dropbear: svr-authpubkey.c annotate

annotate svr-authpubkey.c @ 476:df7f7da7f6e4 pubkey-options

- Rework pubkey options to be more careful about buffer lengths. Needs review.

author	Matt Johnston <matt@ucc.asn.au>
date	Fri, 12 Sep 2008 17:23:56 +0000
parents	52a644e7b8e1
children	a98a2138364a

rev	line source
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 /*
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	2 * Dropbear - a SSH2 server
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	4 * Copyright (c) 2002,2003 Matt Johnston
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	5 * All rights reserved.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	6 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	7 * Permission is hereby granted, free of charge, to any person obtaining a copy
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	8 * of this software and associated documentation files (the "Software"), to deal
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	9 * in the Software without restriction, including without limitation the rights
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	11 * copies of the Software, and to permit persons to whom the Software is
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12 * furnished to do so, subject to the following conditions:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14 * The above copyright notice and this permission notice shall be included in
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	15 * all copies or substantial portions of the Software.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	16 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	23 * SOFTWARE. */
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	24 /*
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	25 * This file incorporates work covered by the following copyright and
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	26 * permission notice:
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	27 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	28 * Copyright (c) 2000 Markus Friedl. All rights reserved.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	29 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	30 * Redistribution and use in source and binary forms, with or without
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	31 * modification, are permitted provided that the following conditions
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	32 * are met:
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	33 * 1. Redistributions of source code must retain the above copyright
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	34 * notice, this list of conditions and the following disclaimer.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	35 * 2. Redistributions in binary form must reproduce the above copyright
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	36 * notice, this list of conditions and the following disclaimer in the
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	37 * documentation and/or other materials provided with the distribution.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	38 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	39 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	40 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	41 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	42 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	43 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	44 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	45 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	46 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	47 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	48 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	49 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	50 * This copyright and permission notice applies to the code parsing public keys
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	51 * options string which can also be found in OpenSSH auth2-pubkey.c file
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	52 * (user_key_allowed2). It has been adapted to work with buffers.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	53 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	54 */
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	55
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	56 /* Process a pubkey auth request */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	57
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	58 #include "includes.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	59 #include "session.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	60 #include "dbutil.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	61 #include "buffer.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	62 #include "signkey.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	63 #include "auth.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	64 #include "ssh.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	65 #include "packet.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	66 #include "algo.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	67
68 eee77ac31ccc cleaning up the pubkey defines Matt Johnston <matt@ucc.asn.au> parents: 51 diff changeset	68 #ifdef ENABLE_SVR_PUBKEY_AUTH
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	69
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	70 #define MIN_AUTHKEYS_LINE 10 /* "ssh-rsa AB" - short but doesn't matter */
51 095d689fed16 - Hostkey checking is mostly there, just aren't appending yet. Matt Johnston <matt@ucc.asn.au> parents: 44 diff changeset	71 #define MAX_AUTHKEYS_LINE 4200 /* max length of a line in authkeys */
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	72
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	73 static int checkpubkey(unsigned char* algo, unsigned int algolen,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	74 unsigned char* keyblob, unsigned int keybloblen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	75 static int checkpubkeyperms();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	76 static void send_msg_userauth_pk_ok(unsigned char* algo, unsigned int algolen,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	77 unsigned char* keyblob, unsigned int keybloblen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	78 static int checkfileperm(char * filename);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	79
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	80 /* process a pubkey auth request, sending success or failure message as
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	81 * appropriate */
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 4 diff changeset	82 void svr_auth_pubkey() {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	83
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	84 unsigned char testkey; /* whether we're just checking if a key is usable */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	85 unsigned char* algo = NULL; /* pubkey algo */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	86 unsigned int algolen;
70 b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	87 unsigned char* keyblob = NULL;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	88 unsigned int keybloblen;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	89 buffer * signbuf = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	90 sign_key * key = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	91 char* fp = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	92 int type = -1;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	93
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	94 TRACE(("enter pubkeyauth"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	95
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	96 /* 0 indicates user just wants to check if key can be used, 1 is an
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	97 * actual attempt*/
179 161557a9dde8 * fix longstanding bug with connections being closed on failure to Matt Johnston <matt@ucc.asn.au> parents: 165 diff changeset	98 testkey = (buf_getbool(ses.payload) == 0);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	99
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	100 algo = buf_getstring(ses.payload, &algolen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	101 keybloblen = buf_getint(ses.payload);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	102 keyblob = buf_getptr(ses.payload, keybloblen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	103
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	104 /* check if the key is valid */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	105 if (checkpubkey(algo, algolen, keyblob, keybloblen) == DROPBEAR_FAILURE) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	106 send_msg_userauth_failure(0, 0);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	107 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	108 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	109
