Mercurial > dropbear
annotate svr-authpubkey.c @ 1523:1d163552145f coverity
merge coverity
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Mon, 19 Feb 2018 23:14:49 +0800 |
parents | 35f38af1238b |
children | 5916af64acd4 5d2d1021ca00 |
rev | line source |
---|---|
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
1 /* |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
2 * Dropbear - a SSH2 server |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
3 * |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
4 * Copyright (c) 2002,2003 Matt Johnston |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
5 * All rights reserved. |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
6 * |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
7 * Permission is hereby granted, free of charge, to any person obtaining a copy |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
8 * of this software and associated documentation files (the "Software"), to deal |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
9 * in the Software without restriction, including without limitation the rights |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
11 * copies of the Software, and to permit persons to whom the Software is |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
12 * furnished to do so, subject to the following conditions: |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
13 * |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
14 * The above copyright notice and this permission notice shall be included in |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
15 * all copies or substantial portions of the Software. |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
16 * |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
23 * SOFTWARE. */ |
475
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
24 /* |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
25 * This file incorporates work covered by the following copyright and |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
26 * permission notice: |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
27 * |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
28 * Copyright (c) 2000 Markus Friedl. All rights reserved. |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
29 * |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
30 * Redistribution and use in source and binary forms, with or without |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
31 * modification, are permitted provided that the following conditions |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
32 * are met: |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
33 * 1. Redistributions of source code must retain the above copyright |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
34 * notice, this list of conditions and the following disclaimer. |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
35 * 2. Redistributions in binary form must reproduce the above copyright |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
36 * notice, this list of conditions and the following disclaimer in the |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
37 * documentation and/or other materials provided with the distribution. |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
38 * |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
39 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
40 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
41 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
42 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
43 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
44 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
45 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
46 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
47 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
48 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
49 * |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
50 * This copyright and permission notice applies to the code parsing public keys |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
51 * options string which can also be found in OpenSSH auth2-pubkey.c file |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
52 * (user_key_allowed2). It has been adapted to work with buffers. |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
53 * |
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
54 */ |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
55 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
56 /* Process a pubkey auth request */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
57 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
58 #include "includes.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
59 #include "session.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
60 #include "dbutil.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
61 #include "buffer.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
62 #include "signkey.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
63 #include "auth.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
64 #include "ssh.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
65 #include "packet.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
66 #include "algo.h" |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
67 |
1295
750ec4ec4cbe
Convert #ifdef to #if, other build changes
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
68 #if DROPBEAR_SVR_PUBKEY_AUTH |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
69 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
70 #define MIN_AUTHKEYS_LINE 10 /* "ssh-rsa AB" - short but doesn't matter */ |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
44
diff
changeset
|
71 #define MAX_AUTHKEYS_LINE 4200 /* max length of a line in authkeys */ |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
72 |
1459
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
73 static int checkpubkey(const char* algo, unsigned int algolen, |
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
74 const unsigned char* keyblob, unsigned int keybloblen); |
1276
9169e4e7cbee
fix empty C prototypes
Francois Perrad <francois.perrad@gadz.org>
parents:
1122
diff
changeset
|
75 static int checkpubkeyperms(void); |
1459
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
76 static void send_msg_userauth_pk_ok(const char* algo, unsigned int algolen, |
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
77 const unsigned char* keyblob, unsigned int keybloblen); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
78 static int checkfileperm(char * filename); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
