Deleted Added
sdiff udiff text old ( 113911 ) new ( 124211 )
full compact
monitor_wrap.c (113911) monitor_wrap.c (124211)
1/*
2 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
3 * Copyright 2002 Markus Friedl <markus@openbsd.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:

--- 11 unchanged lines hidden (view full) ---

20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
1/*
2 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
3 * Copyright 2002 Markus Friedl <markus@openbsd.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:

--- 11 unchanged lines hidden (view full) ---

20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28RCSID("$OpenBSD: monitor_wrap.c,v 1.24 2003/04/01 10:22:21 markus Exp $");
29RCSID("$FreeBSD: head/crypto/openssh/monitor_wrap.c 113911 2003-04-23 17:13:13Z des $");
28RCSID("$OpenBSD: monitor_wrap.c,v 1.31 2003/08/28 12:54:34 markus Exp $");
29RCSID("$FreeBSD: head/crypto/openssh/monitor_wrap.c 124211 2004-01-07 11:16:27Z des $");
30
31#include <openssl/bn.h>
32#include <openssl/dh.h>
33
34#include "ssh.h"
35#include "dh.h"
36#include "kex.h"
37#include "auth.h"

--- 5 unchanged lines hidden (view full) ---

43#include "log.h"
44#include "zlib.h"
45#include "monitor.h"
46#include "monitor_wrap.h"
47#include "xmalloc.h"
48#include "atomicio.h"
49#include "monitor_fdpass.h"
50#include "getput.h"
30
31#include <openssl/bn.h>
32#include <openssl/dh.h>
33
34#include "ssh.h"
35#include "dh.h"
36#include "kex.h"
37#include "auth.h"

--- 5 unchanged lines hidden (view full) ---

43#include "log.h"
44#include "zlib.h"
45#include "monitor.h"
46#include "monitor_wrap.h"
47#include "xmalloc.h"
48#include "atomicio.h"
49#include "monitor_fdpass.h"
50#include "getput.h"
51#include "servconf.h"
51
52#include "auth.h"
53#include "channels.h"
54#include "session.h"
55
52
53#include "auth.h"
54#include "channels.h"
55#include "session.h"
56
57#ifdef GSSAPI
58#include "ssh-gss.h"
59#endif
60
56/* Imports */
57extern int compat20;
58extern Newkeys *newkeys[];
59extern z_stream incoming_stream;
60extern z_stream outgoing_stream;
61extern struct monitor *pmonitor;
62extern Buffer input, output;
61/* Imports */
62extern int compat20;
63extern Newkeys *newkeys[];
64extern z_stream incoming_stream;
65extern z_stream outgoing_stream;
66extern struct monitor *pmonitor;
67extern Buffer input, output;
68extern ServerOptions options;
63
64void
65mm_request_send(int socket, enum monitor_reqtype type, Buffer *m)
66{
67 u_int mlen = buffer_len(m);
68 u_char buf[5];
69
70 debug3("%s entering: type %d", __func__, type);
71
72 PUT_32BIT(buf, mlen + 1);
73 buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */
69
70void
71mm_request_send(int socket, enum monitor_reqtype type, Buffer *m)
72{
73 u_int mlen = buffer_len(m);
74 u_char buf[5];
75
76 debug3("%s entering: type %d", __func__, type);
77
78 PUT_32BIT(buf, mlen + 1);
79 buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */
74 if (atomicio(write, socket, buf, sizeof(buf)) != sizeof(buf))
80 if (atomicio(vwrite, socket, buf, sizeof(buf)) != sizeof(buf))
75 fatal("%s: write", __func__);
81 fatal("%s: write", __func__);
76 if (atomicio(write, socket, buffer_ptr(m), mlen) != mlen)
82 if (atomicio(vwrite, socket, buffer_ptr(m), mlen) != mlen)
77 fatal("%s: write", __func__);
78}
79
80void
81mm_request_receive(int socket, Buffer *m)
82{
83 u_char buf[4];
84 u_int msg_len;

