1 /* $NetBSD: monitor_wrap.c,v 1.32 2023/07/26 17:58:15 christos Exp $ */
2 /* $OpenBSD: monitor_wrap.c,v 1.126 2023/01/06 02:47:18 djm Exp $ */
3 /*
4 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
5 * Copyright 2002 Markus Friedl <markus@openbsd.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 #include "includes.h"
30 __RCSID("$NetBSD: monitor_wrap.c,v 1.32 2023/07/26 17:58:15 christos Exp $");
31 #include <sys/types.h>
32 #include <sys/uio.h>
33 #include <sys/queue.h>
34
35 #include <errno.h>
36 #include <pwd.h>
37 #include <signal.h>
38 #include <stdio.h>
39 #include <string.h>
40 #include <stdarg.h>
41 #include <unistd.h>
42
43 #ifdef WITH_OPENSSL
44 #include <openssl/bn.h>
45 #include <openssl/dh.h>
46 #endif
47
48 #include "xmalloc.h"
49 #include "ssh.h"
50 #ifdef WITH_OPENSSL
51 #include "dh.h"
52 #endif
53 #include "sshbuf.h"
54 #include "sshkey.h"
55 #include "cipher.h"
56 #include "kex.h"
57 #include "hostfile.h"
58 #include "auth.h"
59 #include "auth-options.h"
60 #include "packet.h"
61 #include "mac.h"
62 #include "log.h"
63 #include "monitor.h"
64 #ifdef GSSAPI
65 #include "ssh-gss.h"
66 #endif
67 #include "monitor_wrap.h"
68 #include "atomicio.h"
69 #include "monitor_fdpass.h"
70 #ifdef USE_PAM
71 #include "misc.h"
72 #include "servconf.h"
73 #include <security/pam_appl.h>
74 #endif
75 #include "misc.h"
76
77 #include "channels.h"
78 #include "session.h"
79 #include "servconf.h"
80
81 #include "ssherr.h"
82
83 /* Imports */
84 extern struct monitor *pmonitor;
85 extern struct sshbuf *loginmsg;
86 extern ServerOptions options;
87
88 void
mm_log_handler(LogLevel level,int forced,const char * msg,void * ctx)89 mm_log_handler(LogLevel level, int forced, const char *msg, void *ctx)
90 {
91 struct sshbuf *log_msg;
92 struct monitor *mon = (struct monitor *)ctx;
93 int r;
94 size_t len;
95
96 if (mon->m_log_sendfd == -1)
97 fatal_f("no log channel");
98
99 if ((log_msg = sshbuf_new()) == NULL)
100 fatal_f("sshbuf_new failed");
101
102 if ((r = sshbuf_put_u32(log_msg, 0)) != 0 || /* length; filled below */
103 (r = sshbuf_put_u32(log_msg, level)) != 0 ||
104 (r = sshbuf_put_u32(log_msg, forced)) != 0 ||
105 (r = sshbuf_put_cstring(log_msg, msg)) != 0)
106 fatal_fr(r, "assemble");
107 if ((len = sshbuf_len(log_msg)) < 4 || len > 0xffffffff)
108 fatal_f("bad length %zu", len);
109 POKE_U32(sshbuf_mutable_ptr(log_msg), len - 4);
110 if (atomicio(vwrite, mon->m_log_sendfd,
111 sshbuf_mutable_ptr(log_msg), len) != len)
112 fatal_f("write: %s", strerror(errno));
113 sshbuf_free(log_msg);
114 }
115
116 int
mm_is_monitor(void)117 mm_is_monitor(void)
118 {
119 /*
120 * m_pid is only set in the privileged part, and
121 * points to the unprivileged child.
