON_ONCE, mm_answer_sessid},
216	{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
217	{MONITOR_REQ_RSAKEYALLOWED, MON_ISAUTH, mm_answer_rsa_keyallowed},
218	{MONITOR_REQ_KEYALLOWED, MON_ISAUTH, mm_answer_keyallowed},
219	{MONITOR_REQ_RSACHALLENGE, MON_ONCE, mm_answer_rsa_challenge},
220	{MONITOR_REQ_RSARESPONSE, MON_ONCE\|MON_AUTHDECIDE, mm_answer_rsa_response},
221	#ifdef BSD_AUTH
222	{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
223	{MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH,mm_answer_bsdauthrespond},
224	#endif
225	#ifdef SKEY
226	{MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
227	{MONITOR_REQ_SKEYRESPOND, MON_AUTH, mm_answer_skeyrespond},
228	#endif
229	#ifdef USE_PAM
230	{MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start},
231	#endif
232	#ifdef KRB4
233	{MONITOR_REQ_KRB4, MON_ONCE\|MON_AUTH, mm_answer_krb4},
234	#endif
235	#ifdef KRB5
236	{MONITOR_REQ_KRB5, MON_ONCE\|MON_AUTH, mm_answer_krb5},
237	#endif
238	{0, 0, NULL}
239	};
240
241	struct mon_table mon_dispatch_postauth15[] = {
242	{MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
243	{MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
244	{MONITOR_REQ_TERM, 0, mm_answer_term},
245	{0, 0, NULL}
246	};
247
248	struct mon_table *mon_dispatch;
249
250	/* Specifies if a certain message is allowed at the moment */
251
252	static void
253	monitor_permit(struct mon_table *ent, enum monitor_reqtype type, int permit)
254	{
255	while (ent->f != NULL) {
256	if (ent->type == type) {
257	ent->flags &= ~MON_PERMIT;
258	ent->flags \|= permit ? MON_PERMIT : 0;
259	return;
260	}
261	ent++;
262	}
263	}
264
265	static void
266	monitor_permit_authentications(int permit)
267	{
268	struct mon_table *ent = mon_dispatch;
269
270	while (ent->f != NULL) {
271	if (ent->flags & MON_AUTH) {
272	ent->flags &= ~MON_PERMIT;
273	ent->flags \|= permit ? MON_PERMIT : 0;
274	}
275	ent++;
276	}
277	}
278
279	Authctxt *
280	monitor_child_preauth(struct monitor *pmonitor)
281	{
282	struct mon_table *ent;
283	int authenticated = 0;
284
285	debug3("preauth child monitor started");
286
287	if (compat20) {
288	mon_dispatch = mon_dispatch_proto20;
289
290	/* Permit requests for moduli and signatures */
291	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
292	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
293	#ifdef GSSAPI
294	/* and for the GSSAPI key exchange */
295	monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
296	monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 1);
297	monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1);
298	#endif
299	} else {
300	mon_dispatch = mon_dispatch_proto15;
301
302	monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1);
303	}
304
305	authctxt = authctxt_new();
306
307	/* The first few requests do not require asynchronous access */
308	while (!authenticated) {
309	authenticated = monitor_read(pmonitor, mon_dispatch, &ent);
310	if (authenticated) {
311	if (!(ent->flags & MON_AUTHDECIDE))
312	fatal("%s: unexpected authentication from %d",
313	__func__, ent->type);
314	if (authctxt->pw->pw_uid == 0 &&
315	!auth_root_allowed(auth_method))
316	authenticated = 0;
317	#ifdef USE_PAM
318	if (!do_pam_account(authctxt->pw->pw_name, NULL))
319	authenticated = 0;
320	#endif
321	}
322
323	if (ent->flags & MON_AUTHDECIDE) {
324	auth_log(authctxt, authenticated, auth_method,
325	compat20 ? " ssh2" : "");
326	if (!authenticated)
327	authctxt->failures++;
328	}
329	}
330
331	if (!authctxt->valid)
332	fatal("%s: authenticated invalid user", __func__);
333
334	debug("%s: %s has been authenticated by privileged process",
335	__func__, authctxt->user);
336
337	mm_get_keystate(pmonitor);
338
339	return (authctxt);
340	}
341
342	void
343	monitor_child_postauth(struct monitor *pmonitor)
344	{
345	if (compat20) {
346	mon_dispatch = mon_dispatch_postauth20;
347
348	/* Permit requests for moduli and signatures */
349	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
350	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
351	monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
352
353	} else {
354	mon_dispatch = mon_dispatch_postauth15;
355	monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
356	}
357	if (!no_pty_flag) {
358	monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
359	monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1);
360	}
361
362	for (;;)
363	monitor_read(pmonitor, mon_dispatch, NULL);
364	}
365
366	void
367	monitor_sync(struct monitor *pmonitor)
368	{
369	if (options.compression) {
370	/* The member allocation is not visible, so sync it */
371	mm_share_sync(&pmonitor->m_zlib, &pmonitor->m_zback);
372	}
373	}
374
375	int
376	monitor_read(struct monitor pmonitor, struct mon_table ent,
377	struct mon_table **pent)
378	{
379	Buffer m;
380	int ret;
381	u_char type;
382
383	buffer_init(&m);
384
385	mm_request_receive(pmonitor->m_sendfd, &m);
386	type = buffer_get_char(&m);
387
388	debug3("%s: checking request %d", __func__, type);
389
390	while (ent->f != NULL) {
391	if (ent->type == type)
392	break;
393	ent++;
394	}
395
396	if (ent->f != NULL) {
397	if (!(ent->flags & MON_PERMIT))
398	fatal("%s: unpermitted request %d", __func__,
399	type);
400	ret = (*ent->f)(pmonitor->m_sendfd, &m);
401	buffer_free(&m);