--- 431 unchanged lines hidden (view full) ---

516}
517
518void
519mm_send_keystate(struct monitor *pmonitor)
520{
521 Buffer m;
522 u_char *blob, *p;
523 u_int bloblen, plen;
83 fatal("%s: write", __func__);
84}
85
86void
87mm_request_receive(int socket, Buffer *m)
88{
89 u_char buf[4];
90 u_int msg_len;

--- 431 unchanged lines hidden (view full) ---

522}
523
524void
525mm_send_keystate(struct monitor *pmonitor)
526{
527 Buffer m;
528 u_char *blob, *p;
529 u_int bloblen, plen;
530 u_int32_t seqnr, packets;
531 u_int64_t blocks;
524
525 buffer_init(&m);
526
527 if (!compat20) {
528 u_char iv[24];
529 u_char *key;
530 u_int ivlen, keylen;
531

--- 32 unchanged lines hidden (view full) ---

564 xfree(blob);
565
566 if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
567 fatal("%s: conversion of newkeys failed", __func__);
568
569 buffer_put_string(&m, blob, bloblen);
570 xfree(blob);
571
532
533 buffer_init(&m);
534
535 if (!compat20) {
536 u_char iv[24];
537 u_char *key;
538 u_int ivlen, keylen;
539

--- 32 unchanged lines hidden (view full) ---

572 xfree(blob);
573
574 if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
575 fatal("%s: conversion of newkeys failed", __func__);
576
577 buffer_put_string(&m, blob, bloblen);
578 xfree(blob);
579
572 buffer_put_int(&m, packet_get_seqnr(MODE_OUT));
573 buffer_put_int(&m, packet_get_seqnr(MODE_IN));
580 packet_get_state(MODE_OUT, &seqnr, &blocks, &packets);
581 buffer_put_int(&m, seqnr);
582 buffer_put_int64(&m, blocks);
583 buffer_put_int(&m, packets);
584 packet_get_state(MODE_IN, &seqnr, &blocks, &packets);
585 buffer_put_int(&m, seqnr);
586 buffer_put_int64(&m, blocks);
587 buffer_put_int(&m, packets);
574
575 debug3("%s: New keys have been sent", __func__);
576 skip:
577 /* More key context */
578 plen = packet_get_keycontext(MODE_OUT, NULL);
579 p = xmalloc(plen+1);
580 packet_get_keycontext(MODE_OUT, p);
581 buffer_put_string(&m, p, plen);

--- 75 unchanged lines hidden (view full) ---

657
658#ifdef USE_PAM
659void
660mm_start_pam(char *user)
661{
662 Buffer m;
663
664 debug3("%s entering", __func__);
588
589 debug3("%s: New keys have been sent", __func__);
590 skip:
591 /* More key context */
592 plen = packet_get_keycontext(MODE_OUT, NULL);
593 p = xmalloc(plen+1);
594 packet_get_keycontext(MODE_OUT, p);
595 buffer_put_string(&m, p, plen);

--- 75 unchanged lines hidden (view full) ---

671
672#ifdef USE_PAM
673void
674mm_start_pam(char *user)
675{
676 Buffer m;
677
678 debug3("%s entering", __func__);
679 if (!options.use_pam)
680 fatal("UsePAM=no, but ended up in %s anyway", __func__);
665
666 buffer_init(&m);
667 buffer_put_cstring(&m, user);
668
669 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, &m);
670
671 buffer_free(&m);
672}
673
681
682 buffer_init(&m);
683 buffer_put_cstring(&m, user);
684
685 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, &m);
686
687 buffer_free(&m);
688}
689
690u_int
691mm_do_pam_account(void)
692{
693 Buffer m;
694 u_int ret;
695
696 debug3("%s entering", __func__);
697 if (!options.use_pam)
698 fatal("UsePAM=no, but ended up in %s anyway", __func__);
699
700 buffer_init(&m);
701 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_ACCOUNT, &m);
702
703 mm_request_receive_expect(pmonitor->m_recvfd,
704 MONITOR_ANS_PAM_ACCOUNT, &m);
705 ret = buffer_get_int(&m);
706
707 buffer_free(&m);
708
709 debug3("%s returning %d", __func__, ret);
710
711 return (ret);
712}
713
674void *
714void *
675mm_pam_init_ctx(Authctxt *authctxt)
715mm_sshpam_init_ctx(Authctxt *authctxt)
676{
677 Buffer m;
678 int success;
679
680 debug3("%s", __func__);
681 buffer_init(&m);
682 buffer_put_cstring(&m, authctxt->user);
683 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, &m);