122 */
123 return (pmonitor && pmonitor->m_pid > 0);
124 }
125
126 void
mm_request_send(int sock,enum monitor_reqtype type,struct sshbuf * m)127 mm_request_send(int sock, enum monitor_reqtype type, struct sshbuf *m)
128 {
129 size_t mlen = sshbuf_len(m);
130 u_char buf[5];
131
132 debug3_f("entering, type %d", type);
133
134 if (mlen >= 0xffffffff)
135 fatal_f("bad length %zu", mlen);
136 POKE_U32(buf, mlen + 1);
137 buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */
138 if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf))
139 fatal_f("write: %s", strerror(errno));
140 if (atomicio(vwrite, sock, sshbuf_mutable_ptr(m), mlen) != mlen)
141 fatal_f("write: %s", strerror(errno));
142 }
143
144 void
mm_request_receive(int sock,struct sshbuf * m)145 mm_request_receive(int sock, struct sshbuf *m)
146 {
147 u_char buf[4], *p = NULL;
148 u_int msg_len;
149 int r;
150
151 debug3_f("entering");
152
153 if (atomicio(read, sock, buf, sizeof(buf)) != sizeof(buf)) {
154 if (errno == EPIPE)
155 cleanup_exit(254);
156 fatal_f("read: %s", strerror(errno));
157 }
158 msg_len = PEEK_U32(buf);
159 if (msg_len > 256 * 1024)
160 fatal_f("read: bad msg_len %d", msg_len);
161 sshbuf_reset(m);
162 if ((r = sshbuf_reserve(m, msg_len, &p)) != 0)
163 fatal_fr(r, "reserve");
164 if (atomicio(read, sock, p, msg_len) != msg_len)
165 fatal_f("read: %s", strerror(errno));
166 }
167
168 void
mm_request_receive_expect(int sock,enum monitor_reqtype type,struct sshbuf * m)169 mm_request_receive_expect(int sock, enum monitor_reqtype type, struct sshbuf *m)
170 {
171 u_char rtype;
172 int r;
173
174 debug3_f("entering, type %d", type);
175
176 mm_request_receive(sock, m);
177 if ((r = sshbuf_get_u8(m, &rtype)) != 0)
178 fatal_fr(r, "parse");
179 if (rtype != type)
180 fatal_f("read: rtype %d != type %d", rtype, type);
181 }
182
183 #ifdef WITH_OPENSSL
184 DH *
mm_choose_dh(int min,int nbits,int max)185 mm_choose_dh(int min, int nbits, int max)
186 {
187 BIGNUM *p, *g;
188 int r;
189 u_char success = 0;
190 struct sshbuf *m;
191
192 if ((m = sshbuf_new()) == NULL)
193 fatal_f("sshbuf_new failed");
194 if ((r = sshbuf_put_u32(m, min)) != 0 ||
195 (r = sshbuf_put_u32(m, nbits)) != 0 ||
196 (r = sshbuf_put_u32(m, max)) != 0)
197 fatal_fr(r, "assemble");
198
199 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_MODULI, m);
200
201 debug3_f("waiting for MONITOR_ANS_MODULI");
202 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_MODULI, m);
203
204 if ((r = sshbuf_get_u8(m, &success)) != 0)
205 fatal_fr(r, "parse success");
206 if (success == 0)
207 fatal_f("MONITOR_ANS_MODULI failed");
208
209 if ((r = sshbuf_get_bignum2(m, &p)) != 0 ||
210 (r = sshbuf_get_bignum2(m, &g)) != 0)
211 fatal_fr(r, "parse group");
212
213 debug3_f("remaining %zu", sshbuf_len(m));
214 sshbuf_free(m);
215
216 return (dh_new_group(g, p));
217 }
218 #endif
219
220 int
mm_sshkey_sign(struct ssh * ssh,struct sshkey * key,u_char ** sigp,size_t * lenp,const u_char * data,size_t datalen,const char * hostkey_alg,const char * sk_provider,const char * sk_pin,u_int compat)221 mm_sshkey_sign(struct ssh *ssh, struct sshkey *key, u_char **sigp, size_t *lenp,
222 const u_char *data, size_t datalen, const char *hostkey_alg,
223 const char *sk_provider, const char *sk_pin, u_int compat)
224 {
225 struct kex *kex = *pmonitor->m_pkex;
226 struct sshbuf *m;
227 u_int ndx = kex->host_key_index(key, 0, ssh);
228 int r;
229
230 debug3_f("entering");
231 if ((m = sshbuf_new()) == NULL)
232 fatal_f("sshbuf_new failed");
233 if ((r = sshbuf_put_u32(m, ndx)) != 0 ||
234 (r = sshbuf_put_string(m, data, datalen)) != 0 ||
235 (r = sshbuf_put_cstring(m, hostkey_alg)) != 0 ||
236 (r = sshbuf_put_u32(m, compat)) != 0)
237 fatal_fr(r, "assemble");
238
239 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, m);
240
241 debug3_f("waiting for MONITOR_ANS_SIGN");
242 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SIGN, m);
243 if ((r = sshbuf_get_string(m, sigp, lenp)) != 0)
244 fatal_fr(r, "parse");
245 sshbuf_free(m);
246
247 return (0);
248 }
249
250 #define GETPW(b, id) \
251 do { \
252 if ((r = sshbuf_get_string_direct(b, &p, &len)) != 0) \
