1 /* $OpenBSD: monitor_wrap.c,v 1.138 2024/10/22 06:13:00 dtucker Exp $ */ 2 /* 3 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 4 * Copyright 2002 Markus Friedl <markus@openbsd.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/types.h> 29 #include <sys/uio.h> 30 #include <sys/queue.h> 31 #include <sys/wait.h> 32 33 #include <errno.h> 34 #include <pwd.h> 35 #include <signal.h> 36 #include <stdio.h> 37 #include <string.h> 38 #include <stdarg.h> 39 #include <unistd.h> 40 41 #ifdef WITH_OPENSSL 42 #include <openssl/bn.h> 43 #include <openssl/dh.h> 44 #endif 45 46 #include "xmalloc.h" 47 #include "ssh.h" 48 #ifdef WITH_OPENSSL 49 #include "dh.h" 50 #endif 51 #include "sshbuf.h" 52 #include "sshkey.h" 53 #include "cipher.h" 54 #include "kex.h" 55 #include "hostfile.h" 56 #include "auth.h" 57 #include "auth-options.h" 58 #include "packet.h" 59 #include "mac.h" 60 #include "log.h" 61 #include "monitor.h" 62 #ifdef GSSAPI 63 #include "ssh-gss.h" 64 #endif 65 #include "atomicio.h" 66 #include "monitor_fdpass.h" 67 #include "misc.h" 68 69 #include "channels.h" 70 #include "session.h" 71 #include "servconf.h" 72 #include "monitor_wrap.h" 73 #include "srclimit.h" 74 75 #include "ssherr.h" 76 77 /* Imports */ 78 extern struct monitor *pmonitor; 79 extern struct sshbuf *loginmsg; 80 extern ServerOptions options; 81 82 void 83 mm_log_handler(LogLevel level, int forced, const char *msg, void *ctx) 84 { 85 struct sshbuf *log_msg; 86 struct monitor *mon = (struct monitor *)ctx; 87 int r; 88 size_t len; 89 90 if (mon->m_log_sendfd == -1) 91 fatal_f("no log channel"); 92 93 if ((log_msg = sshbuf_new()) == NULL) 94 fatal_f("sshbuf_new failed"); 95 96 if ((r = sshbuf_put_u32(log_msg, 0)) != 0 || /* length; filled below */ 97 (r = sshbuf_put_u32(log_msg, level)) != 0 || 98 (r = sshbuf_put_u32(log_msg, forced)) != 0 || 99 (r = sshbuf_put_cstring(log_msg, msg)) != 0) 100 fatal_fr(r, "assemble"); 101 if ((len = sshbuf_len(log_msg)) < 4 || len > 0xffffffff) 102 fatal_f("bad length %zu", len); 103 POKE_U32(sshbuf_mutable_ptr(log_msg), len - 4); 104 if (atomicio(vwrite, mon->m_log_sendfd, 105 sshbuf_mutable_ptr(log_msg), len) != len) 106 fatal_f("write: %s", strerror(errno)); 107 sshbuf_free(log_msg); 108 } 109 110 static void 111 mm_reap(void) 112 { 113 int status = -1; 114 115 if (!mm_is_monitor()) 116 return; 117 while (waitpid(pmonitor->m_pid, &status, 0) == -1) { 118 if (errno == EINTR) 119 continue; 120 pmonitor->m_pid = -1; 121 fatal_f("waitpid: %s", strerror(errno)); 122 } 123 if (WIFEXITED(status)) { 124 if (WEXITSTATUS(status) != 0) { 125 debug_f("preauth child exited with status %d", 126 WEXITSTATUS(status)); 127 cleanup_exit(255); 128 } 129 } else if (WIFSIGNALED(status)) { 130 error_f("preauth child terminated by signal %d", 131 WTERMSIG(status)); 132 cleanup_exit(signal_is_crash(WTERMSIG(status)) ? 133 EXIT_CHILD_CRASH : 255); 134 } else { 135 error_f("preauth child terminated abnormally (status=0x%x)", 136 status); 137 cleanup_exit(EXIT_CHILD_CRASH); 138 } 139 } 140 141 void 142 mm_request_send(int sock, enum monitor_reqtype type, struct sshbuf *m) 143 { 144 size_t mlen = sshbuf_len(m); 145 u_char buf[5]; 146 147 debug3_f("entering, type %d", type); 148 149 if (mlen >= 0xffffffff) 150 fatal_f("bad length %zu", mlen); 151 POKE_U32(buf, mlen + 1); 152 buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */ 153 if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf) || 