79 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
80 /* process a pubkey auth request, sending success or failure message as |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
81 * appropriate */ |
33 | 82 void svr_auth_pubkey() { |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
83 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
84 unsigned char testkey; /* whether we're just checking if a key is usable */ |
1110
83025b7063ec
Turn checkpubkey() and send_msg_userauth_pk_ok()'s algo argument into char *
Gaël PORTAY <gael.portay@gmail.com>
parents:
1094
diff
changeset
|
85 char* algo = NULL; /* pubkey algo */ |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
86 unsigned int algolen; |
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
87 unsigned char* keyblob = NULL; |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
88 unsigned int keybloblen; |
1059
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
89 unsigned int sign_payload_length; |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
90 buffer * signbuf = NULL; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
91 sign_key * key = NULL; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
92 char* fp = NULL; |
852
7540c0822374
Various cleanups and fixes for warnings
Matt Johnston <matt@ucc.asn.au>
parents:
762
diff
changeset
|
93 enum signkey_type type = -1; |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
94 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
95 TRACE(("enter pubkeyauth")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
96 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
97 /* 0 indicates user just wants to check if key can be used, 1 is an |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
98 * actual attempt*/ |
179
161557a9dde8
* fix longstanding bug with connections being closed on failure to
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
99 testkey = (buf_getbool(ses.payload) == 0); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
100 |
1122
aaf576b27a10
Merge pull request #13 from gazoo74/fix-warnings
Matt Johnston <matt@ucc.asn.au>
parents:
1110
diff
changeset
|
101 algo = buf_getstring(ses.payload, &algolen); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
102 keybloblen = buf_getint(ses.payload); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
103 keyblob = buf_getptr(ses.payload, keybloblen); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
104 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
105 /* check if the key is valid */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
106 if (checkpubkey(algo, algolen, keyblob, keybloblen) == DROPBEAR_FAILURE) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
107 send_msg_userauth_failure(0, 0); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
108 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
109 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
110 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
111 /* let them know that the key is ok to use */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
112 if (testkey) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
113 send_msg_userauth_pk_ok(algo, algolen, keyblob, keybloblen); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
114 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
115 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
116 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
117 /* now we can actually verify the signature */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
118 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
119 /* get the key */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
120 key = new_sign_key(); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
121 type = DROPBEAR_SIGNKEY_ANY; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
122 if (buf_get_pub_key(ses.payload, key, &type) == DROPBEAR_FAILURE) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
123 send_msg_userauth_failure(0, 1); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
124 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
125 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
126 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
127 /* create the data which has been signed - this a string containing |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
128 * session_id, concatenated with the payload packet up to the signature */ |
1059
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
129 assert(ses.payload_beginning <= ses.payload->pos); |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
130 sign_payload_length = ses.payload->pos - ses.payload_beginning; |
762
a78a38e402d1
- Fix various hardcoded uses of SHA1
Matt Johnston <matt@ucc.asn.au>
parents:
761
diff
changeset
|
131 signbuf = buf_new(ses.payload->pos + 4 + ses.session_id->len); |
761
ac2158e3e403
ecc kind of works, needs fixing/testing
Matt Johnston <matt@ucc.asn.au>
parents:
594
diff
changeset
|
132 buf_putbufstring(signbuf, ses.session_id); |
1059
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
133 |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
134 /* The entire contents of the payload prior. */ |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
135 buf_setpos(ses.payload, ses.payload_beginning); |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
136 buf_putbytes(signbuf, |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
137 buf_getptr(ses.payload, sign_payload_length), |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
138 sign_payload_length); |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
139 buf_incrpos(ses.payload, sign_payload_length); |
703c7cdd2577
Fix pubkey auth after change to reuse ses.readbuf as ses.payload
Matt Johnston <matt@ucc.asn.au>
parents:
853
diff
changeset
|
140 |
44 | 141 buf_setpos(signbuf, 0); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
142 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
143 /* ... and finally verify the signature */ |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
44
diff
changeset
|
144 fp = sign_key_fingerprint(keyblob, keybloblen); |
761
ac2158e3e403
ecc kind of works, needs fixing/testing
Matt Johnston <matt@ucc.asn.au>
parents:
594
diff
changeset
|
145 if (buf_verify(ses.payload, key, signbuf) == DROPBEAR_SUCCESS) { |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
146 dropbear_log(LOG_NOTICE, |
594
a98a2138364a
Improve capitalisation for all logged strings
Matt Johnston <matt@ucc.asn.au>
parents:
476
diff
changeset
|
147 "Pubkey auth succeeded for '%s' with key %s from %s", |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
148 ses.authstate.pw_name, fp, svr_ses.addrstring); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