--- 5 unchanged lines hidden (view full) ---

689 buffer_free(&m);
690 return (NULL);
691 }
692 buffer_free(&m);
693 return (authctxt);
694}
695
696int
716{
717 Buffer m;
718 int success;
719
720 debug3("%s", __func__);
721 buffer_init(&m);
722 buffer_put_cstring(&m, authctxt->user);
723 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, &m);

--- 5 unchanged lines hidden (view full) ---

729 buffer_free(&m);
730 return (NULL);
731 }
732 buffer_free(&m);
733 return (authctxt);
734}
735
736int
697mm_pam_query(void *ctx, char **name, char **info,
737mm_sshpam_query(void *ctx, char **name, char **info,
698 u_int *num, char ***prompts, u_int **echo_on)
699{
700 Buffer m;
701 int i, ret;
702
703 debug3("%s", __func__);
704 buffer_init(&m);
705 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_QUERY, &m);

--- 10 unchanged lines hidden (view full) ---

716 (*prompts)[i] = buffer_get_string(&m, NULL);
717 (*echo_on)[i] = buffer_get_int(&m);
718 }
719 buffer_free(&m);
720 return (ret);
721}
722
723int
738 u_int *num, char ***prompts, u_int **echo_on)
739{
740 Buffer m;
741 int i, ret;
742
743 debug3("%s", __func__);
744 buffer_init(&m);
745 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_QUERY, &m);

--- 10 unchanged lines hidden (view full) ---

756 (*prompts)[i] = buffer_get_string(&m, NULL);
757 (*echo_on)[i] = buffer_get_int(&m);
758 }
759 buffer_free(&m);
760 return (ret);
761}
762
763int
724mm_pam_respond(void *ctx, u_int num, char **resp)
764mm_sshpam_respond(void *ctx, u_int num, char **resp)
725{
726 Buffer m;
727 int i, ret;
728
729 debug3("%s", __func__);
730 buffer_init(&m);
731 buffer_put_int(&m, num);
732 for (i = 0; i < num; ++i)
733 buffer_put_cstring(&m, resp[i]);
734 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_RESPOND, &m);
735 debug3("%s: waiting for MONITOR_ANS_PAM_RESPOND", __func__);
736 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_RESPOND, &m);
737 ret = buffer_get_int(&m);
738 debug3("%s: pam_respond returned %d", __func__, ret);
739 buffer_free(&m);
740 return (ret);
741}
742
743void
765{
766 Buffer m;
767 int i, ret;
768
769 debug3("%s", __func__);
770 buffer_init(&m);
771 buffer_put_int(&m, num);
772 for (i = 0; i < num; ++i)
773 buffer_put_cstring(&m, resp[i]);
774 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_RESPOND, &m);
775 debug3("%s: waiting for MONITOR_ANS_PAM_RESPOND", __func__);
776 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_RESPOND, &m);
777 ret = buffer_get_int(&m);
778 debug3("%s: pam_respond returned %d", __func__, ret);
779 buffer_free(&m);
780 return (ret);
781}
782
783void
744mm_pam_free_ctx(void *ctxtp)
784mm_sshpam_free_ctx(void *ctxtp)
745{
746 Buffer m;
747
748 debug3("%s", __func__);
749 buffer_init(&m);
750 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_FREE_CTX, &m);
751 debug3("%s: waiting for MONITOR_ANS_PAM_FREE_CTX", __func__);
752 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_FREE_CTX, &m);

--- 276 unchanged lines hidden (view full) ---

1029 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSARESPONSE, &m);
1030
1031 success = buffer_get_int(&m);
1032 buffer_free(&m);
1033
1034 return (success);
1035}
1036
785{
786 Buffer m;
787
788 debug3("%s", __func__);
789 buffer_init(&m);
790 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_FREE_CTX, &m);
791 debug3("%s: waiting for MONITOR_ANS_PAM_FREE_CTX", __func__);
792 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_FREE_CTX, &m);