154 atomicio(vwrite, sock, sshbuf_mutable_ptr(m), mlen) != mlen) { 155 if (errno == EPIPE) { 156 debug3_f("monitor fd closed"); 157 mm_reap(); 158 cleanup_exit(255); 159 } 160 fatal_f("write: %s", strerror(errno)); 161 } 162 } 163 164 void 165 mm_request_receive(int sock, struct sshbuf *m) 166 { 167 u_char buf[4], *p = NULL; 168 u_int msg_len; 169 int oerrno, r; 170 171 debug3_f("entering"); 172 173 if (atomicio(read, sock, buf, sizeof(buf)) != sizeof(buf)) { 174 if (errno == EPIPE) { 175 debug3_f("monitor fd closed"); 176 mm_reap(); 177 cleanup_exit(255); 178 } 179 fatal_f("read: %s", strerror(errno)); 180 } 181 msg_len = PEEK_U32(buf); 182 if (msg_len > 256 * 1024) 183 fatal_f("read: bad msg_len %d", msg_len); 184 sshbuf_reset(m); 185 if ((r = sshbuf_reserve(m, msg_len, &p)) != 0) 186 fatal_fr(r, "reserve"); 187 if (atomicio(read, sock, p, msg_len) != msg_len) { 188 oerrno = errno; 189 error_f("read: %s", strerror(errno)); 190 if (oerrno == EPIPE) 191 mm_reap(); 192 cleanup_exit(255); 193 } 194 } 195 196 void 197 mm_request_receive_expect(int sock, enum monitor_reqtype type, struct sshbuf *m) 198 { 199 u_char rtype; 200 int r; 201 202 debug3_f("entering, type %d", type); 203 204 mm_request_receive(sock, m); 205 if ((r = sshbuf_get_u8(m, &rtype)) != 0) 206 fatal_fr(r, "parse"); 207 if (rtype != type) 208 fatal_f("read: rtype %d != type %d", rtype, type); 209 } 210 211 #ifdef WITH_OPENSSL 212 DH * 213 mm_choose_dh(int min, int nbits, int max) 214 { 215 BIGNUM *p, *g; 216 int r; 217 u_char success = 0; 218 struct sshbuf *m; 219 220 if ((m = sshbuf_new()) == NULL) 221 fatal_f("sshbuf_new failed"); 222 if ((r = sshbuf_put_u32(m, min)) != 0 || 223 (r = sshbuf_put_u32(m, nbits)) != 0 || 224 (r = sshbuf_put_u32(m, max)) != 0) 225 fatal_fr(r, "assemble"); 226 227 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_MODULI, m); 228 229 debug3_f("waiting for MONITOR_ANS_MODULI"); 230 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_MODULI, m); 231 232 if ((r = sshbuf_get_u8(m, &success)) != 0) 233 fatal_fr(r, "parse success"); 234 if (success == 0) 235 fatal_f("MONITOR_ANS_MODULI failed"); 236 237 if ((r = sshbuf_get_bignum2(m, &p)) != 0 || 238 (r = sshbuf_get_bignum2(m, &g)) != 0) 239 fatal_fr(r, "parse group"); 240 241 debug3_f("remaining %zu", sshbuf_len(m)); 242 sshbuf_free(m); 243 244 return (dh_new_group(g, p)); 245 } 246 #endif 247 248 int 249 mm_sshkey_sign(struct ssh *ssh, struct sshkey *key, u_char **sigp, size_t *lenp, 250 const u_char *data, size_t datalen, const char *hostkey_alg, 251 const char *sk_provider, const char *sk_pin, u_int compat) 252 { 253 struct sshbuf *m; 254 int r; 255 256 debug3_f("entering"); 257 if ((m = sshbuf_new()) == NULL) 258 fatal_f("sshbuf_new failed"); 259 if ((r = sshkey_puts(key, m)) != 0 || 260 (r = sshbuf_put_string(m, data, datalen)) != 0 || 261 (r = sshbuf_put_cstring(m, hostkey_alg)) != 0 || 262 (r = sshbuf_put_u32(m, compat)) != 0) 263 fatal_fr(r, "assemble"); 264 265 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, m); 266 267 debug3_f("waiting for MONITOR_ANS_SIGN"); 268 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SIGN, m); 269 if ((r = sshbuf_get_string(m, sigp, lenp)) != 0) 270 fatal_fr(r, "parse"); 271 sshbuf_free(m); 272 debug3_f("%s signature len=%zu", hostkey_alg ? hostkey_alg : "(null)", 273 *lenp); 274 275 return (0); 276 } 277 278 void 279 mm_decode_activate_server_options(struct ssh *ssh, struct sshbuf *m) 280 { 281 const u_char *p; 282 size_t len; 283 u_int i; 284 ServerOptions *newopts; 285 int r; 286 287 if ((r = sshbuf_get_string_direct(m, &p, &len)) != 0) 288 fatal_fr(r, "parse opts"); 289 if (len != sizeof(*newopts)) 290 fatal_f("option block size mismatch"); 291 newopts = xcalloc(sizeof(*newopts), 1); 292 memcpy(newopts, p, sizeof(*newopts)); 293 294 #define M_CP_STROPT(x) do { \ 295 if (newopts->x != NULL && \ 296 (r = sshbuf_get_cstring(m, &newopts->x, NULL)) != 0) \ 297 fatal_fr(r, "parse %s", #x); \ 298 } while (0) 299 #define M_CP_STRARRAYOPT(x, nx) do { \ 300 newopts->x = newopts->nx == 0 ? \ 301 NULL : xcalloc(newopts->nx, sizeof(*newopts->x)); \ 302 for (i = 0; i < newopts->nx; i++) { \ 303 if ((r = sshbuf_get_cstring(m, \ 304 &newopts->x[i], NULL)) != 0) \ 305 fatal_fr(r, "parse %s", #x); \ 306 } \ 307 } while (0) 308 /* See comment in servconf.h */ 309 COPY_MATCH_STRING_OPTS(); 310 #undef M_CP_STROPT 311 #undef M_CP_STRARRAYOPT 312 313 copy_set_server_options(&options, newopts, 1); 314 log_change_level(options.log_level); 315 log_verbose_reset(); 316 for (i = 0; i < options.num_log_verbose; i++) 317 log_verbose_add(options.log_verbose[i]); 318 free(newopts); 319 } 320 321 #define GETPW(b, id) \ 322 do { \ 323 if ((r = sshbuf_get_string_direct(b, &p, &len)) != 0) \ 324 fatal_fr(r, "parse pw %s", #id); \ 325 if (len != sizeof(pw->id)) \ 326 fatal_fr(r, "bad length for %s", #id); \ 327 memcpy(&pw->id, p, len); \ 328 } while (0) 329 330 struct passwd * 331 mm_getpwnamallow(struct ssh *ssh, const char *username) 332 { 333 struct sshbuf *m; 334 struct passwd *pw; 335 size_t len; 336 int r; 337 u_char ok; 338 const u_char *p; 339 340 debug3_f("entering"); 341 342 if ((m = sshbuf_new()) == NULL) 343 fatal_f("sshbuf_new failed"); 344 if ((r = sshbuf_put_cstring(m, username)) != 0) 345 fatal_fr(r, "assemble"); 346 347 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, m); 348 349 debug3_f("waiting for MONITOR_ANS_PWNAM"); 350 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, m); 351 352 if ((r = sshbuf_get_u8(m, &ok)) != 0) 353 fatal_fr(r, "parse success"); 354 if (ok == 0) { 355 pw = NULL; 356 goto out; 357 } 358 359 pw = xcalloc(sizeof(*pw), 1); 360 GETPW(m, pw_uid); 361 GETPW(m, pw_gid); 362 GETPW(m, pw_change); 363 GETPW(m, pw_expire); 364 if ((r = sshbuf_get_cstring(m, &pw->pw_name, NULL)) != 0 || 365 (r = sshbuf_get_cstring(m, &pw->pw_passwd, NULL)) != 0 || 366 (r = sshbuf_get_cstring(m, &pw->pw_gecos, NULL)) != 0 || 367 (r = sshbuf_get_cstring(m, &pw->pw_class, NULL)) != 0 || 368 (r = sshbuf_get_cstring(m, &pw->pw_dir, NULL)) != 0 || 369 (r = sshbuf_get_cstring(m, &pw->pw_shell, NULL)) != 0) 370 fatal_fr(r, "parse pw"); 371 372 out: 373 /* copy options block as a Match directive may have changed some */ 374 mm_decode_activate_server_options(ssh, m); 375 server_process_permitopen(ssh); 376 server_process_channel_timeouts(ssh); 377 kex_set_server_sig_algs(ssh, options.pubkey_accepted_algos); 378 sshbuf_free(m); 379 380 return (pw); 381 } 382 383 char * 384 mm_auth2_read_banner(void) 385 { 386 struct sshbuf *m; 387 char *banner; 388 int r; 389 390 debug3_f("entering"); 391 392 if ((m = sshbuf_new()) == NULL) 393 fatal_f("sshbuf_new failed"); 394 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, m); 395 sshbuf_reset(m); 396 397 mm_request_receive_expect(pmonitor->m_recvfd, 398 MONITOR_ANS_AUTH2_READ_BANNER, m); 399 if ((r = sshbuf_get_cstring(m, &banner, NULL)) != 0) 400 fatal_fr(r, "parse"); 401 sshbuf_free(m); 402 403 /* treat empty banner as missing banner */ 404 if (strlen(banner) == 0) { 405 free(banner); 406 banner = NULL; 407 } 408 return (banner); 409 } 410 411 /* Inform the privileged process about service and style */ 412 413 void 414 mm_inform_authserv(char *service, char *style) 415 { 416 struct sshbuf *m; 417 int r; 418 419 debug3_f("entering"); 420 421 if ((m = sshbuf_new()) == NULL) 422 fatal_f("sshbuf_new failed"); 423 if ((r = sshbuf_put_cstring(m, service)) != 0 || 424 (r = sshbuf_put_cstring(m, style ? style : "")) != 0) 425 fatal_fr(r, "assemble"); 426 427 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, m); 428 429 sshbuf_free(m); 430 } 431 432 /* Do the password authentication */ 433 int 434 mm_auth_password(struct ssh *ssh, char *password) 435 { 436 struct sshbuf *m; 437 int r, authenticated = 0; 438 439 debug3_f("entering"); 440 441 if ((m = sshbuf_new()) == NULL) 442 fatal_f("sshbuf_new failed"); 443 if ((r = sshbuf_put_cstring(m, password)) != 0) 444 fatal_fr(r, "assemble"); 445 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHPASSWORD, m); 446 447 debug3_f("waiting for MONITOR_ANS_AUTHPASSWORD"); 448 mm_request_receive_expect(pmonitor->m_recvfd, 449 MONITOR_ANS_AUTHPASSWORD, m); 450 451 if ((r = sshbuf_get_u32(m, &authenticated)) != 0) 452 fatal_fr(r, "parse"); 453 454 sshbuf_free(m); 455 456 debug3_f("user %sauthenticated", authenticated ? "" : "not "); 457 return (authenticated); 458 } 459 460 int 461 mm_user_key_allowed(struct ssh *ssh, struct passwd *pw, struct sshkey *key, 462 int pubkey_auth_attempt, struct sshauthopt **authoptp) 463 { 464 return (mm_key_allowed(MM_USERKEY, NULL, NULL, key, 465 pubkey_auth_attempt, authoptp)); 466 } 467 468 int 469 mm_hostbased_key_allowed(struct ssh *ssh, struct passwd *pw, 470 const char *user, const char *host, struct sshkey *key) 471 { 472 return (mm_key_allowed(MM_HOSTKEY, user, host, key, 0, NULL)); 473 } 474 475 int 476 mm_key_allowed(enum mm_keytype type, const char *user, const char *host, 477 struct sshkey *key, int pubkey_auth_attempt, struct sshauthopt **authoptp) 478 { 479 struct sshbuf *m; 480 int r, allowed = 0; 481 struct sshauthopt *opts = NULL; 482 483 debug3_f("entering"); 484 485 if (authoptp != NULL) 486 *authoptp = NULL; 487 488 if ((m = sshbuf_new()) == NULL) 489 fatal_f("sshbuf_new failed"); 490 if ((r = sshbuf_put_u32(m, type)) != 0 || 491 (r = sshbuf_put_cstring(m, user ? user : "")) != 0 || 492 (r = sshbuf_put_cstring(m, host ? host : "")) != 0 || 493 (r = sshkey_puts(key, m)) != 0 || 494 (r = sshbuf_put_u32(m, pubkey_auth_attempt)) != 0) 495 fatal_fr(r, "assemble"); 496 497 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, m); 498 499 debug3_f("waiting for MONITOR_ANS_KEYALLOWED"); 500 mm_request_receive_expect(pmonitor->m_recvfd, 501 MONITOR_ANS_KEYALLOWED, m); 502 503 if ((r = sshbuf_get_u32(m, &allowed)) != 0) 504 fatal_fr(r, "parse"); 505 if (allowed && type == MM_USERKEY && 506 (r = sshauthopt_deserialise(m, &opts)) != 0) 507 fatal_fr(r, "sshauthopt_deserialise"); 508 sshbuf_free(m); 509 510 if (authoptp != NULL) { 511 *authoptp = opts; 512 opts = NULL; 513 } 514 sshauthopt_free(opts); 515 516 return allowed; 517 } 518 519 /* 520 * This key verify needs to send the key type along, because the 521 * privileged parent makes the decision if the key is allowed 522 * for authentication. 