402
403	/* The child may use this request only once, disable it */
404	if (ent->flags & MON_ONCE) {
405	debug2("%s: %d used once, disabling now", __func__,
406	type);
407	ent->flags &= ~MON_PERMIT;
408	}
409
410	if (pent != NULL)
411	*pent = ent;
412
413	return ret;
414	}
415
416	fatal("%s: unsupported request: %d", __func__, type);
417
418	/* NOTREACHED */
419	return (-1);
420	}
421
422	/* allowed key state */
423	static int
424	monitor_allowed_key(u_char *blob, u_int bloblen)
425	{
426	/* make sure key is allowed */
427	if (key_blob == NULL \|\| key_bloblen != bloblen \|\|
428	memcmp(key_blob, blob, key_bloblen))
429	return (0);
430	return (1);
431	}
432
433	static void
434	monitor_reset_key_state(void)
435	{
436	/* reset state */
437	if (key_blob != NULL)
438	xfree(key_blob);
439	if (hostbased_cuser != NULL)
440	xfree(hostbased_cuser);
441	if (hostbased_chost != NULL)
442	xfree(hostbased_chost);
443	key_blob = NULL;
444	key_bloblen = 0;
445	key_blobtype = MM_NOKEY;
446	hostbased_cuser = NULL;
447	hostbased_chost = NULL;
448	}
449
450	int
451	mm_answer_moduli(int socket, Buffer *m)
452	{
453	DH *dh;
454	int min, want, max;
455
456	min = buffer_get_int(m);
457	want = buffer_get_int(m);
458	max = buffer_get_int(m);
459
460	debug3("%s: got parameters: %d %d %d",
461	__func__, min, want, max);
462	/* We need to check here, too, in case the child got corrupted */
463	if (max < min \|\| want < min \|\| max < want)
464	fatal("%s: bad parameters: %d %d %d",
465	__func__, min, want, max);
466
467	buffer_clear(m);
468
469	dh = choose_dh(min, want, max);
470	if (dh == NULL) {
471	buffer_put_char(m, 0);
472	return (0);
473	} else {
474	/* Send first bignum */
475	buffer_put_char(m, 1);
476	buffer_put_bignum2(m, dh->p);
477	buffer_put_bignum2(m, dh->g);
478
479	DH_free(dh);
480	}
481	mm_request_send(socket, MONITOR_ANS_MODULI, m);
482	return (0);
483	}
484
485	int
486	mm_answer_sign(int socket, Buffer *m)
487	{
488	Key *key;
489	u_char *p;
490	u_char *signature;
491	u_int siglen, datlen;
492	int keyid;
493
494	debug3("%s", __func__);
495
496	keyid = buffer_get_int(m);
497	p = buffer_get_string(m, &datlen);
498
499	if (datlen != 20)
500	fatal("%s: data length incorrect: %u", __func__, datlen);
501
502	/* save session id, it will be passed on the first call */
503	if (session_id2_len == 0) {
504	session_id2_len = datlen;
505	session_id2 = xmalloc(session_id2_len);
506	memcpy(session_id2, p, session_id2_len);
507	}
508
509	if ((key = get_hostkey_by_index(keyid)) == NULL)
510	fatal("%s: no hostkey from index %d", __func__, keyid);
511	if (key_sign(key, &signature, &siglen, p, datlen) < 0)
512	fatal("%s: key_sign failed", __func__);
513
514	debug3("%s: signature %p(%u)", __func__, signature, siglen);
515
516	buffer_clear(m);
517	buffer_put_string(m, signature, siglen);
518
519	xfree(p);
520	xfree(signature);
521
522	mm_request_send(socket, MONITOR_ANS_SIGN, m);
523
524	/* Turn on permissions for getpwnam */
525	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
526
527	return (0);
528	}
529
530	/* Retrieves the password entry and also checks if the user is permitted */
531
532	int
533	mm_answer_pwnamallow(int socket, Buffer *m)
534	{
535	char *login;
536	struct passwd *pwent;
537	int allowed = 0;
538
539	debug3("%s", __func__);
540
541	if (authctxt->attempt++ != 0)
542	fatal("%s: multiple attempts for getpwnam", __func__);
543
544	login = buffer_get_string(m, NULL);
545
546	pwent = getpwnamallow(login);
547
548	authctxt->user = xstrdup(login);
549	setproctitle("%s [priv]", pwent ? login : "unknown");
550	xfree(login);
551
552	buffer_clear(m);
553
554	if (pwent == NULL) {
555	buffer_put_char(m, 0);
556	goto out;
557	}
558
559	allowed = 1;
560	authctxt->pw = pwent;
561	authctxt->valid = 1;
562
563	buffer_put_char(m, 1);
564	buffer_put_string(m, pwent, sizeof(struct passwd));
565	buffer_put_cstring(m, pwent->pw_name);
566	buffer_put_cstring(m, "*");
567	buffer_put_cstring(m, pwent->pw_gecos);
568	#ifdef HAVE_PW_CLASS_IN_PASSWD
569	buffer_put_cstring(m, pwent->pw_class);
570	#endif
571	buffer_put_cstring(m, pwent->pw_dir);
572	buffer_put_cstring(m, pwent->pw_shell);
573
574	out:
575	debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed);
576	mm_request_send(socket, MONITOR_ANS_PWNAM, m);
577
578	/* For SSHv1 allow authentication now */
579	if (!compat20)
580	monitor_permit_authentications(1);
581	else {
582	/* Allow service/style information on the auth context */
583	monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
584	monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
585	}
586
587	#ifdef USE_PAM
588	monitor_permit(mon_dispatch, MONITOR_REQ_PAM_START, 1);
589	#endif
590
591	return (0);
592	}
593
594	int mm_answer_auth2_read_banner(int socket, Buffer *m)
595	{
596	char *banner;
597
598	buffer_clear(m);
599	banner = auth2_read_banner();
600	buffer_put_cstring(m, banner != NULL ? banner : "");
601	mm_request_send(socket, MONITOR_ANS_AUTH2_READ_BANNER, m);
602
603	if (banner != NULL)
604	xfree(banner);
605
606	return (0);
607	}
608
609	int
610	mm_answer_authserv(int socket, Buffer *m)
611	{
612	monitor_permit_authentications(1);
613
614	authctxt->service = buffer_get_string(m, NULL);
615	authctxt->style = buffer_get_string(m, NULL);
