dropbear: kex.h annotate

annotate kex.h @ 1930:299f4f19ba19

Add /usr/sbin and /sbin to default root PATH When dropbear is used in a very restricted environment (such as in a initrd), the default user shell is often also very restricted and doesn't take care of setting the PATH so the user ends up with the PATH set by dropbear. Unfortunately, dropbear always sets "/usr/bin:/bin" as default PATH even for the root user which should have /usr/sbin and /sbin too. For a concrete instance of this problem, see the "Remote Unlocking" section in this tutorial: https://paxswill.com/blog/2013/11/04/encrypted-raspberry-pi/ It speaks of a bug in the initramfs script because it's written "blkid" instead of "/sbin/blkid"... this is just because the scripts from the initramfs do not expect to have a PATH without the sbin directories and because dropbear is not setting the PATH appropriately for the root user. I'm thus suggesting to use the attached patch to fix this misbehaviour (I did not test it, but it's easy enough). It might seem anecdotic but multiple Kali users have been bitten by this. From https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903403

author	Raphael Hertzog <hertzog@debian.org>
date	Mon, 09 Jul 2018 16:27:53 +0200
parents	8f93f37c01de
children

rev	line source
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 /*
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	2 * Dropbear - a SSH2 server
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	4 * Copyright (c) 2002,2003 Matt Johnston
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	5 * All rights reserved.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	6 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	7 * Permission is hereby granted, free of charge, to any person obtaining a copy
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	8 * of this software and associated documentation files (the "Software"), to deal
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	9 * in the Software without restriction, including without limitation the rights
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	11 * copies of the Software, and to permit persons to whom the Software is
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12 * furnished to do so, subject to the following conditions:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14 * The above copyright notice and this permission notice shall be included in
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	15 * all copies or substantial portions of the Software.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	16 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	23 * SOFTWARE. */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	24
1036 deed0571cacc DROPBEAR_ prefix for include guards to avoid collisions Thorsten Horstmann <thorsten.horstmann@web.de> parents: 848 diff changeset	25 #ifndef DROPBEAR_KEX_H_
deed0571cacc DROPBEAR_ prefix for include guards to avoid collisions Thorsten Horstmann <thorsten.horstmann@web.de> parents: 848 diff changeset	26 #define DROPBEAR_KEX_H_
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	27
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	28 #include "includes.h"
26 0969767bca0d snapshot of stuff Matt Johnston <matt@ucc.asn.au> parents: 4 diff changeset	29 #include "algo.h"
759 76fba0856749 More changes for KEX and ECDH. Set up hash descriptors, make ECC code work, Matt Johnston <matt@ucc.asn.au> parents: 756 diff changeset	30 #include "signkey.h"
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	31
1276 9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	32 void send_msg_kexinit(void);
9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	33 void recv_msg_kexinit(void);
9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	34 void send_msg_newkeys(void);
9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	35 void recv_msg_newkeys(void);
9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	36 void kexfirstinitialise(void);
1456 a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1295 diff changeset	37 void finish_kexhashbuf(void);
755 b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	38
1702 8f93f37c01de Allow DH to be completely disabled (#97) Vladislav Grishenko <themiron@users.noreply.github.com> parents: 1681 diff changeset	39 #if DROPBEAR_NORMAL_DH
1276 9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	40 struct kex_dh_param *gen_kexdh_param(void);
755 b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	41 void free_kexdh_param(struct kex_dh_param *param);
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	42 void kexdh_comb_key(struct kex_dh_param param, mp_int dh_pub_them,
26 0969767bca0d snapshot of stuff Matt Johnston <matt@ucc.asn.au> parents: 4 diff changeset	43 sign_key *hostkey);
1702 8f93f37c01de Allow DH to be completely disabled (#97) Vladislav Grishenko <themiron@users.noreply.github.com> parents: 1681 diff changeset	44 #endif
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	45
1295 750ec4ec4cbe Convert #ifdef to #if, other build changes Matt Johnston <matt@ucc.asn.au> parents: 1276 diff changeset	46 #if DROPBEAR_ECDH
1276 9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	47 struct kex_ecdh_param *gen_kexecdh_param(void);
755 b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	48 void free_kexecdh_param(struct kex_ecdh_param *param);
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	49 void kexecdh_comb_key(struct kex_ecdh_param param, buffer pub_them,
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	50 sign_key *hostkey);
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	51 #endif
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	52
1295 750ec4ec4cbe Convert #ifdef to #if, other build changes Matt Johnston <matt@ucc.asn.au> parents: 1276 diff changeset	53 #if DROPBEAR_CURVE25519
1276 9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	54 struct kex_curve25519_param *gen_kexcurve25519_param(void);
848 6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	55 void free_kexcurve25519_param(struct kex_curve25519_param *param);
1459 06d52bcb8094 Pointer parameter could be declared as pointing to const Francois Perrad <francois.perrad@gadz.org> parents: 1295 diff changeset	56 void kexcurve25519_comb_key(const struct kex_curve25519_param param, const buffer pub_them,
848 6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	57 sign_key *hostkey);