523 */ 524 525 int 526 mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen, 527 const u_char *data, size_t datalen, const char *sigalg, u_int compat, 528 struct sshkey_sig_details **sig_detailsp) 529 { 530 struct sshbuf *m; 531 u_int encoded_ret = 0; 532 int r; 533 u_char sig_details_present, flags; 534 u_int counter; 535 536 debug3_f("entering"); 537 538 if (sig_detailsp != NULL) 539 *sig_detailsp = NULL; 540 if ((m = sshbuf_new()) == NULL) 541 fatal_f("sshbuf_new failed"); 542 if ((r = sshkey_puts(key, m)) != 0 || 543 (r = sshbuf_put_string(m, sig, siglen)) != 0 || 544 (r = sshbuf_put_string(m, data, datalen)) != 0 || 545 (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0) 546 fatal_fr(r, "assemble"); 547 548 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, m); 549 550 debug3_f("waiting for MONITOR_ANS_KEYVERIFY"); 551 mm_request_receive_expect(pmonitor->m_recvfd, 552 MONITOR_ANS_KEYVERIFY, m); 553 554 if ((r = sshbuf_get_u32(m, &encoded_ret)) != 0 || 555 (r = sshbuf_get_u8(m, &sig_details_present)) != 0) 556 fatal_fr(r, "parse"); 557 if (sig_details_present && encoded_ret == 0) { 558 if ((r = sshbuf_get_u32(m, &counter)) != 0 || 559 (r = sshbuf_get_u8(m, &flags)) != 0) 560 fatal_fr(r, "parse sig_details"); 561 if (sig_detailsp != NULL) { 562 *sig_detailsp = xcalloc(1, sizeof(**sig_detailsp)); 563 (*sig_detailsp)->sk_counter = counter; 564 (*sig_detailsp)->sk_flags = flags; 565 } 566 } 567 568 sshbuf_free(m); 569 570 if (encoded_ret != 0) 571 return SSH_ERR_SIGNATURE_INVALID; 572 return 0; 573 } 574 575 void 576 mm_send_keystate(struct ssh *ssh, struct monitor *monitor) 577 { 578 struct sshbuf *m; 579 int r; 580 581 if ((m = sshbuf_new()) == NULL) 582 fatal_f("sshbuf_new failed"); 583 if ((r = ssh_packet_get_state(ssh, m)) != 0) 584 fatal_fr(r, "ssh_packet_get_state"); 585 mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, m); 586 debug3_f("Finished sending state"); 587 sshbuf_free(m); 588 } 589 590 int 591 mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen) 592 { 593 struct sshbuf *m; 594 char *p, *msg; 595 int success = 0, tmp1 = -1, tmp2 = -1, r; 596 597 /* Kludge: ensure there are fds free to receive the pty/tty */ 598 if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 || 599 (tmp2 = dup(pmonitor->m_recvfd)) == -1) { 600 error_f("cannot allocate fds for pty"); 601 if (tmp1 >= 0) 602 close(tmp1); 603 return 0; 604 } 605 close(tmp1); 606 close(tmp2); 607 608 if ((m = sshbuf_new()) == NULL) 609 fatal_f("sshbuf_new failed"); 610 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, m); 611 612 debug3_f("waiting for MONITOR_ANS_PTY"); 613 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PTY, m); 614 615 if ((r = sshbuf_get_u32(m, &success)) != 0) 616 fatal_fr(r, "parse success"); 617 if (success == 0) { 618 debug3_f("pty alloc failed"); 619 sshbuf_free(m); 620 return (0); 621 } 622 if ((r = sshbuf_get_cstring(m, &p, NULL)) != 0 || 623 (r = sshbuf_get_cstring(m, &msg, NULL)) != 0) 624 fatal_fr(r, "parse"); 625 sshbuf_free(m); 626 627 strlcpy(namebuf, p, namebuflen); /* Possible truncation */ 628 free(p); 629 630 if ((r = sshbuf_put(loginmsg, msg, strlen(msg))) != 0) 631 fatal_fr(r, "put loginmsg"); 632 free(msg); 633 634 if ((*ptyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1 || 635 (*ttyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1) 636 fatal_f("receive fds failed"); 637 638 /* Success */ 639 return (1); 640 } 641 642 void 