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	110 /* let them know that the key is ok to use */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	111 if (testkey) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	112 send_msg_userauth_pk_ok(algo, algolen, keyblob, keybloblen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	113 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	114 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	115
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	116 /* now we can actually verify the signature */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	117
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	118 /* get the key */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	119 key = new_sign_key();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	120 type = DROPBEAR_SIGNKEY_ANY;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	121 if (buf_get_pub_key(ses.payload, key, &type) == DROPBEAR_FAILURE) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	122 send_msg_userauth_failure(0, 1);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	123 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	124 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	125
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	126 /* create the data which has been signed - this a string containing
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	127 * session_id, concatenated with the payload packet up to the signature */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	128 signbuf = buf_new(ses.payload->pos + 4 + SHA1_HASH_SIZE);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	129 buf_putstring(signbuf, ses.session_id, SHA1_HASH_SIZE);
44 45edf30ea0a6 Improved signkey code Matt Johnston <matt@ucc.asn.au> parents: 33 diff changeset	130 buf_putbytes(signbuf, ses.payload->data, ses.payload->pos);
45edf30ea0a6 Improved signkey code Matt Johnston <matt@ucc.asn.au> parents: 33 diff changeset	131 buf_setpos(signbuf, 0);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	132
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	133 /* ... and finally verify the signature */
51 095d689fed16 - Hostkey checking is mostly there, just aren't appending yet. Matt Johnston <matt@ucc.asn.au> parents: 44 diff changeset	134 fp = sign_key_fingerprint(keyblob, keybloblen);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	135 if (buf_verify(ses.payload, key, buf_getptr(signbuf, signbuf->len),
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	136 signbuf->len) == DROPBEAR_SUCCESS) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	137 dropbear_log(LOG_NOTICE,
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 70 diff changeset	138 "pubkey auth succeeded for '%s' with key %s from %s",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	139 ses.authstate.pw_name, fp, svr_ses.addrstring);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	140 send_msg_userauth_success();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	141 } else {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	142 dropbear_log(LOG_WARNING,
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 70 diff changeset	143 "pubkey auth bad signature for '%s' with key %s from %s",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	144 ses.authstate.pw_name, fp, svr_ses.addrstring);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	145 send_msg_userauth_failure(0, 1);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	146 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	147 m_free(fp);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	148
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	149 out:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	150 /* cleanup stuff */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	151 if (signbuf) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	152 buf_free(signbuf);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	153 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	154 if (algo) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	155 m_free(algo);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	156 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	157 if (key) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	158 sign_key_free(key);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	159 key = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	160 }
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	161 TRACE(("leave pubkeyauth"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	162 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	163
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	164 /* Reply that the key is valid for auth, this is sent when the user sends
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	165 * a straight copy of their pubkey to test, to avoid having to perform
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	166 * expensive signing operations with a worthless key */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	167 static void send_msg_userauth_pk_ok(unsigned char* algo, unsigned int algolen,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	168 unsigned char* keyblob, unsigned int keybloblen) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	169
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	170 TRACE(("enter send_msg_userauth_pk_ok"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	171 CHECKCLEARTOWRITE();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	172
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	173 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_PK_OK);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	174 buf_putstring(ses.writepayload, algo, algolen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	175 buf_putstring(ses.writepayload, keyblob, keybloblen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	176
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	177 encrypt_packet();
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	178 TRACE(("leave send_msg_userauth_pk_ok"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	179
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	180 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	181
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	182 /* Checks whether a specified publickey (and associated algorithm) is an
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	183 * acceptable key for authentication */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	184 /* Returns DROPBEAR_SUCCESS if key is ok for auth, DROPBEAR_FAILURE otherwise */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	185 static int checkpubkey(unsigned char* algo, unsigned int algolen,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	186 unsigned char* keyblob, unsigned int keybloblen) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	187
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	188 FILE * authfile = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	189 char * filename = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	190 int ret = DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	191 buffer * line = NULL;
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	192 unsigned int len, pos;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	193 buffer * options_buf = NULL;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	194 int line_num;
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	195
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	196 TRACE(("enter checkpubkey"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	197
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	198 /* check that we can use the algo */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	199 if (have_algo(algo, algolen, sshhostkey) == DROPBEAR_FAILURE) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	200 dropbear_log(LOG_WARNING,
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 70 diff changeset	201 "pubkey auth attempt with unknown algo for '%s' from %s",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	202 ses.authstate.pw_name, svr_ses.addrstring);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	203 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	204 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	205
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	206 /* check file permissions, also whether file exists */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	207 if (checkpubkeyperms() == DROPBEAR_FAILURE) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	208 TRACE(("bad authorized_keys permissions, or file doesn't exist"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	209 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	210 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	211
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	212 /* we don't need to check pw and pw_dir for validity, since
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	213 * its been done in checkpubkeyperms. */