253 fatal_fr(r, "parse pw %s", #id); \
254 if (len != sizeof(pw->id)) \
255 fatal_fr(r, "bad length for %s", #id); \
256 memcpy(&pw->id, p, len); \
257 } while (0)
258
259 struct passwd *
mm_getpwnamallow(struct ssh * ssh,const char * username)260 mm_getpwnamallow(struct ssh *ssh, const char *username)
261 {
262 struct sshbuf *m;
263 struct passwd *pw;
264 size_t len;
265 u_int i;
266 ServerOptions *newopts;
267 int r;
268 u_char ok;
269 const u_char *p;
270
271 debug3_f("entering");
272
273 if ((m = sshbuf_new()) == NULL)
274 fatal_f("sshbuf_new failed");
275 if ((r = sshbuf_put_cstring(m, username)) != 0)
276 fatal_fr(r, "assemble");
277
278 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, m);
279
280 debug3_f("waiting for MONITOR_ANS_PWNAM");
281 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, m);
282
283 if ((r = sshbuf_get_u8(m, &ok)) != 0)
284 fatal_fr(r, "parse success");
285 if (ok == 0) {
286 pw = NULL;
287 goto out;
288 }
289
290 pw = xcalloc(sizeof(*pw), 1);
291 GETPW(m, pw_uid);
292 GETPW(m, pw_gid);
293 GETPW(m, pw_change);
294 GETPW(m, pw_expire);
295 if ((r = sshbuf_get_cstring(m, &pw->pw_name, NULL)) != 0 ||
296 (r = sshbuf_get_cstring(m, &pw->pw_passwd, NULL)) != 0 ||
297 (r = sshbuf_get_cstring(m, &pw->pw_gecos, NULL)) != 0 ||
298 (r = sshbuf_get_cstring(m, &pw->pw_class, NULL)) != 0 ||
299 (r = sshbuf_get_cstring(m, &pw->pw_dir, NULL)) != 0 ||
300 (r = sshbuf_get_cstring(m, &pw->pw_shell, NULL)) != 0)
301 fatal_fr(r, "parse pw");
302
303 out:
304 /* copy options block as a Match directive may have changed some */
305 if ((r = sshbuf_get_string_direct(m, &p, &len)) != 0)
306 fatal_fr(r, "parse opts");
307 if (len != sizeof(*newopts))
308 fatal_f("option block size mismatch");
309 newopts = xcalloc(sizeof(*newopts), 1);
310 memcpy(newopts, p, sizeof(*newopts));
311
312 #define M_CP_STROPT(x) do { \
313 if (newopts->x != NULL && \
314 (r = sshbuf_get_cstring(m, &newopts->x, NULL)) != 0) \
315 fatal_fr(r, "parse %s", #x); \
316 } while (0)
317 #define M_CP_STRARRAYOPT(x, nx) do { \
318 newopts->x = newopts->nx == 0 ? \
319 NULL : xcalloc(newopts->nx, sizeof(*newopts->x)); \
320 for (i = 0; i < newopts->nx; i++) { \
321 if ((r = sshbuf_get_cstring(m, \
322 &newopts->x[i], NULL)) != 0) \
323 fatal_fr(r, "parse %s", #x); \
324 } \
325 } while (0)
326 /* See comment in servconf.h */
327 COPY_MATCH_STRING_OPTS();
328 #undef M_CP_STROPT
329 #undef M_CP_STRARRAYOPT
330
331 copy_set_server_options(&options, newopts, 1);
332 log_change_level(options.log_level);
333 log_verbose_reset();
334 for (i = 0; i < options.num_log_verbose; i++)
335 log_verbose_add(options.log_verbose[i]);
336 process_permitopen(ssh, &options);
337 process_channel_timeouts(ssh, &options);
338 free(newopts);
339
340 sshbuf_free(m);
341
342 return (pw);
343 }
344
345 char *
mm_auth2_read_banner(void)346 mm_auth2_read_banner(void)
347 {
348 struct sshbuf *m;
349 char *banner;
350 int r;
351
352 debug3_f("entering");
353
354 if ((m = sshbuf_new()) == NULL)
355 fatal_f("sshbuf_new failed");
356 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, m);
357 sshbuf_reset(m);
358
359 mm_request_receive_expect(pmonitor->m_recvfd,
360 MONITOR_ANS_AUTH2_READ_BANNER, m);
361 if ((r = sshbuf_get_cstring(m, &banner, NULL)) != 0)
362 fatal_fr(r, "parse");
363 sshbuf_free(m);
364
365 /* treat empty banner as missing banner */
366 if (strlen(banner) == 0) {
367 free(banner);
368 banner = NULL;
369 }
370 return (banner);
371 }
372
373 /* Inform the privileged process about service and style */
374
375 void
mm_inform_authserv(char * service,char * style)376 mm_inform_authserv(char *service, char *style)
377 {
378 struct sshbuf *m;
379 int r;
380
381 debug3_f("entering");
382
383 if ((m = sshbuf_new()) == NULL)
384 fatal_f("sshbuf_new failed");
385 if ((r = sshbuf_put_cstring(m, service)) != 0 ||
386 (r = sshbuf_put_cstring(m, style ? style : "")) != 0)
387 fatal_fr(r, "assemble");
388
389 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, m);
390
391 sshbuf_free(m);
392 }
393
394 /* Do the password authentication */
395 int
mm_auth_password(struct ssh * ssh,const char * password)396 mm_auth_password(struct ssh *ssh, const char *password)