--- 276 unchanged lines hidden (view full) ---

1069 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSARESPONSE, &m);
1070
1071 success = buffer_get_int(&m);
1072 buffer_free(&m);
1073
1074 return (success);
1075}
1076
1037#ifdef KRB4
1038int
1039mm_auth_krb4(Authctxt *authctxt, void *_auth, char **client, void *_reply)
1077#ifdef GSSAPI
1078OM_uint32
1079mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
1040{
1080{
1041 KTEXT auth, reply;
1042 Buffer m;
1043 u_int rlen;
1044 int success = 0;
1045 char *p;
1081 Buffer m;
1082 OM_uint32 major;
1046
1083
1047 debug3("%s entering", __func__);
1048 auth = _auth;
1049 reply = _reply;
1084 /* Client doesn't get to see the context */
1085 *ctx = NULL;
1050
1051 buffer_init(&m);
1086
1087 buffer_init(&m);
1052 buffer_put_string(&m, auth->dat, auth->length);
1088 buffer_put_string(&m, oid->elements, oid->length);
1053
1089
1054 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB4, &m);
1055 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB4, &m);
1090 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSETUP, &m);
1091 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSETUP, &m);
1056
1092
1057 success = buffer_get_int(&m);
1058 if (success) {
1059 *client = buffer_get_string(&m, NULL);
1060 p = buffer_get_string(&m, &rlen);
1061 if (rlen >= MAX_KTXT_LEN)
1062 fatal("%s: reply from monitor too large", __func__);
1063 reply->length = rlen;
1064 memcpy(reply->dat, p, rlen);
1065 memset(p, 0, rlen);
1066 xfree(p);
1067 }
1093 major = buffer_get_int(&m);
1094
1068 buffer_free(&m);
1095 buffer_free(&m);
1069 return (success);
1096 return (major);
1070}
1097}
1071#endif
1072
1098
1073#ifdef KRB5
1074int
1075mm_auth_krb5(void *ctx, void *argp, char **userp, void *resp)
1099OM_uint32
1100mm_ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *in,
1101 gss_buffer_desc *out, OM_uint32 *flags)
1076{
1102{
1077 krb5_data *tkt, *reply;
1078 Buffer m;
1103 Buffer m;
1079 int success;
1104 OM_uint32 major;
1105 u_int len;
1080
1106
1081 debug3("%s entering", __func__);
1082 tkt = (krb5_data *) argp;
1083 reply = (krb5_data *) resp;
1084
1085 buffer_init(&m);
1107 buffer_init(&m);
1086 buffer_put_string(&m, tkt->data, tkt->length);
1108 buffer_put_string(&m, in->value, in->length);
1087
1109
1088 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB5, &m);
1089 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB5, &m);
1110 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSTEP, &m);
1111 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSTEP, &m);
1090
1112
1091 success = buffer_get_int(&m);
1092 if (success) {
1093 u_int len;
1113 major = buffer_get_int(&m);
1114 out->value = buffer_get_string(&m, &len);
1115 out->length = len;
1116 if (flags)
1117 *flags = buffer_get_int(&m);
1094
1118
1095 *userp = buffer_get_string(&m, NULL);
1096 reply->data = buffer_get_string(&m, &len);
1097 reply->length = len;
1098 } else {
1099 memset(reply, 0, sizeof(*reply));
1100 *userp = NULL;
1101 }
1119 buffer_free(&m);
1102
1120
1121 return (major);
1122}
1123
1124int
1125mm_ssh_gssapi_userok(char *user)
1126{
1127 Buffer m;
1128 int authenticated = 0;
1129
1130 buffer_init(&m);
1131
1132 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, &m);
1133 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUSEROK,
1134 &m);
1135
1136 authenticated = buffer_get_int(&m);
1137
1103 buffer_free(&m);
1138 buffer_free(&m);
1104 return (success);
1139 debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
1140 return (authenticated);
1105}
1141}
1106#endif
1142#endif /* GSSAPI */