149 send_msg_userauth_success(); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
150 } else { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
151 dropbear_log(LOG_WARNING, |
594
a98a2138364a
Improve capitalisation for all logged strings
Matt Johnston <matt@ucc.asn.au>
parents:
476
diff
changeset
|
152 "Pubkey auth bad signature for '%s' with key %s from %s", |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
153 ses.authstate.pw_name, fp, svr_ses.addrstring); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
154 send_msg_userauth_failure(0, 1); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
155 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
156 m_free(fp); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
157 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
158 out: |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
159 /* cleanup stuff */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
160 if (signbuf) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
161 buf_free(signbuf); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
162 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
163 if (algo) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
164 m_free(algo); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
165 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
166 if (key) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
167 sign_key_free(key); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
168 key = NULL; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
169 } |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
170 TRACE(("leave pubkeyauth")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
171 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
172 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
173 /* Reply that the key is valid for auth, this is sent when the user sends |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
174 * a straight copy of their pubkey to test, to avoid having to perform |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
175 * expensive signing operations with a worthless key */ |
1459
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
176 static void send_msg_userauth_pk_ok(const char* algo, unsigned int algolen, |
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
177 const unsigned char* keyblob, unsigned int keybloblen) { |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
178 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
179 TRACE(("enter send_msg_userauth_pk_ok")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
180 CHECKCLEARTOWRITE(); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
181 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
182 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_PK_OK); |
1122
aaf576b27a10
Merge pull request #13 from gazoo74/fix-warnings
Matt Johnston <matt@ucc.asn.au>
parents:
1110
diff
changeset
|
183 buf_putstring(ses.writepayload, algo, algolen); |
aaf576b27a10
Merge pull request #13 from gazoo74/fix-warnings
Matt Johnston <matt@ucc.asn.au>
parents:
1110
diff
changeset
|
184 buf_putstring(ses.writepayload, (const char*)keyblob, keybloblen); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
185 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
186 encrypt_packet(); |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
187 TRACE(("leave send_msg_userauth_pk_ok")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
188 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
189 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
190 |
1459
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
191 static int checkpubkey_line(buffer* line, int line_num, const char* filename, |
1420
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
192 const char* algo, unsigned int algolen, |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
193 const unsigned char* keyblob, unsigned int keybloblen) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
194 buffer *options_buf = NULL; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
195 unsigned int pos, len; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
196 int ret = DROPBEAR_FAILURE; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
197 |
1422 | 198 if (line->len < MIN_AUTHKEYS_LINE || line->len > MAX_AUTHKEYS_LINE) { |
1452
15d4b821bcc9
fix checkpubkey_line function name for TRACE
Matt Johnston <matt@ucc.asn.au>
parents:
1451
diff
changeset
|
199 TRACE(("checkpubkey_line: bad line length %d", line->len)) |
1422 | 200 return DROPBEAR_FAILURE; |
1420
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
201 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
202 |
1421
814f22d4a58f
don't exit encountering short lines
Matt Johnston <matt@ucc.asn.au>
parents:
1420
diff
changeset
|
203 /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ |
814f22d4a58f
don't exit encountering short lines
Matt Johnston <matt@ucc.asn.au>
parents:
1420
diff
changeset
|
204 if (line->pos + algolen+3 > line->len) { |
814f22d4a58f
don't exit encountering short lines
Matt Johnston <matt@ucc.asn.au>
parents:
1420
diff
changeset
|
205 goto out; |
814f22d4a58f
don't exit encountering short lines
Matt Johnston <matt@ucc.asn.au>
parents:
1420
diff
changeset
|
206 } |
1420
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
207 /* check the key type */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
208 if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
209 int is_comment = 0; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
210 unsigned char *options_start = NULL; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
211 int options_len = 0; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
212 int escape, quoted; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
213 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
214 /* skip over any comments or leading whitespace */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
215 while (line->pos < line->len) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
216 const char c = buf_getbyte(line); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
217 if (c == ' ' || c == '\t') { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
218 continue; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
219 } else if (c == '#') { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
220 is_comment = 1; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
221 break; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
222 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
223 buf_incrpos(line, -1); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
224 break; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