397 {
398 struct sshbuf *m;
399 int r;
400 u_int authenticated = 0;
401
402 debug3_f("entering");
403
404 if ((m = sshbuf_new()) == NULL)
405 fatal_f("sshbuf_new failed");
406 if ((r = sshbuf_put_cstring(m, password)) != 0)
407 fatal_fr(r, "assemble");
408 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHPASSWORD, m);
409
410 debug3_f("waiting for MONITOR_ANS_AUTHPASSWORD");
411 mm_request_receive_expect(pmonitor->m_recvfd,
412 MONITOR_ANS_AUTHPASSWORD, m);
413
414 if ((r = sshbuf_get_u32(m, &authenticated)) != 0)
415 fatal_fr(r, "parse");
416
417 sshbuf_free(m);
418
419 debug3_f("user %sauthenticated", authenticated ? "" : "not ");
420 return (authenticated);
421 }
422
423 int
mm_user_key_allowed(struct ssh * ssh,struct passwd * pw,struct sshkey * key,int pubkey_auth_attempt,struct sshauthopt ** authoptp)424 mm_user_key_allowed(struct ssh *ssh, struct passwd *pw, struct sshkey *key,
425 int pubkey_auth_attempt, struct sshauthopt **authoptp)
426 {
427 return (mm_key_allowed(MM_USERKEY, NULL, NULL, key,
428 pubkey_auth_attempt, authoptp));
429 }
430
431 int
mm_hostbased_key_allowed(struct ssh * ssh,struct passwd * pw,const char * user,const char * host,struct sshkey * key)432 mm_hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,
433 const char *user, const char *host, struct sshkey *key)
434 {
435 return (mm_key_allowed(MM_HOSTKEY, user, host, key, 0, NULL));
436 }
437
438 int
mm_key_allowed(enum mm_keytype type,const char * user,const char * host,struct sshkey * key,int pubkey_auth_attempt,struct sshauthopt ** authoptp)439 mm_key_allowed(enum mm_keytype type, const char *user, const char *host,
440 struct sshkey *key, int pubkey_auth_attempt, struct sshauthopt **authoptp)
441 {
442 struct sshbuf *m;
443 int r;
444 u_int allowed = 0;
445 struct sshauthopt *opts = NULL;
446
447 debug3_f("entering");
448
449 if (authoptp != NULL)
450 *authoptp = NULL;
451
452 if ((m = sshbuf_new()) == NULL)
453 fatal_f("sshbuf_new failed");
454 if ((r = sshbuf_put_u32(m, type)) != 0 ||
455 (r = sshbuf_put_cstring(m, user ? user : "")) != 0 ||
456 (r = sshbuf_put_cstring(m, host ? host : "")) != 0 ||
457 (r = sshkey_puts(key, m)) != 0 ||
458 (r = sshbuf_put_u32(m, pubkey_auth_attempt)) != 0)
459 fatal_fr(r, "assemble");
460
461 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, m);
462
463 debug3_f("waiting for MONITOR_ANS_KEYALLOWED");
464 mm_request_receive_expect(pmonitor->m_recvfd,
465 MONITOR_ANS_KEYALLOWED, m);
466
467 if ((r = sshbuf_get_u32(m, &allowed)) != 0)
468 fatal_fr(r, "parse");
469 if (allowed && type == MM_USERKEY &&
470 (r = sshauthopt_deserialise(m, &opts)) != 0)
471 fatal_fr(r, "sshauthopt_deserialise");
472 sshbuf_free(m);
473
474 if (authoptp != NULL) {
475 *authoptp = opts;
476 opts = NULL;
477 }
478 sshauthopt_free(opts);
479
480 return allowed;
481 }
482
483 /*
484 * This key verify needs to send the key type along, because the
485 * privileged parent makes the decision if the key is allowed
486 * for authentication.
487 */
488
489 int
mm_sshkey_verify(const struct sshkey * key,const u_char * sig,size_t siglen,const u_char * data,size_t datalen,const char * sigalg,u_int compat,struct sshkey_sig_details ** sig_detailsp)490 mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen,
491 const u_char *data, size_t datalen, const char *sigalg, u_int compat,
492 struct sshkey_sig_details **sig_detailsp)
493 {
494 struct sshbuf *m;
495 u_int encoded_ret = 0;
496 int r;
497 u_char sig_details_present, flags;
498 u_int counter;
499
500 debug3_f("entering");
501
502 if (sig_detailsp != NULL)
503 *sig_detailsp = NULL;
504 if ((m = sshbuf_new()) == NULL)
505 fatal_f("sshbuf_new failed");
506 if ((r = sshkey_puts(key, m)) != 0 ||
507 (r = sshbuf_put_string(m, sig, siglen)) != 0 ||
508 (r = sshbuf_put_string(m, data, datalen)) != 0 ||
509 (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
510 fatal_fr(r, "assemble");
511
512 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, m);
513
514 debug3_f("waiting for MONITOR_ANS_KEYVERIFY");
515 mm_request_receive_expect(pmonitor->m_recvfd,
516 MONITOR_ANS_KEYVERIFY, m);
517