616	debug3("%s: service=%s, style=%s",
617	__func__, authctxt->service, authctxt->style);
618
619	if (strlen(authctxt->style) == 0) {
620	xfree(authctxt->style);
621	authctxt->style = NULL;
622	}
623
624	return (0);
625	}
626
627	int
628	mm_answer_authpassword(int socket, Buffer *m)
629	{
630	static int call_count;
631	char *passwd;
632	int authenticated;
633	u_int plen;
634
635	passwd = buffer_get_string(m, &plen);
636	/* Only authenticate if the context is valid */
637	authenticated = options.password_authentication &&
638	authctxt->valid && auth_password(authctxt, passwd);
639	memset(passwd, 0, strlen(passwd));
640	xfree(passwd);
641
642	buffer_clear(m);
643	buffer_put_int(m, authenticated);
644
645	debug3("%s: sending result %d", __func__, authenticated);
646	mm_request_send(socket, MONITOR_ANS_AUTHPASSWORD, m);
647
648	call_count++;
649	if (plen == 0 && call_count == 1)
650	auth_method = "none";
651	else
652	auth_method = "password";
653
654	/* Causes monitor loop to terminate if authenticated */
655	return (authenticated);
656	}
657
658	#ifdef BSD_AUTH
659	int
660	mm_answer_bsdauthquery(int socket, Buffer *m)
661	{
662	char name, infotxt;
663	u_int numprompts;
664	u_int *echo_on;
665	char **prompts;
666	int res;
667
668	res = bsdauth_query(authctxt, &name, &infotxt, &numprompts,
669	&prompts, &echo_on);
670
671	buffer_clear(m);
672	buffer_put_int(m, res);
673	if (res != -1)
674	buffer_put_cstring(m, prompts[0]);
675
676	debug3("%s: sending challenge res: %d", __func__, res);
677	mm_request_send(socket, MONITOR_ANS_BSDAUTHQUERY, m);
678
679	if (res != -1) {
680	xfree(name);
681	xfree(infotxt);
682	xfree(prompts);
683	xfree(echo_on);
684	}
685
686	return (0);
687	}
688
689	int
690	mm_answer_bsdauthrespond(int socket, Buffer *m)
691	{
692	char *response;
693	int authok;
694
695	if (authctxt->as == 0)
696	fatal("%s: no bsd auth session", __func__);
697
698	response = buffer_get_string(m, NULL);
699	authok = options.challenge_response_authentication &&
700	auth_userresponse(authctxt->as, response, 0);
701	authctxt->as = NULL;
702	debug3("%s: <%s> = <%d>", __func__, response, authok);
703	xfree(response);
704
705	buffer_clear(m);
706	buffer_put_int(m, authok);
707
708	debug3("%s: sending authenticated: %d", __func__, authok);
709	mm_request_send(socket, MONITOR_ANS_BSDAUTHRESPOND, m);
710
711	auth_method = "bsdauth";
712
713	return (authok != 0);
714	}
715	#endif
716
717	#ifdef SKEY
718	int
719	mm_answer_skeyquery(int socket, Buffer *m)
720	{
721	struct skey skey;
722	char challenge[1024];
723	int res;
724
725	res = skeychallenge(&skey, authctxt->user, challenge);
726
727	buffer_clear(m);
728	buffer_put_int(m, res);
729	if (res != -1)
730	buffer_put_cstring(m, challenge);
731
732	debug3("%s: sending challenge res: %d", __func__, res);
733	mm_request_send(socket, MONITOR_ANS_SKEYQUERY, m);
734
735	return (0);
736	}
737
738	int
739	mm_answer_skeyrespond(int socket, Buffer *m)
740	{
741	char *response;
742	int authok;
743
744	response = buffer_get_string(m, NULL);
745
746	authok = (options.challenge_response_authentication &&
747	authctxt->valid &&
748	skey_haskey(authctxt->pw->pw_name) == 0 &&
749	skey_passcheck(authctxt->pw->pw_name, response) != -1);
750
751	xfree(response);
752
753	buffer_clear(m);
754	buffer_put_int(m, authok);
755
756	debug3("%s: sending authenticated: %d", __func__, authok);
757	mm_request_send(socket, MONITOR_ANS_SKEYRESPOND, m);
758
759	auth_method = "skey";
760
761	return (authok != 0);
762	}
763	#endif
764
765	#ifdef USE_PAM
766	int
767	mm_answer_pam_start(int socket, Buffer *m)
768	{
769	char *user;
770
771	user = buffer_get_string(m, NULL);
772
773	start_pam(user);
774
775	xfree(user);
776
777	return (0);
778	}
779	#endif
780
781	static void
782	mm_append_debug(Buffer *m)
783	{
784	if (auth_debug_init && buffer_len(&auth_debug)) {
785	debug3("%s: Appending debug messages for child", __func__);
786	buffer_append(m, buffer_ptr(&auth_debug),
787	buffer_len(&auth_debug));
788	buffer_clear(&auth_debug);
789	}
790	}
791
792	int
793	mm_answer_keyallowed(int socket, Buffer *m)
794	{
795	Key *key;
796	char cuser, chost;
797	u_char *blob;
798	u_int bloblen;
799	enum mm_keytype type = 0;
800	int allowed = 0;
801
802	debug3("%s entering", __func__);
803
804	type = buffer_get_int(m);
805	cuser = buffer_get_string(m, NULL);
806	chost = buffer_get_string(m, NULL);
807	blob = buffer_get_string(m, &bloblen);
808
809	key = key_from_blob(blob, bloblen);
810
811	if ((compat20 && type == MM_RSAHOSTKEY) \|\|
812	(!compat20 && type != MM_RSAHOSTKEY))
813	fatal("%s: key type and protocol mismatch", __func__);
814
815	debug3("%s: key_from_blob: %p", __func__, key);
816
817	if (key != NULL && authctxt->pw != NULL) {
818	switch(type) {
819	case MM_USERKEY:
820	allowed = options.pubkey_authentication &&
821	user_key_allowed(authctxt->pw, key);
822	break;
823	case MM_HOSTKEY:
824	allowed = options.hostbased_authentication &&
825	hostbased_key_allowed(authctxt->pw,
826	cuser, chost, key);
827	break;
828	case MM_RSAHOSTKEY:
829	key->type = KEY_RSA1; /* XXX */
830	allowed = options.rhosts_rsa_authentication &&
831	auth_rhosts_rsa_key_allowed(authctxt->pw,
832	cuser, chost, key);
833	break;
834	default:
835	fatal("%s: unknown key type %d", __func__, type);
836	break;
837	}