225 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
226 if (is_comment) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
227 /* next line */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
228 goto out; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
229 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
230 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
231 /* remember start of options */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
232 options_start = buf_getptr(line, 1); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
233 quoted = 0; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
234 escape = 0; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
235 options_len = 0; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
236 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
237 /* figure out where the options are */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
238 while (line->pos < line->len) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
239 const char c = buf_getbyte(line); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
240 if (!quoted && (c == ' ' || c == '\t')) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
241 break; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
242 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
243 escape = (!escape && c == '\\'); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
244 if (!escape && c == '"') { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
245 quoted = !quoted; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
246 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
247 options_len++; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
248 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
249 options_buf = buf_new(options_len); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
250 buf_putbytes(options_buf, options_start, options_len); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
251 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
252 /* compare the algorithm. +3 so we have enough bytes to read a space and some base64 characters too. */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
253 if (line->pos + algolen+3 > line->len) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
254 goto out; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
255 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
256 if (strncmp((const char *) buf_getptr(line, algolen), algo, algolen) != 0) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
257 goto out; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
258 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
259 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
260 buf_incrpos(line, algolen); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
261 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
262 /* check for space (' ') character */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
263 if (buf_getbyte(line) != ' ') { |
1452
15d4b821bcc9
fix checkpubkey_line function name for TRACE
Matt Johnston <matt@ucc.asn.au>
parents:
1451
diff
changeset
|
264 TRACE(("checkpubkey_line: space character expected, isn't there")) |
1420
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
265 goto out; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
266 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
267 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
268 /* truncate the line at the space after the base64 data */ |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
269 pos = line->pos; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
270 for (len = 0; line->pos < line->len; len++) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
271 if (buf_getbyte(line) == ' ') break; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
272 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
273 buf_setpos(line, pos); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
274 buf_setlen(line, line->pos + len); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
275 |
1452
15d4b821bcc9
fix checkpubkey_line function name for TRACE
Matt Johnston <matt@ucc.asn.au>
parents:
1451
diff
changeset
|
276 TRACE(("checkpubkey_line: line pos = %d len = %d", line->pos, line->len)) |
1420
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
277 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
278 ret = cmp_base64_key(keyblob, keybloblen, (const unsigned char *) algo, algolen, line, NULL); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
279 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
280 if (ret == DROPBEAR_SUCCESS && options_buf) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
281 ret = svr_add_pubkey_options(options_buf, line_num, filename); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
282 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
283 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
284 out: |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
285 if (options_buf) { |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
286 buf_free(options_buf); |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
287 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
288 return ret; |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
289 } |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
290 |
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
291 |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
292 /* Checks whether a specified publickey (and associated algorithm) is an |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
293 * acceptable key for authentication */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
294 /* Returns DROPBEAR_SUCCESS if key is ok for auth, DROPBEAR_FAILURE otherwise */ |
1459
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
295 static int checkpubkey(const char* algo, unsigned int algolen, |
06d52bcb8094
Pointer parameter could be declared as pointing to const
Francois Perrad <francois.perrad@gadz.org>
parents:
1422
diff
changeset
|
296 const unsigned char* keyblob, unsigned int keybloblen) { |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
297 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
298 FILE * authfile = NULL; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
299 char * filename = NULL; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
300 int ret = DROPBEAR_FAILURE; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
301 buffer * line = NULL; |
1420
950c6973f27b
split out checkpubkey_line() separately
Matt Johnston <matt@ucc.asn.au>
parents:
1342
diff
changeset
|
302 unsigned int len; |
476
df7f7da7f6e4
- Rework pubkey options to be more careful about buffer lengths. Needs review.