518 if ((r = sshbuf_get_u32(m, &encoded_ret)) != 0 ||
519 (r = sshbuf_get_u8(m, &sig_details_present)) != 0)
520 fatal_fr(r, "parse");
521 if (sig_details_present && encoded_ret == 0) {
522 if ((r = sshbuf_get_u32(m, &counter)) != 0 ||
523 (r = sshbuf_get_u8(m, &flags)) != 0)
524 fatal_fr(r, "parse sig_details");
525 if (sig_detailsp != NULL) {
526 *sig_detailsp = xcalloc(1, sizeof(**sig_detailsp));
527 (*sig_detailsp)->sk_counter = counter;
528 (*sig_detailsp)->sk_flags = flags;
529 }
530 }
531
532 sshbuf_free(m);
533
534 if (encoded_ret != 0)
535 return SSH_ERR_SIGNATURE_INVALID;
536 return 0;
537 }
538
539 void
mm_send_keystate(struct ssh * ssh,struct monitor * monitor)540 mm_send_keystate(struct ssh *ssh, struct monitor *monitor)
541 {
542 struct sshbuf *m;
543 int r;
544
545 if ((m = sshbuf_new()) == NULL)
546 fatal_f("sshbuf_new failed");
547 if ((r = ssh_packet_get_state(ssh, m)) != 0)
548 fatal_fr(r, "ssh_packet_get_state");
549 mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, m);
550 debug3_f("Finished sending state");
551 sshbuf_free(m);
552 }
553
554 int
mm_pty_allocate(int * ptyfd,int * ttyfd,char * namebuf,size_t namebuflen)555 mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen)
556 {
557 struct sshbuf *m;
558 char *p, *msg;
559 u_int success = 0;
560 int tmp1 = -1, tmp2 = -1, r;
561
562 /* Kludge: ensure there are fds free to receive the pty/tty */
563 if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
564 (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
565 error_f("cannot allocate fds for pty");
566 if (tmp1 > 0)
567 close(tmp1);
568 if (tmp2 > 0)
569 close(tmp2);
570 return 0;
571 }
572 close(tmp1);
573 close(tmp2);
574
575 if ((m = sshbuf_new()) == NULL)
576 fatal_f("sshbuf_new failed");
577 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, m);
578
579 debug3_f("waiting for MONITOR_ANS_PTY");
580 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PTY, m);
581
582 if ((r = sshbuf_get_u32(m, &success)) != 0)
583 fatal_fr(r, "parse success");
584 if (success == 0) {
585 debug3_f("pty alloc failed");
586 sshbuf_free(m);
587 return (0);
588 }
589 if ((r = sshbuf_get_cstring(m, &p, NULL)) != 0 ||
590 (r = sshbuf_get_cstring(m, &msg, NULL)) != 0)
591 fatal_fr(r, "parse");
592 sshbuf_free(m);
593
594 strlcpy(namebuf, p, namebuflen); /* Possible truncation */
595 free(p);
596
597 if ((r = sshbuf_put(loginmsg, msg, strlen(msg))) != 0)
598 fatal_fr(r, "put loginmsg");
599 free(msg);
600
601 if ((*ptyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1 ||
602 (*ttyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1)
603 fatal_f("receive fds failed");
604
605 /* Success */
606 return (1);
607 }
608
609 void
mm_session_pty_cleanup2(Session * s)610 mm_session_pty_cleanup2(Session *s)
611 {
612 struct sshbuf *m;
613 int r;
614
615 if (s->ttyfd == -1)
616 return;
617 if ((m = sshbuf_new()) == NULL)
618 fatal_f("sshbuf_new failed");
619 if ((r = sshbuf_put_cstring(m, s->tty)) != 0)
620 fatal_fr(r, "assmble");
621 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTYCLEANUP, m);
622 sshbuf_free(m);
623
624 /* closed dup'ed master */
625 if (s->ptymaster != -1 && close(s->ptymaster) == -1)
626 error("close(s->ptymaster/%d): %s",
627 s->ptymaster, strerror(errno));
628
629 /* unlink pty from session */
630 s->ttyfd = -1;
631 }
632
633 #ifdef USE_PAM
634 void
mm_start_pam(struct ssh * ssh)635 mm_start_pam(struct ssh *ssh)
636 {
637 struct sshbuf *m;
638
639 debug3("%s entering", __func__);
640 if (!options.use_pam)
641 fatal("UsePAM=no, but ended up in %s anyway", __func__);
642
643 if ((m = sshbuf_new()) == NULL)
644 fatal("%s: sshbuf_new failed", __func__);
645 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, m);
646
647 sshbuf_free(m);
648 }
649
650 u_int
mm_do_pam_account(void)651 mm_do_pam_account(void)
652 {
653 struct sshbuf *m;
654 int r;
655 u_int ret;
656 size_t len;
657 char *msg;
658
659 debug3("%s entering", __func__);
660 if (!options.use_pam)
661 fatal("UsePAM=no, but ended up in %s anyway", __func__);
662
663 if ((m = sshbuf_new()) == NULL)
664 fatal("%s: sshbuf_new failed", __func__);
665 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_ACCOUNT, m);