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	214 len = strlen(ses.authstate.pw_dir);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	215 /* allocate max required pathname storage,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	216 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	217 filename = m_malloc(len + 22);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	218 snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	219 ses.authstate.pw_dir);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	220
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	221 /* open the file */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	222 authfile = fopen(filename, "r");
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	223 if (authfile == NULL) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	224 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	225 }
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	226 TRACE(("checkpubkey: opened authorized_keys OK"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	227
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	228 line = buf_new(MAX_AUTHKEYS_LINE);
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	229 line_num = 0;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	230
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	231 /* iterate through the lines */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	232 do {
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	233 /* new line : potentially new options */
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	234 if (options_buf) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	235 buf_free(options_buf);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	236 options_buf = NULL;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	237 }
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	238
51 095d689fed16 - Hostkey checking is mostly there, just aren't appending yet. Matt Johnston <matt@ucc.asn.au> parents: 44 diff changeset	239 if (buf_getline(line, authfile) == DROPBEAR_FAILURE) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	240 /* EOF reached */
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	241 TRACE(("checkpubkey: authorized_keys EOF reached"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	242 break;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	243 }
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	244 line_num++;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	245
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	246 if (line->len < MIN_AUTHKEYS_LINE) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	247 TRACE(("checkpubkey: line too short"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	248 continue; /* line is too short for it to be a valid key */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	249 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	250
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	251 /* check the key type - will fail if there are options */
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	252 TRACE(("a line!"))
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	253
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	254 if (strncmp(buf_getptr(line, algolen), algo, algolen) != 0) {
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	255 int is_comment = 0;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	256 char *options_start = NULL;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	257 int options_len = 0;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	258 int escape, quoted;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	259
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	260 /* skip over any comments or leading whitespace */
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	261 while (line->pos < line->len) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	262 const char c = buf_getbyte(line);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	263 if (c == ' ' \|\| c == '\t') {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	264 continue;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	265 } else if (c == '#') {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	266 is_comment = 1;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	267 break;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	268 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	269 buf_incrpos(line, -1);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	270 break;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	271 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	272 if (is_comment) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	273 /* next line */
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	274 continue;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	275 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	276
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	277 /* remember start of options */
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	278 options_start = buf_getptr(line, 1);
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	279 quoted = 0;
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	280 escape = 0;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	281 options_len = 0;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	282
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	283 /* figure out where the options are */
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	284 while (line->pos < line->len) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	285 const char c = buf_getbyte(line);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	286 if (!quoted && (c == ' ' \|\| c == '\t')) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	287 break;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	288 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	289 escape = (!escape && c == '\\');
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	290 if (!escape && c == '"') {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	291 quoted = !quoted;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	292 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	293 options_len++;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	294 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	295 options_buf = buf_new(options_len);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	296 buf_putbytes(options_buf, options_start, options_len);
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	297
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	298 /* compare the algorithm */
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	299 if (line->pos + algolen > line->len) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	300 continue;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	301 }
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	302 if (strncmp(buf_getptr(line, algolen), algo, algolen) != 0) {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	303 continue;
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	304 }
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	305 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	306 buf_incrpos(line, algolen);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	307
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	308 /* check for space (' ') character */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	309 if (buf_getbyte(line) != ' ') {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	310 TRACE(("checkpubkey: space character expected, isn't there"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	311 continue;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	312 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	313
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	314 /* truncate the line at the space after the base64 data */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	315 pos = line->pos;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	316 for (len = 0; line->pos < line->len; len++) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	317 if (buf_getbyte(line) == ' ') break;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	318 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	319 buf_setpos(line, pos);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	320 buf_setlen(line, line->pos + len);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	321
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	322 TRACE(("checkpubkey: line pos = %d len = %d", line->pos, line->len))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	323
436 7282370416a0 Improve known_hosts checking. Matt Johnston <matt@ucc.asn.au> parents: 248 diff changeset	324 ret = cmp_base64_key(keyblob, keybloblen, algo, algolen, line, NULL);
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	325
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	326 if (ret == DROPBEAR_SUCCESS && options_buf) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	327 ret = svr_add_pubkey_options(options_buf, line_num, filename);