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
303 int line_num; |
1330
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
304 uid_t origuid; |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
305 gid_t origgid; |
475
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
306 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
307 TRACE(("enter checkpubkey")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
308 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
309 /* check that we can use the algo */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
310 if (have_algo(algo, algolen, sshhostkey) == DROPBEAR_FAILURE) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
311 dropbear_log(LOG_WARNING, |
594
a98a2138364a
Improve capitalisation for all logged strings
Matt Johnston <matt@ucc.asn.au>
parents:
476
diff
changeset
|
312 "Pubkey auth attempt with unknown algo for '%s' from %s", |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
313 ses.authstate.pw_name, svr_ses.addrstring); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
314 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
315 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
316 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
317 /* check file permissions, also whether file exists */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
318 if (checkpubkeyperms() == DROPBEAR_FAILURE) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
319 TRACE(("bad authorized_keys permissions, or file doesn't exist")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
320 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
321 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
322 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
323 /* we don't need to check pw and pw_dir for validity, since |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
324 * its been done in checkpubkeyperms. */ |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
325 len = strlen(ses.authstate.pw_dir); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
326 /* allocate max required pathname storage, |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
327 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
328 filename = m_malloc(len + 22); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
329 snprintf(filename, len + 22, "%s/.ssh/authorized_keys", |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
330 ses.authstate.pw_dir); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
331 |
1330
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
332 /* open the file as the authenticating user. */ |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
333 origuid = getuid(); |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
334 origgid = getgid(); |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
335 if ((setegid(ses.authstate.pw_gid)) < 0 || |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
336 (seteuid(ses.authstate.pw_uid)) < 0) { |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
337 dropbear_exit("Failed to set euid"); |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
338 } |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
339 |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
340 authfile = fopen(filename, "r"); |
1330
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
341 |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
342 if ((seteuid(origuid)) < 0 || |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
343 (setegid(origgid)) < 0) { |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
344 dropbear_exit("Failed to revert euid"); |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
345 } |
0d889b068123
switch user when opening authorized_keys
Matt Johnston <matt@ucc.asn.au>
parents:
1276
diff
changeset
|
346 |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
347 if (authfile == NULL) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
348 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
349 } |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
350 TRACE(("checkpubkey: opened authorized_keys OK")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
351 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
352 line = buf_new(MAX_AUTHKEYS_LINE); |
476
df7f7da7f6e4
- Rework pubkey options to be more careful about buffer lengths. Needs review.
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
353 line_num = 0; |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
354 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
355 /* iterate through the lines */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
356 do { |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
44
diff
changeset
|
357 if (buf_getline(line, authfile) == DROPBEAR_FAILURE) { |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
358 /* EOF reached */ |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
359 TRACE(("checkpubkey: authorized_keys EOF reached")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
360 break; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
361 } |
476
df7f7da7f6e4
- Rework pubkey options to be more careful about buffer lengths. Needs review.