666
667 mm_request_receive_expect(pmonitor->m_recvfd,
668 MONITOR_ANS_PAM_ACCOUNT, m);
669 if ((r = sshbuf_get_u32(m, &ret)) != 0 ||
670 (r = sshbuf_get_cstring(m, &msg, &len)) != 0)
671 fatal("%s: buffer error: %s", __func__, ssh_err(r));
672 sshbuf_put_cstring(loginmsg, msg);
673 free(msg);
674
675 sshbuf_free(m);
676
677 debug3("%s returning %d", __func__, ret);
678
679 return (ret);
680 }
681
682 void *
mm_sshpam_init_ctx(Authctxt * authctxt)683 mm_sshpam_init_ctx(Authctxt *authctxt)
684 {
685 struct sshbuf *m;
686 u_int success;
687 int r;
688
689 debug3("%s", __func__);
690 if ((m = sshbuf_new()) == NULL)
691 fatal("%s: sshbuf_new failed", __func__);
692 sshbuf_put_cstring(m, authctxt->user);
693 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, m);
694 debug3("%s: waiting for MONITOR_ANS_PAM_INIT_CTX", __func__);
695 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_INIT_CTX, m);
696 if ((r = sshbuf_get_u32(m, &success)) != 0)
697 fatal("%s: buffer error: %s", __func__, ssh_err(r));
698 if (success == 0) {
699 debug3("%s: pam_init_ctx failed", __func__);
700 sshbuf_free(m);
701 return (NULL);
702 }
703 sshbuf_free(m);
704 return (authctxt);
705 }
706
707 int
mm_sshpam_query(void * ctx,char ** name,char ** info,u_int * num,char *** prompts,u_int ** echo_on)708 mm_sshpam_query(void *ctx, char **name, char **info,
709 u_int *num, char ***prompts, u_int **echo_on)
710 {
711 struct sshbuf *m;
712 u_int i, ret;
713 int r;
714
715 debug3("%s", __func__);
716 if ((m = sshbuf_new()) == NULL)
717 fatal("%s: sshbuf_new failed", __func__);
718 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_QUERY, m);
719 debug3("%s: waiting for MONITOR_ANS_PAM_QUERY", __func__);
720 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_QUERY, m);
721 if ((r = sshbuf_get_u32(m, &ret)) != 0)
722 fatal("%s: buffer error: %s", __func__, ssh_err(r));
723 debug3("%s: pam_query returned %d", __func__, ret);
724 if ((r = sshbuf_get_cstring(m, name, NULL)) != 0 ||
725 (r = sshbuf_get_cstring(m, info, NULL)) != 0 ||
726 (r = sshbuf_get_u32(m, num)) != 0)
727 fatal("%s: buffer error: %s", __func__, ssh_err(r));
728 if (*num > PAM_MAX_NUM_MSG)
729 fatal("%s: received %u PAM messages, expected <= %u",
730 __func__, *num, PAM_MAX_NUM_MSG);
731 *prompts = xcalloc((*num + 1), sizeof(char *));
732 *echo_on = xcalloc((*num + 1), sizeof(u_int));
733 for (i = 0; i < *num; ++i) {
734 if ((r = sshbuf_get_cstring(m, &(*prompts)[i], NULL)) != 0 ||
735 (r = sshbuf_get_u32(m, (echo_on)[i])) != 0)
736 fatal("%s: buffer error: %s", __func__, ssh_err(r));
737 }
738 sshbuf_free(m);
739 return (ret);
740 }
741
742 int
mm_sshpam_respond(void * ctx,u_int num,char ** resp)743 mm_sshpam_respond(void *ctx, u_int num, char **resp)
744 {
745 struct sshbuf *m;
746 int r;
747 u_int i;
748 u_int ret;
749
750 debug3("%s", __func__);
751 if ((m = sshbuf_new()) == NULL)
752 fatal("%s: sshbuf_new failed", __func__);
753 sshbuf_put_u32(m, num);
754 for (i = 0; i < num; ++i)
755 sshbuf_put_cstring(m, resp[i]);
756 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_RESPOND, m);
757 debug3("%s: waiting for MONITOR_ANS_PAM_RESPOND", __func__);
758 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_RESPOND, m);
759 if ((r = sshbuf_get_u32(m, &ret)) != 0)
760 fatal("%s: buffer error: %s", __func__, ssh_err(r));
761 debug3("%s: pam_respond returned %d", __func__, ret);
762 sshbuf_free(m);
763 return (ret);
764 }
765
766 void
mm_sshpam_free_ctx(void * ctxtp)767 mm_sshpam_free_ctx(void *ctxtp)
768 {
769 struct sshbuf *m;
770
771 debug3("%s", __func__);
772 if ((m = sshbuf_new()) == NULL)
773 fatal("%s: sshbuf_new failed", __func__);
774 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_FREE_CTX, m);
775 debug3("%s: waiting for MONITOR_ANS_PAM_FREE_CTX", __func__);
776 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_FREE_CTX, m);
777 sshbuf_free(m);
778 }
779 #endif /* USE_PAM */
780
781 /* Request process termination */
782
783 void
mm_terminate(void)784 mm_terminate(void)
785 {
786 struct sshbuf *m;
787
788 if ((m = sshbuf_new()) == NULL)
789 fatal_f("sshbuf_new failed");