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	328 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	329
51 095d689fed16 - Hostkey checking is mostly there, just aren't appending yet. Matt Johnston <matt@ucc.asn.au> parents: 44 diff changeset	330 if (ret == DROPBEAR_SUCCESS) {
095d689fed16 - Hostkey checking is mostly there, just aren't appending yet. Matt Johnston <matt@ucc.asn.au> parents: 44 diff changeset	331 break;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	332 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	333
51 095d689fed16 - Hostkey checking is mostly there, just aren't appending yet. Matt Johnston <matt@ucc.asn.au> parents: 44 diff changeset	334 /* We continue to the next line otherwise */
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	335
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	336 } while (1);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	337
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	338 out:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	339 if (authfile) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	340 fclose(authfile);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	341 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	342 if (line) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	343 buf_free(line);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	344 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	345 m_free(filename);
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	346 if (options_buf) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	347 buf_free(options_buf);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	348 }
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	349 TRACE(("leave checkpubkey: ret=%d", ret))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	350 return ret;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	351 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	352
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	353
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	354 /* Returns DROPBEAR_SUCCESS if file permissions for pubkeys are ok,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	355 * DROPBEAR_FAILURE otherwise.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	356 * Checks that the user's homedir, ~/.ssh, and
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	357 * ~/.ssh/authorized_keys are all owned by either root or the user, and are
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	358 * g-w, o-w */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	359 static int checkpubkeyperms() {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	360
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	361 char* filename = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	362 int ret = DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	363 unsigned int len;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	364
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	365 TRACE(("enter checkpubkeyperms"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	366
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	367 if (ses.authstate.pw_dir == NULL) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	368 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	369 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	370
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	371 if ((len = strlen(ses.authstate.pw_dir)) == 0) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	372 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	373 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	374
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	375 /* allocate max required pathname storage,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	376 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	377 filename = m_malloc(len + 22);
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	378 strncpy(filename, ses.authstate.pw_dir, len+1);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	379
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	380 /* check ~ */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	381 if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	382 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	383 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	384
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	385 /* check ~/.ssh */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	386 strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	387 if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	388 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	389 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	390
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	391 /* now check ~/.ssh/authorized_keys */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	392 strncat(filename, "/authorized_keys", 16);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	393 if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	394 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	395 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	396
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	397 /* file looks ok, return success */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	398 ret = DROPBEAR_SUCCESS;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	399
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	400 out:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	401 m_free(filename);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	402
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	403 TRACE(("leave checkpubkeyperms"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	404 return ret;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	405 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	406
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	407 /* Checks that a file is owned by the user or root, and isn't writable by
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	408 * group or other */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	409 /* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	410 static int checkfileperm(char * filename) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	411 struct stat filestat;
248 bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	412 int badperm = 0;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	413
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	414 TRACE(("enter checkfileperm(%s)", filename))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	415
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	416 if (stat(filename, &filestat) != 0) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	417 TRACE(("leave checkfileperm: stat() != 0"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	418 return DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	419 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	420 /* check ownership - user or root only*/
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 436 diff changeset	421 if (filestat.st_uid != ses.authstate.pw_uid
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	422 && filestat.st_uid != 0) {
248 bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	423 badperm = 1;
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	424 TRACE(("wrong ownership"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	425 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	426 /* check permissions - don't want group or others +w */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	427 if (filestat.st_mode & (S_IWGRP \| S_IWOTH)) {
248 bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	428 badperm = 1;
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	429 TRACE(("wrong perms"))
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	430 }
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	431 if (badperm) {
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	432 if (!ses.authstate.perm_warn) {
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	433 ses.authstate.perm_warn = 1;
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	434 dropbear_log(LOG_INFO, "%s must be owned by user or root, and not writable by others", filename);
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	435 }
bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	436 TRACE(("leave checkfileperm: failure perms/owner"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	437 return DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	438 }
248 bf64e666f99b Log when pubkey auth fails because of bad pubkey perms/ownership Matt Johnston <matt@ucc.asn.au> parents: 241 diff changeset	439
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	440 TRACE(("leave checkfileperm: success"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	441 return DROPBEAR_SUCCESS;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	442 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	443
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	444 #endif

Mercurial > dropbear

annotate svr-authpubkey.c @ 476:df7f7da7f6e4 pubkey-options