838	key_free(key);
839	}
840
841	/* clear temporarily storage (used by verify) */
842	monitor_reset_key_state();
843
844	if (allowed) {
845	/* Save temporarily for comparison in verify */
846	key_blob = blob;
847	key_bloblen = bloblen;
848	key_blobtype = type;
849	hostbased_cuser = cuser;
850	hostbased_chost = chost;
851	}
852
853	debug3("%s: key %p is %s",
854	__func__, key, allowed ? "allowed" : "disallowed");
855
856	buffer_clear(m);
857	buffer_put_int(m, allowed);
858
859	mm_append_debug(m);
860
861	mm_request_send(socket, MONITOR_ANS_KEYALLOWED, m);
862
863	if (type == MM_RSAHOSTKEY)
864	monitor_permit(mon_dispatch, MONITOR_REQ_RSACHALLENGE, allowed);
865
866	return (0);
867	}
868
869	static int
870	monitor_valid_userblob(u_char *data, u_int datalen)
871	{
872	Buffer b;
873	char *p;
874	u_int len;
875	int fail = 0;
876
877	buffer_init(&b);
878	buffer_append(&b, data, datalen);
879
880	if (datafellows & SSH_OLD_SESSIONID) {
881	p = buffer_ptr(&b);
882	len = buffer_len(&b);
883	if ((session_id2 == NULL) \|\|
884	(len < session_id2_len) \|\|
885	(memcmp(p, session_id2, session_id2_len) != 0))
886	fail++;
887	buffer_consume(&b, session_id2_len);
888	} else {
889	p = buffer_get_string(&b, &len);
890	if ((session_id2 == NULL) \|\|
891	(len != session_id2_len) \|\|
892	(memcmp(p, session_id2, session_id2_len) != 0))
893	fail++;
894	xfree(p);
895	}
896	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
897	fail++;
898	p = buffer_get_string(&b, NULL);
899	if (strcmp(authctxt->user, p) != 0) {
900	log("wrong user name passed to monitor: expected %s != %.100s",
901	authctxt->user, p);
902	fail++;
903	}
904	xfree(p);
905	buffer_skip_string(&b);
906	if (datafellows & SSH_BUG_PKAUTH) {
907	if (!buffer_get_char(&b))
908	fail++;
909	} else {
910	p = buffer_get_string(&b, NULL);
911	if (strcmp("publickey", p) != 0)
912	fail++;
913	xfree(p);
914	if (!buffer_get_char(&b))
915	fail++;
916	buffer_skip_string(&b);
917	}
918	buffer_skip_string(&b);
919	if (buffer_len(&b) != 0)
920	fail++;
921	buffer_free(&b);
922	return (fail == 0);
923	}
924
925	static int
926	monitor_valid_hostbasedblob(u_char data, u_int datalen, char cuser,
927	char *chost)
928	{
929	Buffer b;
930	char *p;
931	u_int len;
932	int fail = 0;
933
934	buffer_init(&b);
935	buffer_append(&b, data, datalen);
936
937	p = buffer_get_string(&b, &len);
938	if ((session_id2 == NULL) \|\|
939	(len != session_id2_len) \|\|
940	(memcmp(p, session_id2, session_id2_len) != 0))
941	fail++;
942	xfree(p);
943
944	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
945	fail++;
946	p = buffer_get_string(&b, NULL);
947	if (strcmp(authctxt->user, p) != 0) {
948	log("wrong user name passed to monitor: expected %s != %.100s",
949	authctxt->user, p);
950	fail++;
951	}
952	xfree(p);
953	buffer_skip_string(&b); /* service */
954	p = buffer_get_string(&b, NULL);
955	if (strcmp(p, "hostbased") != 0)
956	fail++;
957	xfree(p);
958	buffer_skip_string(&b); /* pkalg */
959	buffer_skip_string(&b); /* pkblob */
960
961	/* verify client host, strip trailing dot if necessary */
962	p = buffer_get_string(&b, NULL);
963	if (((len = strlen(p)) > 0) && p[len - 1] == '.')
964	p[len - 1] = '\0';
965	if (strcmp(p, chost) != 0)
966	fail++;
967	xfree(p);
968
969	/* verify client user */
970	p = buffer_get_string(&b, NULL);
971	if (strcmp(p, cuser) != 0)
972	fail++;
973	xfree(p);
974
975	if (buffer_len(&b) != 0)
976	fail++;
977	buffer_free(&b);
978	return (fail == 0);
979	}
980
981	int
982	mm_answer_keyverify(int socket, Buffer *m)
983	{
984	Key *key;
985	u_char signature, data, *blob;
986	u_int signaturelen, datalen, bloblen;
987	int verified = 0;
988	int valid_data = 0;
989
990	blob = buffer_get_string(m, &bloblen);
991	signature = buffer_get_string(m, &signaturelen);
992	data = buffer_get_string(m, &datalen);
993
994	if (hostbased_cuser == NULL \|\| hostbased_chost == NULL \|\|
995	!monitor_allowed_key(blob, bloblen))
996	fatal("%s: bad key, not previously allowed", __func__);
997
998	key = key_from_blob(blob, bloblen);
999	if (key == NULL)
1000	fatal("%s: bad public key blob", __func__);
1001
1002	switch (key_blobtype) {
1003	case MM_USERKEY:
1004	valid_data = monitor_valid_userblob(data, datalen);
1005	break;
1006	case MM_HOSTKEY:
1007	valid_data = monitor_valid_hostbasedblob(data, datalen,
1008	hostbased_cuser, hostbased_chost);
1009	break;
1010	default:
1011	valid_data = 0;
1012	break;
1013	}
1014	if (!valid_data)
1015	fatal("%s: bad signature data blob", __func__);
1016
1017	verified = key_verify(key, signature, signaturelen, data, datalen);
1018	debug3("%s: key %p signature %s",
1019	__func__, key, verified ? "verified" : "unverified");
1020
1021	key_free(key);
1022	xfree(blob);
1023	xfree(signature);
1024	xfree(data);
1025
1026	auth_method = key_blobtype == MM_USERKEY ? "publickey" : "hostbased";
1027
1028	monitor_reset_key_state();
1029
1030	buffer_clear(m);
1031	buffer_put_int(m, verified);
1032	mm_request_send(socket, MONITOR_ANS_KEYVERIFY, m);
1033
1034	return (verified);
1035	}
1036
1037	static void
1038	mm_record_login(Session s, struct passwd pw)
1039	{
1040	socklen_t fromlen;
1041	struct sockaddr_storage from;
1042
1043	/*
1044	* Get IP address of client. If the connection is not a socket, let
1045	* the address be 0.0.0.0.