790 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_TERM, m);
791 sshbuf_free(m);
792 }
793
794 #if defined(BSD_AUTH) || defined(SKEY)
795 static void
mm_chall_setup(char ** name,char ** infotxt,u_int * numprompts,char *** prompts,u_int ** echo_on)796 mm_chall_setup(char **name, char **infotxt, u_int *numprompts,
797 char ***prompts, u_int **echo_on)
798 {
799 *name = xstrdup("");
800 *infotxt = xstrdup("");
801 *numprompts = 1;
802 *prompts = xcalloc(*numprompts, sizeof(char *));
803 *echo_on = xcalloc(*numprompts, sizeof(u_int));
804 (*echo_on)[0] = 0;
805 }
806
807 #ifdef BSD_AUTH
808 int
mm_bsdauth_query(void * ctx,char ** name,char ** infotxt,u_int * numprompts,char *** prompts,u_int ** echo_on)809 mm_bsdauth_query(void *ctx, char **name, char **infotxt,
810 u_int *numprompts, char ***prompts, u_int **echo_on)
811 {
812 struct sshbuf *m;
813 u_int success;
814 char *challenge;
815 int r;
816
817 debug3_f("entering");
818
819 if ((m = sshbuf_new()) == NULL)
820 fatal_f("sshbuf_new failed");
821 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHQUERY, m);
822
823 mm_request_receive_expect(pmonitor->m_recvfd,
824 MONITOR_ANS_BSDAUTHQUERY, m);
825 if ((r = sshbuf_get_u32(m, &success)) != 0)
826 fatal_fr(r, "parse success");
827 if (success == 0) {
828 debug3_f("no challenge");
829 sshbuf_free(m);
830 return (-1);
831 }
832
833 /* Get the challenge, and format the response */
834 if ((r = sshbuf_get_cstring(m, &challenge, NULL)) != 0)
835 fatal_fr(r, "parse challenge");
836 sshbuf_free(m);
837
838 mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
839 (*prompts)[0] = challenge;
840
841 debug3_f("received challenge: %s", challenge);
842
843 return (0);
844 }
845
846 int
mm_bsdauth_respond(void * ctx,u_int numresponses,char ** responses)847 mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses)
848 {
849 struct sshbuf *m;
850 int r, authok;
851
852 debug3_f("entering");
853 if (numresponses != 1)
854 return (-1);
855
856 if ((m = sshbuf_new()) == NULL)
857 fatal_f("sshbuf_new failed");
858 if ((r = sshbuf_put_cstring(m, responses[0])) != 0)
859 fatal_fr(r, "assemble");
860 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHRESPOND, m);
861
862 mm_request_receive_expect(pmonitor->m_recvfd,
863 MONITOR_ANS_BSDAUTHRESPOND, m);
864
865 if ((r = sshbuf_get_u32(m, &authok)) != 0)
866 fatal_fr(r, "parse");
867 sshbuf_free(m);
868
869 return ((authok == 0) ? -1 : 0);
870 }
871 #endif
872
873 #ifdef SKEY
874 int
mm_skey_query(void * ctx,char ** name,char ** infotxt,u_int * numprompts,char *** prompts,u_int ** echo_on)875 mm_skey_query(void *ctx, char **name, char **infotxt,
876 u_int *numprompts, char ***prompts, u_int **echo_on)
877 {
878 struct sshbuf m;
879 u_int success;
880 char *challenge;
881
882 debug3("%s: entering", __func__);
883
884 sshbuf_new(&m);
885 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYQUERY, &m);
886
887 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SKEYQUERY,
888 &m);
889 success = sshbuf_get_int(&m);
890 if (success == 0) {
891 debug3("%s: no challenge", __func__);
892 sshbuf_free(&m);
893 return (-1);
894 }
895
896 /* Get the challenge, and format the response */
897 challenge = sshbuf_get_string(&m, NULL);
898 sshbuf_free(&m);
899
900 debug3("%s: received challenge: %s", __func__, challenge);
901
902 mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
903
904 xasprintf(*prompts, "%s%s", challenge, SKEY_PROMPT);
905 free(challenge);
906
907 return (0);
908 }
909
910 int
mm_skey_respond(void * ctx,u_int numresponses,char ** responses)911 mm_skey_respond(void *ctx, u_int numresponses, char **responses)
912 {
913 struct sshbuf m;
914 int authok;
915
916 debug3("%s: entering", __func__);
917 if (numresponses != 1)
918 return (-1);
919
920 sshbuf_new(&m);
921 sshbuf_put_cstring(&m, responses[0]);
922 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYRESPOND, &m);
923
924 mm_request_receive_expect(pmonitor->m_recvfd,
925 MONITOR_ANS_SKEYRESPOND, &m);
926
927 authok = sshbuf_get_int(&m);
928 sshbuf_free(&m);
929
930 return ((authok == 0) ? -1 : 0);
931 }
932 #endif /* SKEY */
933 #endif /* BSDAUTH || SKEY */
934
935 #ifdef GSSAPI
936 OM_uint32