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
362 line_num++; |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
363 |
1451
7e95ab97d2b0
fix pubkey authentication return value
Matt Johnston <matt@ucc.asn.au>
parents:
1422
diff
changeset
|
364 ret = checkpubkey_line(line, line_num, filename, algo, algolen, keyblob, keybloblen); |
7e95ab97d2b0
fix pubkey authentication return value
Matt Johnston <matt@ucc.asn.au>
parents:
1422
diff
changeset
|
365 if (ret == DROPBEAR_SUCCESS) { |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
44
diff
changeset
|
366 break; |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
367 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
368 |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
44
diff
changeset
|
369 /* We continue to the next line otherwise */ |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
370 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
371 } while (1); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
372 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
373 out: |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
374 if (authfile) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
375 fclose(authfile); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
376 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
377 if (line) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
378 buf_free(line); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
379 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
380 m_free(filename); |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
381 TRACE(("leave checkpubkey: ret=%d", ret)) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
382 return ret; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
383 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
384 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
385 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
386 /* Returns DROPBEAR_SUCCESS if file permissions for pubkeys are ok, |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
387 * DROPBEAR_FAILURE otherwise. |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
388 * Checks that the user's homedir, ~/.ssh, and |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
389 * ~/.ssh/authorized_keys are all owned by either root or the user, and are |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
390 * g-w, o-w */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
391 static int checkpubkeyperms() { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
392 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
393 char* filename = NULL; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
394 int ret = DROPBEAR_FAILURE; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
395 unsigned int len; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
396 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
397 TRACE(("enter checkpubkeyperms")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
398 |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
399 if (ses.authstate.pw_dir == NULL) { |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
400 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
401 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
402 |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
403 if ((len = strlen(ses.authstate.pw_dir)) == 0) { |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
404 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
405 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
406 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
407 /* allocate max required pathname storage, |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
408 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
409 filename = m_malloc(len + 22); |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
410 strncpy(filename, ses.authstate.pw_dir, len+1); |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
411 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
412 /* check ~ */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
413 if (checkfileperm(filename) != DROPBEAR_SUCCESS) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
414 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
415 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
416 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
417 /* check ~/.ssh */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
418 strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
419 if (checkfileperm(filename) != DROPBEAR_SUCCESS) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
420 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
421 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
422 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
423 /* now check ~/.ssh/authorized_keys */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
424 strncat(filename, "/authorized_keys", 16); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
425 if (checkfileperm(filename) != DROPBEAR_SUCCESS) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
426 goto out; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
427 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
428 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
429 /* file looks ok, return success */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
430 ret = DROPBEAR_SUCCESS; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
431 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
432 out: |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
433 m_free(filename); |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
434 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
435 TRACE(("leave checkpubkeyperms")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
436 return ret; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
437 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
438 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
439 /* Checks that a file is owned by the user or root, and isn't writable by |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
440 * group or other */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
441 /* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
442 static int checkfileperm(char * filename) { |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
443 struct stat filestat; |
248
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
444 int badperm = 0; |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
445 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
446 TRACE(("enter checkfileperm(%s)", filename)) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
447 |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
448 if (stat(filename, &filestat) != 0) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
449 TRACE(("leave checkfileperm: stat() != 0")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
450 return DROPBEAR_FAILURE; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
451 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
452 /* check ownership - user or root only*/ |
464
4317be8b7cf9
Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents:
436
diff
changeset
|
453 if (filestat.st_uid != ses.authstate.pw_uid |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
454 && filestat.st_uid != 0) { |
248
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
455 badperm = 1; |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
456 TRACE(("wrong ownership")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
457 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
458 /* check permissions - don't want group or others +w */ |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
459 if (filestat.st_mode & (S_IWGRP | S_IWOTH)) { |
248
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
460 badperm = 1; |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
461 TRACE(("wrong perms")) |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
462 } |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
463 if (badperm) { |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
464 if (!ses.authstate.perm_warn) { |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
465 ses.authstate.perm_warn = 1; |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
466 dropbear_log(LOG_INFO, "%s must be owned by user or root, and not writable by others", filename); |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
467 } |
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
468 TRACE(("leave checkfileperm: failure perms/owner")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
469 return DROPBEAR_FAILURE; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
470 } |
248
bf64e666f99b
Log when pubkey auth fails because of bad pubkey perms/ownership
Matt Johnston <matt@ucc.asn.au>
parents:
241
diff
changeset
|
471 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
158
diff
changeset
|
472 TRACE(("leave checkfileperm: success")) |
4
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
473 return DROPBEAR_SUCCESS; |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
474 } |
fe6bca95afa7
Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff
changeset
|
475 |
475
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
464
diff
changeset
|
476 #endif |