1046	*/
1047	memset(&from, 0, sizeof(from));
1048	fromlen = sizeof(from);
1049	if (packet_connection_is_on_socket()) {
1050	if (getpeername(packet_get_connection_in(),
1051	(struct sockaddr *) & from, &fromlen) < 0) {
1052	debug("getpeername: %.100s", strerror(errno));
1053	fatal_cleanup();
1054	}
1055	}
1056	/* Record that there was a login on that tty from the remote host. */
1057	record_login(s->pid, s->tty, pw->pw_name, pw->pw_uid,
1058	get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping),
1059	(struct sockaddr *)&from, fromlen);
1060	}
1061
1062	static void
1063	mm_session_close(Session *s)
1064	{
1065	debug3("%s: session %d pid %d", __func__, s->self, s->pid);
1066	if (s->ttyfd != -1) {
1067	debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
1068	fatal_remove_cleanup(session_pty_cleanup2, (void *)s);
1069	session_pty_cleanup2(s);
1070	}
1071	s->used = 0;
1072	}
1073
1074	int
1075	mm_answer_pty(int socket, Buffer *m)
1076	{
1077	extern struct monitor *pmonitor;
1078	Session *s;
1079	int res, fd0;
1080
1081	debug3("%s entering", __func__);
1082
1083	buffer_clear(m);
1084	s = session_new();
1085	if (s == NULL)
1086	goto error;
1087	s->authctxt = authctxt;
1088	s->pw = authctxt->pw;
1089	s->pid = pmonitor->m_pid;
1090	res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
1091	if (res == 0)
1092	goto error;
1093	fatal_add_cleanup(session_pty_cleanup2, (void *)s);
1094	pty_setowner(authctxt->pw, s->tty);
1095
1096	buffer_put_int(m, 1);
1097	buffer_put_cstring(m, s->tty);
1098	mm_request_send(socket, MONITOR_ANS_PTY, m);
1099
1100	mm_send_fd(socket, s->ptyfd);
1101	mm_send_fd(socket, s->ttyfd);
1102
1103	/* We need to trick ttyslot */
1104	if (dup2(s->ttyfd, 0) == -1)
1105	fatal("%s: dup2", __func__);
1106
1107	mm_record_login(s, authctxt->pw);
1108
1109	/* Now we can close the file descriptor again */
1110	close(0);
1111
1112	/* make sure nothing uses fd 0 */
1113	if ((fd0 = open(_PATH_DEVNULL, O_RDONLY)) < 0)
1114	fatal("%s: open(/dev/null): %s", __func__, strerror(errno));
1115	if (fd0 != 0)
1116	error("%s: fd0 %d != 0", __func__, fd0);
1117
1118	/* slave is not needed */
1119	close(s->ttyfd);
1120	s->ttyfd = s->ptyfd;
1121	/* no need to dup() because nobody closes ptyfd */
1122	s->ptymaster = s->ptyfd;
1123
1124	debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ttyfd);
1125
1126	return (0);
1127
1128	error:
1129	if (s != NULL)
1130	mm_session_close(s);
1131	buffer_put_int(m, 0);
1132	mm_request_send(socket, MONITOR_ANS_PTY, m);
1133	return (0);
1134	}
1135
1136	int
1137	mm_answer_pty_cleanup(int socket, Buffer *m)
1138	{
1139	Session *s;
1140	char *tty;
1141
1142	debug3("%s entering", __func__);
1143
1144	tty = buffer_get_string(m, NULL);
1145	if ((s = session_by_tty(tty)) != NULL)
1146	mm_session_close(s);
1147	buffer_clear(m);
1148	xfree(tty);
1149	return (0);
1150	}
1151
1152	int
1153	mm_answer_sesskey(int socket, Buffer *m)
1154	{
1155	BIGNUM *p;
1156	int rsafail;
1157
1158	/* Turn off permissions */
1159	monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1);
1160
1161	if ((p = BN_new()) == NULL)
1162	fatal("%s: BN_new", __func__);
1163
1164	buffer_get_bignum2(m, p);
1165
1166	rsafail = ssh1_session_key(p);
1167
1168	buffer_clear(m);
1169	buffer_put_int(m, rsafail);
1170	buffer_put_bignum2(m, p);
1171
1172	BN_clear_free(p);
1173
1174	mm_request_send(socket, MONITOR_ANS_SESSKEY, m);
1175
1176	/* Turn on permissions for sessid passing */
1177	monitor_permit(mon_dispatch, MONITOR_REQ_SESSID, 1);
1178
1179	return (0);
1180	}
1181
1182	int
1183	mm_answer_sessid(int socket, Buffer *m)
1184	{
1185	int i;
1186
1187	debug3("%s entering", __func__);
1188
1189	if (buffer_len(m) != 16)
1190	fatal("%s: bad ssh1 session id", __func__);
1191	for (i = 0; i < 16; i++)
1192	session_id[i] = buffer_get_char(m);
1193
1194	/* Turn on permissions for getpwnam */
1195	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
1196
1197	return (0);
1198	}
1199
1200	int
1201	mm_answer_rsa_keyallowed(int socket, Buffer *m)
1202	{
1203	BIGNUM *client_n;
1204	Key *key = NULL;
1205	u_char *blob = NULL;
1206	u_int blen = 0;
1207	int allowed = 0;
1208
1209	debug3("%s entering", __func__);
1210
1211	if (options.rsa_authentication && authctxt->valid) {
1212	if ((client_n = BN_new()) == NULL)
1213	fatal("%s: BN_new", __func__);
1214	buffer_get_bignum2(m, client_n);
1215	allowed = auth_rsa_key_allowed(authctxt->pw, client_n, &key);
1216	BN_clear_free(client_n);
1217	}
1218	buffer_clear(m);
1219	buffer_put_int(m, allowed);
1220
1221	/* clear temporarily storage (used by generate challenge) */
1222	monitor_reset_key_state();
1223
1224	if (allowed && key != NULL) {
1225	key->type = KEY_RSA; /* cheat for key_to_blob */
1226	if (key_to_blob(key, &blob, &blen) == 0)
1227	fatal("%s: key_to_blob failed", __func__);
1228	buffer_put_string(m, blob, blen);
1229
1230	/* Save temporarily for comparison in verify */
1231	key_blob = blob;
1232	key_bloblen = blen;