mm_ssh_gssapi_server_ctx(Gssctxt ** ctx,gss_OID goid)937 mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)
938 {
939 struct sshbuf *m;
940 OM_uint32 major;
941 int r;
942
943 /* Client doesn't get to see the context */
944 *ctx = NULL;
945
946 if ((m = sshbuf_new()) == NULL)
947 fatal_f("sshbuf_new failed");
948 if ((r = sshbuf_put_string(m, goid->elements, goid->length)) != 0)
949 fatal_fr(r, "assemble");
950
951 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSETUP, m);
952 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSETUP, m);
953
954 if ((r = sshbuf_get_u32(m, &major)) != 0)
955 fatal_fr(r, "parse");
956
957 sshbuf_free(m);
958 return (major);
959 }
960
961 OM_uint32
mm_ssh_gssapi_accept_ctx(Gssctxt * ctx,gss_buffer_desc * in,gss_buffer_desc * out,OM_uint32 * flagsp)962 mm_ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *in,
963 gss_buffer_desc *out, OM_uint32 *flagsp)
964 {
965 struct sshbuf *m;
966 OM_uint32 major;
967 u_int flags;
968 int r;
969
970 if ((m = sshbuf_new()) == NULL)
971 fatal_f("sshbuf_new failed");
972 if ((r = sshbuf_put_string(m, in->value, in->length)) != 0)
973 fatal_fr(r, "assemble");
974
975 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSTEP, m);
976 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSTEP, m);
977
978 if ((r = sshbuf_get_u32(m, &major)) != 0 ||
979 (r = ssh_gssapi_get_buffer_desc(m, out)) != 0)
980 fatal_fr(r, "parse");
981 if (flagsp != NULL) {
982 if ((r = sshbuf_get_u32(m, &flags)) != 0)
983 fatal_fr(r, "parse flags");
984 *flagsp = flags;
985 }
986
987 sshbuf_free(m);
988
989 return (major);
990 }
991
992 OM_uint32
mm_ssh_gssapi_checkmic(Gssctxt * ctx,gss_buffer_t gssbuf,gss_buffer_t gssmic)993 mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
994 {
995 struct sshbuf *m;
996 OM_uint32 major;
997 int r;
998
999 if ((m = sshbuf_new()) == NULL)
1000 fatal_f("sshbuf_new failed");
1001 if ((r = sshbuf_put_string(m, gssbuf->value, gssbuf->length)) != 0 ||
1002 (r = sshbuf_put_string(m, gssmic->value, gssmic->length)) != 0)
1003 fatal_fr(r, "assemble");
1004
1005 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSCHECKMIC, m);
1006 mm_request_receive_expect(pmonitor->m_recvfd,
1007 MONITOR_ANS_GSSCHECKMIC, m);
1008
1009 if ((r = sshbuf_get_u32(m, &major)) != 0)
1010 fatal_fr(r, "parse");
1011 sshbuf_free(m);
1012 return(major);
1013 }
1014
1015 int
mm_ssh_gssapi_userok(char * user)1016 mm_ssh_gssapi_userok(char *user)
1017 {
1018 struct sshbuf *m;
1019 int r;
1020 u_int authenticated = 0;
1021
1022 if ((m = sshbuf_new()) == NULL)
1023 fatal_f("sshbuf_new failed");
1024
1025 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
1026 mm_request_receive_expect(pmonitor->m_recvfd,
1027 MONITOR_ANS_GSSUSEROK, m);
1028
1029 if ((r = sshbuf_get_u32(m, &authenticated)) != 0)
1030 fatal_fr(r, "parse");
1031
1032 sshbuf_free(m);
1033 debug3_f("user %sauthenticated", authenticated ? "" : "not ");
1034 return (authenticated);
1035 }
1036 #endif /* GSSAPI */
1037
1038 #ifdef KRB5
1039 int
mm_auth_krb5(void * ctx,void * argp,char ** userp,void * resp)1040 mm_auth_krb5(void *ctx, void *argp, char **userp, void *resp)
1041 {
1042 krb5_data *tkt, *reply;
1043 struct sshbuf *m;
1044 u_int success;
1045 int r;
1046
1047 debug3("%s entering", __func__);
1048 tkt = (krb5_data *) argp;
1049 reply = (krb5_data *) resp;
1050
1051 if ((m = sshbuf_new()) == NULL)
1052 fatal("%s: sshbuf_new failed", __func__);
1053 sshbuf_put_string(m, tkt->data, tkt->length);
1054
1055 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB5, m);
1056 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB5, m);
1057
1058 if ((r = sshbuf_get_u32(m, &success)) != 0)
1059 fatal("%s: buffer error: %s", __func__, ssh_err(r));
1060 if (success) {
1061 size_t len;
1062 u_char *data;
1063
1064 if ((r = sshbuf_get_cstring(m, userp, NULL)) != 0 ||
1065 (r = sshbuf_get_string(m, &data, &len)) != 0)
1066 fatal("%s: buffer error: %s", __func__, ssh_err(r));
1067 reply->data = data;
1068 reply->length = len;
1069 } else {
1070 memset(reply, 0, sizeof(*reply));
1071 *userp = NULL;
1072 }
1073
1074 sshbuf_free(m);
1075 return (success);
1076 }
1077 #endif
1078