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	58 #endif
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	59
501 d58c478bd399 Add support for [email protected] delayed compression. Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	60 #ifndef DISABLE_ZLIB
1276 9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	61 int is_compress_trans(void);
9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	62 int is_compress_recv(void);
501 d58c478bd399 Add support for [email protected] delayed compression. Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	63 #endif
d58c478bd399 Add support for [email protected] delayed compression. Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	64
1276 9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	65 void recv_msg_kexdh_init(void); /* server */
26 0969767bca0d snapshot of stuff Matt Johnston <matt@ucc.asn.au> parents: 4 diff changeset	66
1276 9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	67 void send_msg_kexdh_init(void); /* client */
9169e4e7cbee fix empty C prototypes Francois Perrad <francois.perrad@gadz.org> parents: 1224 diff changeset	68 void recv_msg_kexdh_reply(void); /* client */
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	69
1676 d5cdc60db08e ext-info handling for server-sig-algs Matt Johnston <matt@ucc.asn.au> parents: 1635 diff changeset	70 void recv_msg_ext_info(void);
d5cdc60db08e ext-info handling for server-sig-algs Matt Johnston <matt@ucc.asn.au> parents: 1635 diff changeset	71
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	72 struct KEXState {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	73
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	74 unsigned sentkexinit : 1; /set when we've sent/recv kexinit packet /
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	75 unsigned recvkexinit : 1;
739 d44325108d0e first_kex_packet_follows working, needs tidying Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	76 unsigned them_firstfollows : 1; /* true when first_kex_packet_follows is set */
623 895fbe068f2c Fix case where "-K 1" would cause a SSH_MSG_IGNORE packet to be sent Matt Johnston <matt@ucc.asn.au> parents: 501 diff changeset	77 unsigned sentnewkeys : 1; /* set once we've send MSG_NEWKEYS (will be cleared once we have also received */
895fbe068f2c Fix case where "-K 1" would cause a SSH_MSG_IGNORE packet to be sent Matt Johnston <matt@ucc.asn.au> parents: 501 diff changeset	78 unsigned recvnewkeys : 1; /* set once we've received MSG_NEWKEYS (cleared once we have also sent */
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	79
1681 435cfb9ec96e send and handle SSH_MSG_EXT_INFO only at the correct point Matt Johnston <matt@ucc.asn.au> parents: 1678 diff changeset	80 unsigned int donefirstkex; /* Set to 1 after the first kex has completed,
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 26 diff changeset	81 ie the transport layer has been set up */
1681 435cfb9ec96e send and handle SSH_MSG_EXT_INFO only at the correct point Matt Johnston <matt@ucc.asn.au> parents: 1678 diff changeset	82 unsigned int donesecondkex; /* Set to 1 after the second kex has completed */
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 26 diff changeset	83
739 d44325108d0e first_kex_packet_follows working, needs tidying Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	84 unsigned our_first_follows_matches : 1;
d44325108d0e first_kex_packet_follows working, needs tidying Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	85
454 7e43f5e473b9 - Add -K keepalive flag for dropbear and dbclient Matt Johnston <matt@ucc.asn.au> parents: 227 diff changeset	86 time_t lastkextime; /* time of the last kex */
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	87 unsigned int datatrans; /* data transmitted since last kex */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	88 unsigned int datarecv; /* data received since last kex */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	89
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	90 };
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	91
1702 8f93f37c01de Allow DH to be completely disabled (#97) Vladislav Grishenko <themiron@users.noreply.github.com> parents: 1681 diff changeset	92 #if DROPBEAR_NORMAL_DH
755 b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	93 struct kex_dh_param {
801 7dcb46da72d9 merge in HEAD Matt Johnston <matt@ucc.asn.au> parents: 759 740 diff changeset	94 mp_int pub; /* e */
7dcb46da72d9 merge in HEAD Matt Johnston <matt@ucc.asn.au> parents: 759 740 diff changeset	95 mp_int priv; /* x */
755 b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	96 };
1702 8f93f37c01de Allow DH to be completely disabled (#97) Vladislav Grishenko <themiron@users.noreply.github.com> parents: 1681 diff changeset	97 #endif
755 b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	98
1295 750ec4ec4cbe Convert #ifdef to #if, other build changes Matt Johnston <matt@ucc.asn.au> parents: 1276 diff changeset	99 #if DROPBEAR_ECDH
755 b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	100 struct kex_ecdh_param {
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	101 ecc_key key;
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	102 };
b07eb3dc23ec refactor kexdh code a bit, start working on ecdh etc Matt Johnston <matt@ucc.asn.au> parents: 623 diff changeset	103 #endif
740 3062da90dab8 Add kexguess2 behaviour Matt Johnston <matt@ucc.asn.au> parents: 739 diff changeset	104
1295 750ec4ec4cbe Convert #ifdef to #if, other build changes Matt Johnston <matt@ucc.asn.au> parents: 1276 diff changeset	105 #if DROPBEAR_CURVE25519
848 6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	106 #define CURVE25519_LEN 32
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	107 struct kex_curve25519_param {
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	108 unsigned char priv[CURVE25519_LEN];
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	109 unsigned char pub[CURVE25519_LEN];
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	110 };
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	111 #endif
6c69e7df3621 curve25519 Matt Johnston <matt@ucc.asn.au> parents: 801 diff changeset	112
1036 deed0571cacc DROPBEAR_ prefix for include guards to avoid collisions Thorsten Horstmann <thorsten.horstmann@web.de> parents: 848 diff changeset	113 #endif /* DROPBEAR_KEX_H_ */

Mercurial > dropbear

annotate kex.h @ 1930:299f4f19ba19