1233	key_blobtype = MM_RSAUSERKEY;
1234	key_free(key);
1235	}
1236
1237	mm_append_debug(m);
1238
1239	mm_request_send(socket, MONITOR_ANS_RSAKEYALLOWED, m);
1240
1241	monitor_permit(mon_dispatch, MONITOR_REQ_RSACHALLENGE, allowed);
1242	monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 0);
1243	return (0);
1244	}
1245
1246	int
1247	mm_answer_rsa_challenge(int socket, Buffer *m)
1248	{
1249	Key *key = NULL;
1250	u_char *blob;
1251	u_int blen;
1252
1253	debug3("%s entering", __func__);
1254
1255	if (!authctxt->valid)
1256	fatal("%s: authctxt not valid", __func__);
1257	blob = buffer_get_string(m, &blen);
1258	if (!monitor_allowed_key(blob, blen))
1259	fatal("%s: bad key, not previously allowed", __func__);
1260	if (key_blobtype != MM_RSAUSERKEY && key_blobtype != MM_RSAHOSTKEY)
1261	fatal("%s: key type mismatch", __func__);
1262	if ((key = key_from_blob(blob, blen)) == NULL)
1263	fatal("%s: received bad key", __func__);
1264
1265	if (ssh1_challenge)
1266	BN_clear_free(ssh1_challenge);
1267	ssh1_challenge = auth_rsa_generate_challenge(key);
1268
1269	buffer_clear(m);
1270	buffer_put_bignum2(m, ssh1_challenge);
1271
1272	debug3("%s sending reply", __func__);
1273	mm_request_send(socket, MONITOR_ANS_RSACHALLENGE, m);
1274
1275	monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1);
1276	return (0);
1277	}
1278
1279	int
1280	mm_answer_rsa_response(int socket, Buffer *m)
1281	{
1282	Key *key = NULL;
1283	u_char blob, response;
1284	u_int blen, len;
1285	int success;
1286
1287	debug3("%s entering", __func__);
1288
1289	if (!authctxt->valid)
1290	fatal("%s: authctxt not valid", __func__);
1291	if (ssh1_challenge == NULL)
1292	fatal("%s: no ssh1_challenge", __func__);
1293
1294	blob = buffer_get_string(m, &blen);
1295	if (!monitor_allowed_key(blob, blen))
1296	fatal("%s: bad key, not previously allowed", __func__);
1297	if (key_blobtype != MM_RSAUSERKEY && key_blobtype != MM_RSAHOSTKEY)
1298	fatal("%s: key type mismatch: %d", __func__, key_blobtype);
1299	if ((key = key_from_blob(blob, blen)) == NULL)
1300	fatal("%s: received bad key", __func__);
1301	response = buffer_get_string(m, &len);
1302	if (len != 16)
1303	fatal("%s: received bad response to challenge", __func__);
1304	success = auth_rsa_verify_response(key, ssh1_challenge, response);
1305
1306	key_free(key);
1307	xfree(response);
1308
1309	auth_method = key_blobtype == MM_RSAUSERKEY ? "rsa" : "rhosts-rsa";
1310
1311	/* reset state */
1312	BN_clear_free(ssh1_challenge);
1313	ssh1_challenge = NULL;
1314	monitor_reset_key_state();
1315
1316	buffer_clear(m);
1317	buffer_put_int(m, success);
1318	mm_request_send(socket, MONITOR_ANS_RSARESPONSE, m);
1319
1320	return (success);
1321	}
1322
1323	#ifdef KRB4
1324	int
1325	mm_answer_krb4(int socket, Buffer *m)
1326	{
1327	KTEXT_ST auth, reply;
1328	char client, p;
1329	int success;
1330	u_int alen;
1331
1332	reply.length = auth.length = 0;
1333
1334	p = buffer_get_string(m, &alen);
1335	if (alen >= MAX_KTXT_LEN)
1336	fatal("%s: auth too large", __func__);
1337	memcpy(auth.dat, p, alen);
1338	auth.length = alen;
1339	memset(p, 0, alen);
1340	xfree(p);
1341
1342	success = options.kerberos_authentication &&
1343	authctxt->valid &&
1344	auth_krb4(authctxt, &auth, &client, &reply);
1345
1346	memset(auth.dat, 0, alen);
1347	buffer_clear(m);
1348	buffer_put_int(m, success);
1349
1350	if (success) {
1351	buffer_put_cstring(m, client);
1352	buffer_put_string(m, reply.dat, reply.length);
1353	if (client)
1354	xfree(client);
1355	if (reply.length)
1356	memset(reply.dat, 0, reply.length);
1357	}
1358
1359	debug3("%s: sending result %d", __func__, success);
1360	mm_request_send(socket, MONITOR_ANS_KRB4, m);
1361
1362	auth_method = "kerberos";
1363
1364	/* Causes monitor loop to terminate if authenticated */
1365	return (success);
1366	}
1367	#endif
1368
1369	#ifdef KRB5
1370	int
1371	mm_answer_krb5(int socket, Buffer *m)
1372	{
1373	krb5_data tkt, reply;
1374	char *client_user;
1375	u_int len;
1376	int success;
1377
1378	/* use temporary var to avoid size issues on 64bit arch */
1379	tkt.data = buffer_get_string(m, &len);
1380	tkt.length = len;
1381
1382	success = options.kerberos_authentication &&
1383	authctxt->valid &&
1384	auth_krb5(authctxt, &tkt, &client_user, &reply);
1385
1386	if (tkt.length)
1387	xfree(tkt.data);
1388
1389	buffer_clear(m);
1390	buffer_put_int(m, success);
1391
1392	if (success) {
1393	buffer_put_cstring(m, client_user);
1394	buffer_put_string(m, reply.data, reply.length);
1395	if (client_user)
1396	xfree(client_user);
1397	if (reply.length)
1398	xfree(reply.data);
1399	}
1400	mm_request_send(socket, MONITOR_ANS_KRB5, m);
1401
1402	return success;
1403	}
1404	#endif
1405
1406	int
1407	mm_answer_term(int socket, Buffer *req)
1408	{
1409	extern struct monitor *pmonitor;
1410	int res, status;
1411
1412	debug3("%s: tearing down sessions", __func__);
1413
1414	/* The child is terminating */
1415	session_destroy_all(&mm_session_close);
1416