643 mm_session_pty_cleanup2(Session *s) 644 { 645 struct sshbuf *m; 646 int r; 647 648 if (s->ttyfd == -1) 649 return; 650 if ((m = sshbuf_new()) == NULL) 651 fatal_f("sshbuf_new failed"); 652 if ((r = sshbuf_put_cstring(m, s->tty)) != 0) 653 fatal_fr(r, "assmble"); 654 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTYCLEANUP, m); 655 sshbuf_free(m); 656 657 /* closed dup'ed master */ 658 if (s->ptymaster != -1 && close(s->ptymaster) == -1) 659 error("close(s->ptymaster/%d): %s", 660 s->ptymaster, strerror(errno)); 661 662 /* unlink pty from session */ 663 s->ttyfd = -1; 664 } 665 666 /* Request process termination */ 667 668 void 669 mm_terminate(void) 670 { 671 struct sshbuf *m; 672 673 if ((m = sshbuf_new()) == NULL) 674 fatal_f("sshbuf_new failed"); 675 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_TERM, m); 676 sshbuf_free(m); 677 } 678 679 /* Request state information */ 680 681 void 682 mm_get_state(struct ssh *ssh, struct include_list *includes, 683 struct sshbuf *conf, struct sshbuf **confdatap, 684 uint64_t *timing_secretp, 685 struct sshbuf **hostkeysp, struct sshbuf **keystatep, 686 u_char **pw_namep, 687 struct sshbuf **authinfop, struct sshbuf **auth_optsp) 688 { 689 struct sshbuf *m, *inc; 690 u_char *cp; 691 size_t len; 692 int r; 693 struct include_item *item; 694 695 debug3_f("entering"); 696 697 if ((m = sshbuf_new()) == NULL || (inc = sshbuf_new()) == NULL) 698 fatal_f("sshbuf_new failed"); 699 700 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_STATE, m); 701 702 debug3_f("waiting for MONITOR_ANS_STATE"); 703 mm_request_receive_expect(pmonitor->m_recvfd, 704 MONITOR_ANS_STATE, m); 705 706 if ((r = sshbuf_get_string(m, &cp, &len)) != 0 || 707 (r = sshbuf_get_u64(m, timing_secretp)) != 0 || 708 (r = sshbuf_froms(m, hostkeysp)) != 0 || 709 (r = sshbuf_get_stringb(m, ssh->kex->server_version)) != 0 || 710 (r = sshbuf_get_stringb(m, ssh->kex->client_version)) != 0 || 711 (r = sshbuf_get_stringb(m, inc)) != 0) 712 fatal_fr(r, "parse config"); 713 714 /* postauth */ 715 if (confdatap) { 716 if ((r = sshbuf_froms(m, confdatap)) != 0 || 717 (r = sshbuf_froms(m, keystatep)) != 0 || 718 (r = sshbuf_get_string(m, pw_namep, NULL)) != 0 || 719 (r = sshbuf_froms(m, authinfop)) != 0 || 720 (r = sshbuf_froms(m, auth_optsp)) != 0) 721 fatal_fr(r, "parse config postauth"); 722 } 723 724 if (conf != NULL && (r = sshbuf_put(conf, cp, len))) 725 fatal_fr(r, "sshbuf_put"); 726 727 while (sshbuf_len(inc) != 0) { 728 item = xcalloc(1, sizeof(*item)); 729 if ((item->contents = sshbuf_new()) == NULL) 730 fatal_f("sshbuf_new failed"); 731 if ((r = sshbuf_get_cstring(inc, &item->selector, NULL)) != 0 || 732 (r = sshbuf_get_cstring(inc, &item->filename, NULL)) != 0 || 733 (r = sshbuf_get_stringb(inc, item->contents)) != 0) 734 fatal_fr(r, "parse includes"); 735 TAILQ_INSERT_TAIL(includes, item, entry); 736 } 737 738 free(cp); 739 sshbuf_free(m); 740 sshbuf_free(inc); 741 742 debug3_f("done"); 743 } 744 745 static void 746 mm_chall_setup(char **name, char **infotxt, u_int *numprompts, 747 char ***prompts, u_int **echo_on) 748 { 749 *name = xstrdup(""); 750 *infotxt = xstrdup(""); 751 *numprompts = 1; 752 *prompts = xcalloc(*numprompts, sizeof(char *)); 753 *echo_on = xcalloc(*numprompts, sizeof(u_int)); 754 (*echo_on)[0] = 0; 755 } 756 757 int 758 mm_bsdauth_query(void *ctx, char **name, char **infotxt, 759 u_int *numprompts, char ***prompts, u_int **echo_on) 760 { 761 struct sshbuf *m; 762 u_int success; 763 char *challenge; 764 int r; 765 766 debug3_f("entering"); 767 768 if ((m = sshbuf_new()) == NULL) 769 fatal_f("sshbuf_new failed"); 770 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHQUERY, m); 771 772 mm_request_receive_expect(pmonitor->m_recvfd, 773 MONITOR_ANS_BSDAUTHQUERY, m); 774 if ((r = sshbuf_get_u32(m, &success)) != 0) 775 fatal_fr(r, "parse success"); 776 if (success == 0) { 777 debug3_f("no challenge"); 778 sshbuf_free(m); 779 return (-1); 780 } 781 782 /* Get the challenge, and format the response */ 783 if ((r = sshbuf_get_cstring(m, &challenge, NULL)) != 0) 784 fatal_fr(r, "parse challenge"); 785 sshbuf_free(m); 786 787 mm_chall_setup(name, infotxt, numprompts, prompts, echo_on); 788 (*prompts)[0] = challenge; 789 790 debug3_f("received challenge: %s", challenge); 791 792 return (0); 793 } 794 795 int 796 mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses) 797 { 798 struct sshbuf *m; 799 int r, authok; 800 801 debug3_f("entering"); 802 if (numresponses != 1) 803 return (-1); 804 805 if ((m = sshbuf_new()) == NULL) 806 fatal_f("sshbuf_new failed"); 807 if ((r = sshbuf_put_cstring(m, responses[0])) != 0) 808 fatal_fr(r, "assemble"); 809 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHRESPOND, m); 810 811 mm_request_receive_expect(pmonitor->m_recvfd, 812 MONITOR_ANS_BSDAUTHRESPOND, m); 813 814 if ((r = sshbuf_get_u32(m, &authok)) != 0) 815 fatal_fr(r, "parse"); 816 sshbuf_free(m); 817 818 return ((authok == 0) ? -1 : 0); 819 } 820 821 #ifdef GSSAPI 822 OM_uint32 823 mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid) 824 { 825 struct sshbuf *m; 826 OM_uint32 major; 827 int r; 828 829 /* Client doesn't get to see the context */ 830 *ctx = NULL; 831 832 if ((m = sshbuf_new()) == NULL) 833 fatal_f("sshbuf_new failed"); 834 if ((r = sshbuf_put_string(m, goid->elements, goid->length)) != 0) 835 fatal_fr(r, "assemble"); 836 837 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSETUP, m); 838 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSETUP, m); 839 840 if ((r = sshbuf_get_u32(m, &major)) != 0) 841 fatal_fr(r, "parse"); 842 843 sshbuf_free(m); 844 return (major); 845 } 846 847 OM_uint32 848 mm_ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *in, 849 gss_buffer_desc *out, OM_uint32 *flagsp) 850 { 851 struct sshbuf *m; 852 OM_uint32 major; 853 u_int flags; 854 int r; 855 856 if ((m = sshbuf_new()) == NULL) 857 fatal_f("sshbuf_new failed"); 858 if ((r = sshbuf_put_string(m, in->value, in->length)) != 0) 859 fatal_fr(r, "assemble"); 860 861 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSTEP, m); 862 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSTEP, m); 863 864 if ((r = sshbuf_get_u32(m, &major)) != 0 || 865 (r = ssh_gssapi_get_buffer_desc(m, out)) != 0) 866 fatal_fr(r, "parse"); 867 if (flagsp != NULL) { 868 if ((r = sshbuf_get_u32(m, &flags)) != 0) 869 fatal_fr(r, "parse flags"); 870 *flagsp = flags; 871 } 872 873 sshbuf_free(m); 874 875 return (major); 876 } 877 878 OM_uint32 879 mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) 880 { 881 struct sshbuf *m; 882 OM_uint32 major; 883 int r; 884 885 if ((m = sshbuf_new()) == NULL) 886 fatal_f("sshbuf_new failed"); 887 if ((r = sshbuf_put_string(m, gssbuf->value, gssbuf->length)) != 0 || 888 (r = sshbuf_put_string(m, gssmic->value, gssmic->length)) != 0) 889 fatal_fr(r, "assemble"); 890 891 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSCHECKMIC, m); 892 mm_request_receive_expect(pmonitor->m_recvfd, 893 MONITOR_ANS_GSSCHECKMIC, m); 894 895 if ((r = sshbuf_get_u32(m, &major)) != 0) 896 fatal_fr(r, "parse"); 897 sshbuf_free(m); 898 return(major); 899 } 900 901 int 902 mm_ssh_gssapi_userok(char *user) 903 { 904 struct sshbuf *m; 905 int r, authenticated = 0; 906 907 if ((m = sshbuf_new()) == NULL) 908 fatal_f("sshbuf_new failed"); 909 910 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m); 911 mm_request_receive_expect(pmonitor->m_recvfd, 912 MONITOR_ANS_GSSUSEROK, m); 913 914 if ((r = sshbuf_get_u32(m, &authenticated)) != 0) 915 fatal_fr(r, "parse"); 916 917 sshbuf_free(m); 918 debug3_f("user %sauthenticated", authenticated ? "" : "not "); 919 return (authenticated); 920 } 921 #endif /* GSSAPI */ 922 923 /* 924 * Inform channels layer of permitopen options for a single forwarding 925 * direction (local/remote). 926 */ 927 static void 928 server_process_permitopen_list(struct ssh *ssh, int listen, 929 char **opens, u_int num_opens) 930 { 931 u_int i; 932 int port; 933 char *host, *arg, *oarg; 934 int where = listen ? FORWARD_REMOTE : FORWARD_LOCAL; 935 const char *what = listen ? "permitlisten" : "permitopen"; 936 937 channel_clear_permission(ssh, FORWARD_ADM, where); 938 if (num_opens == 0) 939 return; /* permit any */ 940 941 /* handle keywords: "any" / "none" */ 942 if (num_opens == 1 && strcmp(opens[0], "any") == 0) 943 return; 944 if (num_opens == 1 && strcmp(opens[0], "none") == 0) { 945 channel_disable_admin(ssh, where); 946 return; 947 } 948 /* Otherwise treat it as a list of permitted host:port */ 949 for (i = 0; i < num_opens; i++) { 950 oarg = arg = xstrdup(opens[i]); 951 host = hpdelim(&arg); 952 if (host == NULL) 953 fatal_f("missing host in %s", what); 954 host = cleanhostname(host); 955 if (arg == NULL || ((port = permitopen_port(arg)) < 0)) 956 fatal_f("bad port number in %s", what); 957 /* Send it to channels layer */ 958 channel_add_permission(ssh, FORWARD_ADM, 959 where, host, port); 960 free(oarg); 961 } 962 } 963 964 /* 965 * Inform channels layer of permitopen options from configuration. 966 */ 967 void 968 server_process_permitopen(struct ssh *ssh) 969 { 970 server_process_permitopen_list(ssh, 0, 971 options.permitted_opens, options.num_permitted_opens); 972 server_process_permitopen_list(ssh, 1, 973 options.permitted_listens, options.num_permitted_listens); 974 } 975 976 void 977 server_process_channel_timeouts(struct ssh *ssh) 978 { 979 u_int i, secs; 980 char *type; 981 982 debug3_f("setting %u timeouts", options.num_channel_timeouts); 983 channel_clear_timeouts(ssh); 984 for (i = 0; i < options.num_channel_timeouts; i++) { 985 if (parse_pattern_interval(options.channel_timeouts[i], 986 &type, &secs) != 0) { 987 fatal_f("internal error: bad timeout %s", 988 options.channel_timeouts[i]); 989 } 990 channel_add_timeout(ssh, type, secs); 991 free(type); 992 } 993 } 994 995 struct connection_info * 996 server_get_connection_info(struct ssh *ssh, int populate, int use_dns) 997 { 998 static struct connection_info ci; 999 1000 if (ssh == NULL || !populate) 1001 return &ci; 1002 ci.host = use_dns ? ssh_remote_hostname(ssh) : ssh_remote_ipaddr(ssh); 1003 ci.address = ssh_remote_ipaddr(ssh); 1004 ci.laddress = ssh_local_ipaddr(ssh); 1005 ci.lport = ssh_local_port(ssh); 1006 ci.rdomain = ssh_packet_rdomain_in(ssh); 1007 return &ci; 1008 } 1009 1010