1417	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
1418	if (errno != EINTR)
1419	exit(1);
1420
1421	res = WIFEXITED(status) ? WEXITSTATUS(status) : 1;
1422
1423	/* Terminate process */
1424	exit (res);
1425	}
1426
1427	void
1428	monitor_apply_keystate(struct monitor *pmonitor)
1429	{
1430	if (compat20) {
1431	set_newkeys(MODE_IN);
1432	set_newkeys(MODE_OUT);
1433	} else {
1434	packet_set_protocol_flags(child_state.ssh1protoflags);
1435	packet_set_encryption_key(child_state.ssh1key,
1436	child_state.ssh1keylen, child_state.ssh1cipher);
1437	xfree(child_state.ssh1key);
1438	}
1439
1440	/* for rc4 and other stateful ciphers */
1441	packet_set_keycontext(MODE_OUT, child_state.keyout);
1442	xfree(child_state.keyout);
1443	packet_set_keycontext(MODE_IN, child_state.keyin);
1444	xfree(child_state.keyin);
1445
1446	if (!compat20) {
1447	packet_set_iv(MODE_OUT, child_state.ivout);
1448	xfree(child_state.ivout);
1449	packet_set_iv(MODE_IN, child_state.ivin);
1450	xfree(child_state.ivin);
1451	}
1452
1453	memcpy(&incoming_stream, &child_state.incoming,
1454	sizeof(incoming_stream));
1455	memcpy(&outgoing_stream, &child_state.outgoing,
1456	sizeof(outgoing_stream));
1457
1458	/* Update with new address */
1459	if (options.compression)
1460	mm_init_compression(pmonitor->m_zlib);
1461
1462	/* Network I/O buffers */
1463	/* XXX inefficient for large buffers, need: buffer_init_from_string */
1464	buffer_clear(&input);
1465	buffer_append(&input, child_state.input, child_state.ilen);
1466	memset(child_state.input, 0, child_state.ilen);
1467	xfree(child_state.input);
1468
1469	buffer_clear(&output);
1470	buffer_append(&output, child_state.output, child_state.olen);
1471	memset(child_state.output, 0, child_state.olen);
1472	xfree(child_state.output);
1473	}
1474
1475	static Kex *
1476	mm_get_kex(Buffer *m)
1477	{
1478	Kex *kex;
1479	void *blob;
1480	u_int bloblen;
1481
1482	kex = xmalloc(sizeof(*kex));
1483	memset(kex, 0, sizeof(*kex));
1484	kex->session_id = buffer_get_string(m, &kex->session_id_len);
1485	if ((session_id2 == NULL) \|\|
1486	(kex->session_id_len != session_id2_len) \|\|
1487	(memcmp(kex->session_id, session_id2, session_id2_len) != 0))
1488	fatal("mm_get_get: internal error: bad session id");
1489	kex->we_need = buffer_get_int(m);
1490	kex->server = 1;
1491	kex->hostkey_type = buffer_get_int(m);
1492	kex->kex_type = buffer_get_int(m);
1493	blob = buffer_get_string(m, &bloblen);
1494	buffer_init(&kex->my);
1495	buffer_append(&kex->my, blob, bloblen);
1496	xfree(blob);
1497	blob = buffer_get_string(m, &bloblen);
1498	buffer_init(&kex->peer);
1499	buffer_append(&kex->peer, blob, bloblen);
1500	xfree(blob);
1501	kex->done = 1;
1502	kex->flags = buffer_get_int(m);
1503	kex->client_version_string = buffer_get_string(m, NULL);
1504	kex->server_version_string = buffer_get_string(m, NULL);
1505	kex->load_host_key=&get_hostkey_by_type;
1506	kex->host_key_index=&get_hostkey_index;
1507
1508	return (kex);
1509	}
1510
1511	/* This function requries careful sanity checking */
1512
1513	void
1514	mm_get_keystate(struct monitor *pmonitor)
1515	{
1516	Buffer m;
1517	u_char blob, p;
1518	u_int bloblen, plen;
1519
1520	debug3("%s: Waiting for new keys", __func__);
1521
1522	buffer_init(&m);
1523	mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT, &m);
1524	if (!compat20) {
1525	child_state.ssh1protoflags = buffer_get_int(&m);
1526	child_state.ssh1cipher = buffer_get_int(&m);
1527	child_state.ssh1key = buffer_get_string(&m,
1528	&child_state.ssh1keylen);
1529	child_state.ivout = buffer_get_string(&m,
1530	&child_state.ivoutlen);
1531	child_state.ivin = buffer_get_string(&m, &child_state.ivinlen);
1532	goto skip;
1533	} else {
1534	/* Get the Kex for rekeying */
1535	*pmonitor->m_pkex = mm_get_kex(&m);
1536	}
1537
1538	blob = buffer_get_string(&m, &bloblen);
1539	current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
1540	xfree(blob);
1541
1542	debug3("%s: Waiting for second key", __func__);
1543	blob = buffer_get_string(&m, &bloblen);
1544	current_keys[MODE_IN] = mm_newkeys_from_blob(blob, bloblen);
1545	xfree(blob);
1546
1547	/* Now get sequence numbers for the packets */
1548	packet_set_seqnr(MODE_OUT, buffer_get_int(&m));
1549	packet_set_seqnr(MODE_IN, buffer_get_int(&m));
1550
1551	skip:
1552	/* Get the key context */
1553	child_state.keyout = buffer_get_string(&m, &child_state.keyoutlen);
1554	child_state.keyin = buffer_get_string(&m, &child_state.keyinlen);
1555
1556	debug3("%s: Getting compression state", __func__);
1557	/* Get compression state */
1558	p = buffer_get_string(&m, &plen);
1559	if (plen != sizeof(child_state.outgoing))
1560	fatal("%s: bad request size", __func__);
1561	memcpy(&child_state.outgoing, p, sizeof(child_state.outgoing));
1562	xfree(p);
1563
1564	p = buffer_get_string(&m, &plen);
1565	if (plen != sizeof(child_state.incoming))
1566	fatal("%s: bad request size", __func__);
1567	memcpy(&child_state.incoming, p, sizeof(child_state.incoming));
1568	xfree(p);
1569
1570	/* Network I/O buffers */
1571	debug3("%s: Getting Network I/O buffers", __func__);
1572	child_state.input = buffer_get_string(&m, &child_state.ilen);
1573	child_state.output = buffer_get_string(&m, &child_state.olen);
1574
1575	buffer_free(&m);
1576	}
1577
1578
1579	/* Allocation functions for zlib */
1580	void *
1581	mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
1582	{
1583	size_t len = size * ncount;
1584	void *address;
1585
1586	if (len == 0 \|\| ncount > SIZE_T_MAX / size)
1587	fatal("%s: mm_zalloc(%u, %u)", __func__, ncount, size);
1588
1589	address = mm_malloc(mm, len);
1590
1591	return (address);
1592	}
1593
1594	void
1595	mm_zfree(struct mm_master mm, void address)
1596	{
1597	mm_free(mm, address);
1598	}
1599
1600	void
1601	mm_init_compression(struct mm_master *mm)
1602	{
1603	outgoing_stream.zalloc = (alloc_func)mm_zalloc;
1604	outgoing_stream.zfree = (free_func)mm_zfree;
1605	outgoing_stream.opaque = mm;
1606
1607	incoming_stream.zalloc = (alloc_func)mm_zalloc;
1608	incoming_stream.zfree = (free_func)mm_zfree;
1609	incoming_stream.opaque = mm;
1610	}
1611
1612	/* XXX */
1613
1614	#define FD_CLOSEONEXEC(x) do { \
1615	if (fcntl(x, F_SETFD, 1) == -1) \
1616	fatal("fcntl(%d, F_SETFD)", x); \
1617	} while (0)
1618
1619	static void
1620	monitor_socketpair(int *pair)
1621	{
1622	#ifdef HAVE_SOCKETPAIR
1623	if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1)
1624	fatal("%s: socketpair", __func__);
1625	#else
1626	fatal("%s: UsePrivilegeSeparation=yes not supported",
1627	__func__);
1628	#endif
1629	FD_CLOSEONEXEC(pair[0]);
1630	FD_CLOSEONEXEC(pair[1]);
1631	}
1632
1633	#define MM_MEMSIZE 65536
1634
1635	struct monitor *
1636	monitor_init(void)
1637	{
1638	struct monitor *mon;
1639	int pair[2];
1640
1641	mon = xmalloc(sizeof(*mon));
1642
1643	monitor_socketpair(pair);
1644
1645	mon->m_recvfd = pair[0];
1646	mon->m_sendfd = pair[1];
1647
1648	/* Used to share zlib space across processes */
1649	if (options.compression) {
1650	mon->m_zback = mm_create(NULL, MM_MEMSIZE);
1651	mon->m_zlib = mm_create(mon->m_zback, 20 * MM_MEMSIZE);
1652
1653	/* Compression needs to share state across borders */
1654	mm_init_compression(mon->m_zlib);
1655	}
1656
1657	return mon;
1658	}
1659
1660	void
1661	monitor_reinit(struct monitor *mon)
1662	{
1663	int pair[2];
1664
1665	monitor_socketpair(pair);
1666
1667	mon->m_recvfd = pair[0];
1668	mon->m_sendfd = pair[1];
1669	}
1670
1671	#ifdef GSSAPI
1672
1673	int
1674	mm_answer_gss_setup_ctx(int socket, Buffer *m) {
1675	gss_OID_desc oid;
1676	OM_uint32 major;
1677
1678	oid.elements=buffer_get_string(m,&oid.length);
1679
1680	major=ssh_gssapi_server_ctx(&gsscontext,&oid);
1681
1682	xfree(oid.elements);
1683
1684	buffer_clear(m);
1685	buffer_put_int(m,major);
1686
1687	mm_request_send(socket,MONITOR_ANS_GSSSETUP,m);
1688
1689	return(0);
1690	}
1691
1692	int
1693	mm_answer_gss_accept_ctx(int socket, Buffer *m) {
1694	gss_buffer_desc in,out;
1695	OM_uint32 major,minor;
1696	OM_uint32 flags = 0; /* GSI needs this */
1697
1698	in.value = buffer_get_string(m,&in.length);
1699	major=ssh_gssapi_accept_ctx(gsscontext,&in,&out,&flags);
1700	xfree(in.value);
1701
1702	buffer_clear(m);
1703	buffer_put_int(m, major);
1704	buffer_put_string(m, out.value, out.length);
1705	buffer_put_int(m, flags);
1706	mm_request_send(socket,MONITOR_ANS_GSSSTEP,m);
1707
1708	gss_release_buffer(&minor, &out);
1709
1710	return(0);
1711	}
1712	int
1713	mm_answer_gss_userok(int socket, Buffer *m) {
1714	int authenticated;
1715
1716	authenticated = authctxt->valid && ssh_gssapi_userok(authctxt);
1717
1718	buffer_clear(m);
1719	buffer_put_int(m, authenticated);
1720
1721	debug3("%s: sending result %d", __func__, authenticated);
1722	mm_request_send(socket, MONITOR_ANS_GSSUSEROK, m);
1723
1724	auth_method="gssapi";
1725
1726	/* Monitor loop will terminate if authenticated */
1727	return(authenticated);
1728	}
1729	int
1730	mm_answer_gss_sign(int socket, Buffer *m) {
1731	gss_buffer_desc data,hash;
1732	OM_uint32 major,minor;
1733
1734	data.value = buffer_get_string(m,&data.length);
1735	if (data.length != 20)
1736	fatal("%s: data length incorrect: %d", __func__, data.length);
1737
1738	/* Save the session ID - only first time round */
1739	if (session_id2_len == 0) {
1740	session_id2_len=data.length;
1741	session_id2 = xmalloc(session_id2_len);
1742	memcpy(session_id2, data.value, session_id2_len);
1743	}
1744	major=ssh_gssapi_sign(gsscontext, &data, &hash);
1745
1746	xfree(data.value);
1747
1748	buffer_clear(m);
1749	buffer_put_int(m, major);
1750	buffer_put_string(m, hash.value, hash.length);
1751
1752	mm_request_send(socket,MONITOR_ANS_GSSSIGN,m);
1753
1754	gss_release_buffer(&minor,&hash);
1755
1756	/* Turn on permissions for getpwnam */
1757	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
1758
1759	return(0);
1760	}
1761
1762	#endif /* GSSAPI */

Note: See TracBrowser for help on using the repository browser.

Download in other formats: