blob: 7536bf305da6f1f8cd03dd999afe57732dbcc215 [file] [log] [blame]
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001/*
2 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
3 * Copyright 2002 Markus Friedl <markus@openbsd.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000028
29#include <openssl/bn.h>
30#include <openssl/dh.h>
31
32#include "ssh.h"
33#include "dh.h"
34#include "kex.h"
35#include "auth.h"
Damien Miller06ebedf2003-02-24 12:03:38 +110036#include "auth-options.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000037#include "buffer.h"
38#include "bufaux.h"
39#include "packet.h"
40#include "mac.h"
41#include "log.h"
Ben Lindstrom036768e2004-04-08 16:12:30 +000042#ifdef TARGET_OS_MAC /* XXX Broken krb5 headers on Mac */
43#undef TARGET_OS_MAC
Ben Lindstrom1b9f2a62004-04-08 05:11:03 +000044#include "zlib.h"
Ben Lindstrom036768e2004-04-08 16:12:30 +000045#define TARGET_OS_MAC 1
46#else
47#include "zlib.h"
48#endif
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000049#include "monitor.h"
50#include "monitor_wrap.h"
51#include "xmalloc.h"
52#include "atomicio.h"
53#include "monitor_fdpass.h"
54#include "getput.h"
Damien Miller4e448a32003-05-14 15:11:48 +100055#include "servconf.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000056
57#include "auth.h"
58#include "channels.h"
59#include "session.h"
60
Darren Tucker0efd1552003-08-26 11:49:55 +100061#ifdef GSSAPI
62#include "ssh-gss.h"
63#endif
64
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000065/* Imports */
66extern int compat20;
67extern Newkeys *newkeys[];
68extern z_stream incoming_stream;
69extern z_stream outgoing_stream;
Ben Lindstrom7339b2a2002-05-15 16:25:01 +000070extern struct monitor *pmonitor;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000071extern Buffer input, output;
Darren Tucker09991742004-07-17 17:05:14 +100072extern Buffer loginmsg;
Damien Miller4e448a32003-05-14 15:11:48 +100073extern ServerOptions options;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000074
Darren Tucker3e33cec2003-10-02 16:12:36 +100075int
76mm_is_monitor(void)
77{
78 /*
79 * m_pid is only set in the privileged part, and
80 * points to the unprivileged child.
81 */
Darren Tuckera47c9bc2003-11-03 20:03:25 +110082 return (pmonitor && pmonitor->m_pid > 0);
Darren Tucker3e33cec2003-10-02 16:12:36 +100083}
84
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000085void
Darren Tucker3f9fdc72004-06-22 12:56:01 +100086mm_request_send(int sock, enum monitor_reqtype type, Buffer *m)
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000087{
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000088 u_int mlen = buffer_len(m);
Ben Lindstromb1bdc5a2002-07-04 00:09:26 +000089 u_char buf[5];
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000090
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +000091 debug3("%s entering: type %d", __func__, type);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000092
93 PUT_32BIT(buf, mlen + 1);
Ben Lindstromcb72e4f2002-06-21 00:41:51 +000094 buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */
Darren Tucker3f9fdc72004-06-22 12:56:01 +100095 if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf))
Damien Millerb253cc42005-05-26 12:23:44 +100096 fatal("%s: write: %s", __func__, strerror(errno));
Darren Tucker3f9fdc72004-06-22 12:56:01 +100097 if (atomicio(vwrite, sock, buffer_ptr(m), mlen) != mlen)
Damien Millerb253cc42005-05-26 12:23:44 +100098 fatal("%s: write: %s", __func__, strerror(errno));
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000099}
100
101void
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000102mm_request_receive(int sock, Buffer *m)
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000103{
104 u_char buf[4];
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000105 u_int msg_len;
106
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000107 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000108
Damien Millerb253cc42005-05-26 12:23:44 +1000109 if (atomicio(read, sock, buf, sizeof(buf)) != sizeof(buf)) {
110 if (errno == EPIPE)
Darren Tucker3e33cec2003-10-02 16:12:36 +1000111 cleanup_exit(255);
Damien Millerb253cc42005-05-26 12:23:44 +1000112 fatal("%s: read: %s", __func__, strerror(errno));
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000113 }
114 msg_len = GET_32BIT(buf);
115 if (msg_len > 256 * 1024)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000116 fatal("%s: read: bad msg_len %d", __func__, msg_len);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000117 buffer_clear(m);
118 buffer_append_space(m, msg_len);
Damien Millerb253cc42005-05-26 12:23:44 +1000119 if (atomicio(read, sock, buffer_ptr(m), msg_len) != msg_len)
120 fatal("%s: read: %s", __func__, strerror(errno));
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000121}
122
123void
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000124mm_request_receive_expect(int sock, enum monitor_reqtype type, Buffer *m)
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000125{
126 u_char rtype;
127
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000128 debug3("%s entering: type %d", __func__, type);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000129
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000130 mm_request_receive(sock, m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000131 rtype = buffer_get_char(m);
132 if (rtype != type)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000133 fatal("%s: read: rtype %d != type %d", __func__,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000134 rtype, type);
135}
136
137DH *
138mm_choose_dh(int min, int nbits, int max)
139{
140 BIGNUM *p, *g;
141 int success = 0;
142 Buffer m;
143
144 buffer_init(&m);
145 buffer_put_int(&m, min);
146 buffer_put_int(&m, nbits);
147 buffer_put_int(&m, max);
148
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000149 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_MODULI, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000150
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000151 debug3("%s: waiting for MONITOR_ANS_MODULI", __func__);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000152 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_MODULI, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000153
154 success = buffer_get_char(&m);
155 if (success == 0)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000156 fatal("%s: MONITOR_ANS_MODULI failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000157
158 if ((p = BN_new()) == NULL)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000159 fatal("%s: BN_new failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000160 if ((g = BN_new()) == NULL)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000161 fatal("%s: BN_new failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000162 buffer_get_bignum2(&m, p);
163 buffer_get_bignum2(&m, g);
164
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000165 debug3("%s: remaining %d", __func__, buffer_len(&m));
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000166 buffer_free(&m);
167
168 return (dh_new_group(g, p));
169}
170
171int
172mm_key_sign(Key *key, u_char **sigp, u_int *lenp, u_char *data, u_int datalen)
173{
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000174 Kex *kex = *pmonitor->m_pkex;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000175 Buffer m;
176
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000177 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000178
179 buffer_init(&m);
180 buffer_put_int(&m, kex->host_key_index(key));
181 buffer_put_string(&m, data, datalen);
182
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000183 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000184
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000185 debug3("%s: waiting for MONITOR_ANS_SIGN", __func__);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000186 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SIGN, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000187 *sigp = buffer_get_string(&m, lenp);
188 buffer_free(&m);
189
190 return (0);
191}
192
193struct passwd *
Darren Tuckerb09b6772004-06-22 15:06:46 +1000194mm_getpwnamallow(const char *username)
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000195{
196 Buffer m;
197 struct passwd *pw;
198 u_int pwlen;
199
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000200 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000201
202 buffer_init(&m);
Darren Tuckerb09b6772004-06-22 15:06:46 +1000203 buffer_put_cstring(&m, username);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000204
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000205 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000206
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000207 debug3("%s: waiting for MONITOR_ANS_PWNAM", __func__);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000208 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000209
210 if (buffer_get_char(&m) == 0) {
211 buffer_free(&m);
212 return (NULL);
213 }
214 pw = buffer_get_string(&m, &pwlen);
215 if (pwlen != sizeof(struct passwd))
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000216 fatal("%s: struct passwd size mismatch", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000217 pw->pw_name = buffer_get_string(&m, NULL);
218 pw->pw_passwd = buffer_get_string(&m, NULL);
219 pw->pw_gecos = buffer_get_string(&m, NULL);
Kevin Steves7e147602002-03-22 18:07:17 +0000220#ifdef HAVE_PW_CLASS_IN_PASSWD
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000221 pw->pw_class = buffer_get_string(&m, NULL);
Kevin Steves7e147602002-03-22 18:07:17 +0000222#endif
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000223 pw->pw_dir = buffer_get_string(&m, NULL);
224 pw->pw_shell = buffer_get_string(&m, NULL);
225 buffer_free(&m);
226
227 return (pw);
228}
229
Darren Tucker7eb3de02003-10-15 15:56:58 +1000230char *
231mm_auth2_read_banner(void)
Damien Miller5ad9fd92002-05-13 11:07:41 +1000232{
233 Buffer m;
234 char *banner;
235
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000236 debug3("%s entering", __func__);
Damien Miller5ad9fd92002-05-13 11:07:41 +1000237
238 buffer_init(&m);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000239 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, &m);
Damien Miller5ad9fd92002-05-13 11:07:41 +1000240 buffer_clear(&m);
241
Darren Tucker7eb3de02003-10-15 15:56:58 +1000242 mm_request_receive_expect(pmonitor->m_recvfd,
243 MONITOR_ANS_AUTH2_READ_BANNER, &m);
Damien Miller5ad9fd92002-05-13 11:07:41 +1000244 banner = buffer_get_string(&m, NULL);
245 buffer_free(&m);
Ben Lindstromcb72e4f2002-06-21 00:41:51 +0000246
Darren Tucker7eb3de02003-10-15 15:56:58 +1000247 /* treat empty banner as missing banner */
248 if (strlen(banner) == 0) {
249 xfree(banner);
250 banner = NULL;
251 }
Damien Miller5ad9fd92002-05-13 11:07:41 +1000252 return (banner);
253}
254
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000255/* Inform the privileged process about service and style */
256
257void
258mm_inform_authserv(char *service, char *style)
259{
260 Buffer m;
261
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000262 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000263
264 buffer_init(&m);
265 buffer_put_cstring(&m, service);
266 buffer_put_cstring(&m, style ? style : "");
267
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000268 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000269
270 buffer_free(&m);
271}
272
273/* Do the password authentication */
274int
275mm_auth_password(Authctxt *authctxt, char *password)
276{
277 Buffer m;
278 int authenticated = 0;
279
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000280 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000281
282 buffer_init(&m);
283 buffer_put_cstring(&m, password);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000284 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHPASSWORD, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000285
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000286 debug3("%s: waiting for MONITOR_ANS_AUTHPASSWORD", __func__);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000287 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTHPASSWORD, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000288
289 authenticated = buffer_get_int(&m);
290
291 buffer_free(&m);
292
293 debug3("%s: user %sauthenticated",
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000294 __func__, authenticated ? "" : "not ");
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000295 return (authenticated);
296}
297
298int
299mm_user_key_allowed(struct passwd *pw, Key *key)
300{
301 return (mm_key_allowed(MM_USERKEY, NULL, NULL, key));
302}
303
304int
305mm_hostbased_key_allowed(struct passwd *pw, char *user, char *host,
306 Key *key)
307{
308 return (mm_key_allowed(MM_HOSTKEY, user, host, key));
309}
310
311int
312mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user,
313 char *host, Key *key)
314{
315 int ret;
316
317 key->type = KEY_RSA; /* XXX hack for key_to_blob */
318 ret = mm_key_allowed(MM_RSAHOSTKEY, user, host, key);
319 key->type = KEY_RSA1;
320 return (ret);
321}
322
323static void
324mm_send_debug(Buffer *m)
325{
326 char *msg;
327
328 while (buffer_len(m)) {
329 msg = buffer_get_string(m, NULL);
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000330 debug3("%s: Sending debug: %s", __func__, msg);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000331 packet_send_debug("%s", msg);
332 xfree(msg);
333 }
334}
335
336int
337mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key)
338{
339 Buffer m;
340 u_char *blob;
341 u_int len;
Damien Miller06ebedf2003-02-24 12:03:38 +1100342 int allowed = 0, have_forced = 0;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000343
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000344 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000345
346 /* Convert the key to a blob and the pass it over */
347 if (!key_to_blob(key, &blob, &len))
348 return (0);
349
350 buffer_init(&m);
351 buffer_put_int(&m, type);
352 buffer_put_cstring(&m, user ? user : "");
353 buffer_put_cstring(&m, host ? host : "");
354 buffer_put_string(&m, blob, len);
355 xfree(blob);
356
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000357 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000358
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000359 debug3("%s: waiting for MONITOR_ANS_KEYALLOWED", __func__);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000360 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYALLOWED, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000361
362 allowed = buffer_get_int(&m);
363
Damien Miller06ebedf2003-02-24 12:03:38 +1100364 /* fake forced command */
365 auth_clear_options();
366 have_forced = buffer_get_int(&m);
367 forced_command = have_forced ? xstrdup("true") : NULL;
368
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000369 /* Send potential debug messages */
370 mm_send_debug(&m);
371
372 buffer_free(&m);
373
374 return (allowed);
375}
376
377/*
378 * This key verify needs to send the key type along, because the
379 * privileged parent makes the decision if the key is allowed
380 * for authentication.
381 */
382
383int
384mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
385{
386 Buffer m;
387 u_char *blob;
388 u_int len;
389 int verified = 0;
390
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000391 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000392
393 /* Convert the key to a blob and the pass it over */
394 if (!key_to_blob(key, &blob, &len))
395 return (0);
396
397 buffer_init(&m);
398 buffer_put_string(&m, blob, len);
399 buffer_put_string(&m, sig, siglen);
400 buffer_put_string(&m, data, datalen);
401 xfree(blob);
402
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000403 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000404
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000405 debug3("%s: waiting for MONITOR_ANS_KEYVERIFY", __func__);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000406 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYVERIFY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000407
408 verified = buffer_get_int(&m);
409
410 buffer_free(&m);
411
412 return (verified);
413}
414
415/* Export key state after authentication */
416Newkeys *
417mm_newkeys_from_blob(u_char *blob, int blen)
418{
419 Buffer b;
420 u_int len;
421 Newkeys *newkey = NULL;
422 Enc *enc;
423 Mac *mac;
424 Comp *comp;
425
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000426 debug3("%s: %p(%d)", __func__, blob, blen);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000427#ifdef DEBUG_PK
428 dump_base64(stderr, blob, blen);
429#endif
430 buffer_init(&b);
431 buffer_append(&b, blob, blen);
432
433 newkey = xmalloc(sizeof(*newkey));
434 enc = &newkey->enc;
435 mac = &newkey->mac;
436 comp = &newkey->comp;
437
438 /* Enc structure */
439 enc->name = buffer_get_string(&b, NULL);
440 buffer_get(&b, &enc->cipher, sizeof(enc->cipher));
441 enc->enabled = buffer_get_int(&b);
442 enc->block_size = buffer_get_int(&b);
443 enc->key = buffer_get_string(&b, &enc->key_len);
444 enc->iv = buffer_get_string(&b, &len);
445 if (len != enc->block_size)
Ben Lindstrom08512492002-06-27 00:23:02 +0000446 fatal("%s: bad ivlen: expected %u != %u", __func__,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000447 enc->block_size, len);
448
449 if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000450 fatal("%s: bad cipher name %s or pointer %p", __func__,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000451 enc->name, enc->cipher);
452
453 /* Mac structure */
454 mac->name = buffer_get_string(&b, NULL);
455 if (mac->name == NULL || mac_init(mac, mac->name) == -1)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000456 fatal("%s: can not init mac %s", __func__, mac->name);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000457 mac->enabled = buffer_get_int(&b);
458 mac->key = buffer_get_string(&b, &len);
459 if (len > mac->key_len)
Ben Lindstrom08512492002-06-27 00:23:02 +0000460 fatal("%s: bad mac key length: %u > %d", __func__, len,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000461 mac->key_len);
462 mac->key_len = len;
463
464 /* Comp structure */
465 comp->type = buffer_get_int(&b);
466 comp->enabled = buffer_get_int(&b);
467 comp->name = buffer_get_string(&b, NULL);
468
469 len = buffer_len(&b);
470 if (len != 0)
Ben Lindstrom08512492002-06-27 00:23:02 +0000471 error("newkeys_from_blob: remaining bytes in blob %u", len);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000472 buffer_free(&b);
473 return (newkey);
474}
475
476int
477mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
478{
479 Buffer b;
480 int len;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000481 Enc *enc;
482 Mac *mac;
483 Comp *comp;
484 Newkeys *newkey = newkeys[mode];
485
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000486 debug3("%s: converting %p", __func__, newkey);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000487
488 if (newkey == NULL) {
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000489 error("%s: newkey == NULL", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000490 return 0;
491 }
492 enc = &newkey->enc;
493 mac = &newkey->mac;
494 comp = &newkey->comp;
495
496 buffer_init(&b);
497 /* Enc structure */
498 buffer_put_cstring(&b, enc->name);
499 /* The cipher struct is constant and shared, you export pointer */
500 buffer_append(&b, &enc->cipher, sizeof(enc->cipher));
501 buffer_put_int(&b, enc->enabled);
502 buffer_put_int(&b, enc->block_size);
503 buffer_put_string(&b, enc->key, enc->key_len);
504 packet_get_keyiv(mode, enc->iv, enc->block_size);
505 buffer_put_string(&b, enc->iv, enc->block_size);
506
507 /* Mac structure */
508 buffer_put_cstring(&b, mac->name);
509 buffer_put_int(&b, mac->enabled);
510 buffer_put_string(&b, mac->key, mac->key_len);
511
512 /* Comp structure */
513 buffer_put_int(&b, comp->type);
514 buffer_put_int(&b, comp->enabled);
515 buffer_put_cstring(&b, comp->name);
516
517 len = buffer_len(&b);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000518 if (lenp != NULL)
519 *lenp = len;
Ben Lindstrom2bf759c2002-07-07 22:13:31 +0000520 if (blobp != NULL) {
521 *blobp = xmalloc(len);
522 memcpy(*blobp, buffer_ptr(&b), len);
523 }
524 memset(buffer_ptr(&b), 0, len);
525 buffer_free(&b);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000526 return len;
527}
528
529static void
530mm_send_kex(Buffer *m, Kex *kex)
531{
532 buffer_put_string(m, kex->session_id, kex->session_id_len);
533 buffer_put_int(m, kex->we_need);
534 buffer_put_int(m, kex->hostkey_type);
535 buffer_put_int(m, kex->kex_type);
536 buffer_put_string(m, buffer_ptr(&kex->my), buffer_len(&kex->my));
537 buffer_put_string(m, buffer_ptr(&kex->peer), buffer_len(&kex->peer));
538 buffer_put_int(m, kex->flags);
539 buffer_put_cstring(m, kex->client_version_string);
540 buffer_put_cstring(m, kex->server_version_string);
541}
542
543void
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000544mm_send_keystate(struct monitor *monitor)
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000545{
546 Buffer m;
547 u_char *blob, *p;
548 u_int bloblen, plen;
Damien Millera5539d22003-04-09 20:50:06 +1000549 u_int32_t seqnr, packets;
550 u_int64_t blocks;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000551
552 buffer_init(&m);
553
554 if (!compat20) {
555 u_char iv[24];
Ben Lindstrom402c6cc2002-06-21 00:43:42 +0000556 u_char *key;
557 u_int ivlen, keylen;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000558
559 buffer_put_int(&m, packet_get_protocol_flags());
560
561 buffer_put_int(&m, packet_get_ssh1_cipher());
562
Ben Lindstrom402c6cc2002-06-21 00:43:42 +0000563 debug3("%s: Sending ssh1 KEY+IV", __func__);
564 keylen = packet_get_encryption_key(NULL);
565 key = xmalloc(keylen+1); /* add 1 if keylen == 0 */
566 keylen = packet_get_encryption_key(key);
567 buffer_put_string(&m, key, keylen);
568 memset(key, 0, keylen);
569 xfree(key);
570
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000571 ivlen = packet_get_keyiv_len(MODE_OUT);
572 packet_get_keyiv(MODE_OUT, iv, ivlen);
573 buffer_put_string(&m, iv, ivlen);
574 ivlen = packet_get_keyiv_len(MODE_OUT);
575 packet_get_keyiv(MODE_IN, iv, ivlen);
576 buffer_put_string(&m, iv, ivlen);
577 goto skip;
578 } else {
579 /* Kex for rekeying */
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000580 mm_send_kex(&m, *monitor->m_pkex);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000581 }
582
583 debug3("%s: Sending new keys: %p %p",
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000584 __func__, newkeys[MODE_OUT], newkeys[MODE_IN]);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000585
586 /* Keys from Kex */
587 if (!mm_newkeys_to_blob(MODE_OUT, &blob, &bloblen))
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000588 fatal("%s: conversion of newkeys failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000589
590 buffer_put_string(&m, blob, bloblen);
591 xfree(blob);
592
593 if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000594 fatal("%s: conversion of newkeys failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000595
596 buffer_put_string(&m, blob, bloblen);
597 xfree(blob);
598
Damien Millera5539d22003-04-09 20:50:06 +1000599 packet_get_state(MODE_OUT, &seqnr, &blocks, &packets);
600 buffer_put_int(&m, seqnr);
601 buffer_put_int64(&m, blocks);
602 buffer_put_int(&m, packets);
Damien Millerb1ecd9c2003-04-09 20:51:24 +1000603 packet_get_state(MODE_IN, &seqnr, &blocks, &packets);
Damien Millera5539d22003-04-09 20:50:06 +1000604 buffer_put_int(&m, seqnr);
605 buffer_put_int64(&m, blocks);
606 buffer_put_int(&m, packets);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000607
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000608 debug3("%s: New keys have been sent", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000609 skip:
610 /* More key context */
611 plen = packet_get_keycontext(MODE_OUT, NULL);
612 p = xmalloc(plen+1);
613 packet_get_keycontext(MODE_OUT, p);
614 buffer_put_string(&m, p, plen);
615 xfree(p);
616
617 plen = packet_get_keycontext(MODE_IN, NULL);
618 p = xmalloc(plen+1);
619 packet_get_keycontext(MODE_IN, p);
620 buffer_put_string(&m, p, plen);
621 xfree(p);
622
623 /* Compression state */
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000624 debug3("%s: Sending compression state", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000625 buffer_put_string(&m, &outgoing_stream, sizeof(outgoing_stream));
626 buffer_put_string(&m, &incoming_stream, sizeof(incoming_stream));
627
628 /* Network I/O buffers */
629 buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input));
630 buffer_put_string(&m, buffer_ptr(&output), buffer_len(&output));
631
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000632 mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000633 debug3("%s: Finished sending state", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000634
635 buffer_free(&m);
636}
637
638int
639mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
640{
641 Buffer m;
Darren Tucker09991742004-07-17 17:05:14 +1000642 char *p, *msg;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000643 int success = 0;
644
645 buffer_init(&m);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000646 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000647
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000648 debug3("%s: waiting for MONITOR_ANS_PTY", __func__);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000649 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PTY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000650
651 success = buffer_get_int(&m);
652 if (success == 0) {
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000653 debug3("%s: pty alloc failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000654 buffer_free(&m);
655 return (0);
656 }
657 p = buffer_get_string(&m, NULL);
Darren Tucker09991742004-07-17 17:05:14 +1000658 msg = buffer_get_string(&m, NULL);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000659 buffer_free(&m);
660
661 strlcpy(namebuf, p, namebuflen); /* Possible truncation */
662 xfree(p);
663
Darren Tucker09991742004-07-17 17:05:14 +1000664 buffer_append(&loginmsg, msg, strlen(msg));
665 xfree(msg);
666
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000667 *ptyfd = mm_receive_fd(pmonitor->m_recvfd);
668 *ttyfd = mm_receive_fd(pmonitor->m_recvfd);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000669
670 /* Success */
671 return (1);
672}
673
674void
Darren Tucker3e33cec2003-10-02 16:12:36 +1000675mm_session_pty_cleanup2(Session *s)
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000676{
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000677 Buffer m;
678
679 if (s->ttyfd == -1)
680 return;
681 buffer_init(&m);
682 buffer_put_cstring(&m, s->tty);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000683 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTYCLEANUP, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000684 buffer_free(&m);
685
686 /* closed dup'ed master */
687 if (close(s->ptymaster) < 0)
688 error("close(s->ptymaster): %s", strerror(errno));
689
690 /* unlink pty from session */
691 s->ttyfd = -1;
692}
693
Damien Miller79418552002-04-23 20:28:48 +1000694#ifdef USE_PAM
695void
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100696mm_start_pam(Authctxt *authctxt)
Damien Miller79418552002-04-23 20:28:48 +1000697{
698 Buffer m;
699
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000700 debug3("%s entering", __func__);
Damien Miller4e448a32003-05-14 15:11:48 +1000701 if (!options.use_pam)
702 fatal("UsePAM=no, but ended up in %s anyway", __func__);
Damien Miller79418552002-04-23 20:28:48 +1000703
704 buffer_init(&m);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000705 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, &m);
Damien Miller79418552002-04-23 20:28:48 +1000706
707 buffer_free(&m);
708}
Damien Miller4f9f42a2003-05-10 19:28:02 +1000709
Damien Miller1f499fd2003-08-25 13:08:49 +1000710u_int
711mm_do_pam_account(void)
712{
713 Buffer m;
714 u_int ret;
Darren Tucker77fc29e2004-09-11 23:07:03 +1000715 char *msg;
Damien Miller1f499fd2003-08-25 13:08:49 +1000716
717 debug3("%s entering", __func__);
718 if (!options.use_pam)
719 fatal("UsePAM=no, but ended up in %s anyway", __func__);
720
721 buffer_init(&m);
722 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_ACCOUNT, &m);
723
Damien Millera8e06ce2003-11-21 23:48:55 +1100724 mm_request_receive_expect(pmonitor->m_recvfd,
Damien Miller1f499fd2003-08-25 13:08:49 +1000725 MONITOR_ANS_PAM_ACCOUNT, &m);
726 ret = buffer_get_int(&m);
Darren Tucker77fc29e2004-09-11 23:07:03 +1000727 msg = buffer_get_string(&m, NULL);
728 buffer_append(&loginmsg, msg, strlen(msg));
729 xfree(msg);
Damien Miller1f499fd2003-08-25 13:08:49 +1000730
731 buffer_free(&m);
Damien Miller787b2ec2003-11-21 23:56:47 +1100732
Damien Miller1f499fd2003-08-25 13:08:49 +1000733 debug3("%s returning %d", __func__, ret);
734
735 return (ret);
736}
737
Damien Miller4f9f42a2003-05-10 19:28:02 +1000738void *
739mm_sshpam_init_ctx(Authctxt *authctxt)
740{
741 Buffer m;
742 int success;
743
744 debug3("%s", __func__);
745 buffer_init(&m);
746 buffer_put_cstring(&m, authctxt->user);
747 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, &m);
748 debug3("%s: waiting for MONITOR_ANS_PAM_INIT_CTX", __func__);
749 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_INIT_CTX, &m);
750 success = buffer_get_int(&m);
751 if (success == 0) {
752 debug3("%s: pam_init_ctx failed", __func__);
753 buffer_free(&m);
754 return (NULL);
755 }
756 buffer_free(&m);
757 return (authctxt);
758}
759
760int
761mm_sshpam_query(void *ctx, char **name, char **info,
762 u_int *num, char ***prompts, u_int **echo_on)
763{
764 Buffer m;
Damien Miller04b65332005-07-17 17:53:31 +1000765 u_int i;
766 int ret;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000767
768 debug3("%s", __func__);
769 buffer_init(&m);
770 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_QUERY, &m);
771 debug3("%s: waiting for MONITOR_ANS_PAM_QUERY", __func__);
772 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_QUERY, &m);
773 ret = buffer_get_int(&m);
774 debug3("%s: pam_query returned %d", __func__, ret);
775 *name = buffer_get_string(&m, NULL);
776 *info = buffer_get_string(&m, NULL);
777 *num = buffer_get_int(&m);
778 *prompts = xmalloc((*num + 1) * sizeof(char *));
779 *echo_on = xmalloc((*num + 1) * sizeof(u_int));
780 for (i = 0; i < *num; ++i) {
781 (*prompts)[i] = buffer_get_string(&m, NULL);
782 (*echo_on)[i] = buffer_get_int(&m);
783 }
784 buffer_free(&m);
785 return (ret);
786}
787
788int
789mm_sshpam_respond(void *ctx, u_int num, char **resp)
790{
791 Buffer m;
Damien Miller04b65332005-07-17 17:53:31 +1000792 u_int i;
793 int ret;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000794
795 debug3("%s", __func__);
796 buffer_init(&m);
797 buffer_put_int(&m, num);
798 for (i = 0; i < num; ++i)
799 buffer_put_cstring(&m, resp[i]);
800 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_RESPOND, &m);
801 debug3("%s: waiting for MONITOR_ANS_PAM_RESPOND", __func__);
802 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_RESPOND, &m);
803 ret = buffer_get_int(&m);
804 debug3("%s: pam_respond returned %d", __func__, ret);
805 buffer_free(&m);
806 return (ret);
807}
808
809void
810mm_sshpam_free_ctx(void *ctxtp)
811{
812 Buffer m;
813
814 debug3("%s", __func__);
815 buffer_init(&m);
816 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_FREE_CTX, &m);
817 debug3("%s: waiting for MONITOR_ANS_PAM_FREE_CTX", __func__);
818 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_FREE_CTX, &m);
819 buffer_free(&m);
820}
Damien Miller79418552002-04-23 20:28:48 +1000821#endif /* USE_PAM */
822
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000823/* Request process termination */
824
825void
826mm_terminate(void)
827{
828 Buffer m;
829
830 buffer_init(&m);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000831 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_TERM, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000832 buffer_free(&m);
833}
834
835int
836mm_ssh1_session_key(BIGNUM *num)
837{
838 int rsafail;
839 Buffer m;
840
841 buffer_init(&m);
842 buffer_put_bignum2(&m, num);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000843 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSKEY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000844
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000845 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SESSKEY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000846
847 rsafail = buffer_get_int(&m);
848 buffer_get_bignum2(&m, num);
849
850 buffer_free(&m);
851
852 return (rsafail);
853}
854
855static void
856mm_chall_setup(char **name, char **infotxt, u_int *numprompts,
857 char ***prompts, u_int **echo_on)
858{
Ben Lindstromcb72e4f2002-06-21 00:41:51 +0000859 *name = xstrdup("");
860 *infotxt = xstrdup("");
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000861 *numprompts = 1;
Ben Lindstroma962c2f2002-07-04 00:14:17 +0000862 *prompts = xmalloc(*numprompts * sizeof(char *));
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000863 *echo_on = xmalloc(*numprompts * sizeof(u_int));
864 (*echo_on)[0] = 0;
865}
866
867int
868mm_bsdauth_query(void *ctx, char **name, char **infotxt,
869 u_int *numprompts, char ***prompts, u_int **echo_on)
870{
871 Buffer m;
Damien Millerb7df3af2003-02-24 11:55:46 +1100872 u_int success;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000873 char *challenge;
874
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000875 debug3("%s: entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000876
877 buffer_init(&m);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000878 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHQUERY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000879
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000880 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_BSDAUTHQUERY,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000881 &m);
Damien Millerb7df3af2003-02-24 11:55:46 +1100882 success = buffer_get_int(&m);
883 if (success == 0) {
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000884 debug3("%s: no challenge", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000885 buffer_free(&m);
886 return (-1);
887 }
888
889 /* Get the challenge, and format the response */
890 challenge = buffer_get_string(&m, NULL);
891 buffer_free(&m);
892
893 mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
894 (*prompts)[0] = challenge;
895
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000896 debug3("%s: received challenge: %s", __func__, challenge);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000897
898 return (0);
899}
900
901int
902mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses)
903{
904 Buffer m;
905 int authok;
906
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000907 debug3("%s: entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000908 if (numresponses != 1)
909 return (-1);
910
911 buffer_init(&m);
912 buffer_put_cstring(&m, responses[0]);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000913 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHRESPOND, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000914
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000915 mm_request_receive_expect(pmonitor->m_recvfd,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000916 MONITOR_ANS_BSDAUTHRESPOND, &m);
917
918 authok = buffer_get_int(&m);
919 buffer_free(&m);
920
921 return ((authok == 0) ? -1 : 0);
922}
923
Darren Tucker042e2e82004-07-08 23:09:42 +1000924#ifdef SKEY
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000925int
926mm_skey_query(void *ctx, char **name, char **infotxt,
927 u_int *numprompts, char ***prompts, u_int **echo_on)
928{
929 Buffer m;
Damien Millerb7df3af2003-02-24 11:55:46 +1100930 int len;
931 u_int success;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000932 char *p, *challenge;
933
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000934 debug3("%s: entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000935
936 buffer_init(&m);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000937 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYQUERY, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000938
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000939 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SKEYQUERY,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000940 &m);
Damien Millerb7df3af2003-02-24 11:55:46 +1100941 success = buffer_get_int(&m);
942 if (success == 0) {
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000943 debug3("%s: no challenge", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000944 buffer_free(&m);
945 return (-1);
946 }
947
948 /* Get the challenge, and format the response */
949 challenge = buffer_get_string(&m, NULL);
950 buffer_free(&m);
951
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000952 debug3("%s: received challenge: %s", __func__, challenge);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000953
954 mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
955
956 len = strlen(challenge) + strlen(SKEY_PROMPT) + 1;
957 p = xmalloc(len);
958 strlcpy(p, challenge, len);
959 strlcat(p, SKEY_PROMPT, len);
960 (*prompts)[0] = p;
961 xfree(challenge);
962
963 return (0);
964}
965
966int
967mm_skey_respond(void *ctx, u_int numresponses, char **responses)
968{
969 Buffer m;
970 int authok;
971
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000972 debug3("%s: entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000973 if (numresponses != 1)
974 return (-1);
975
976 buffer_init(&m);
977 buffer_put_cstring(&m, responses[0]);
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000978 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYRESPOND, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000979
Ben Lindstrom7339b2a2002-05-15 16:25:01 +0000980 mm_request_receive_expect(pmonitor->m_recvfd,
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000981 MONITOR_ANS_SKEYRESPOND, &m);
982
983 authok = buffer_get_int(&m);
984 buffer_free(&m);
985
986 return ((authok == 0) ? -1 : 0);
987}
Darren Tucker042e2e82004-07-08 23:09:42 +1000988#endif /* SKEY */
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000989
990void
991mm_ssh1_session_id(u_char session_id[16])
992{
993 Buffer m;
994 int i;
995
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +0000996 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000997
998 buffer_init(&m);
999 for (i = 0; i < 16; i++)
1000 buffer_put_char(&m, session_id[i]);
1001
Ben Lindstrom7339b2a2002-05-15 16:25:01 +00001002 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSID, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001003 buffer_free(&m);
1004}
1005
1006int
1007mm_auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
1008{
1009 Buffer m;
1010 Key *key;
1011 u_char *blob;
1012 u_int blen;
Damien Miller06ebedf2003-02-24 12:03:38 +11001013 int allowed = 0, have_forced = 0;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001014
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +00001015 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001016
1017 buffer_init(&m);
1018 buffer_put_bignum2(&m, client_n);
1019
Ben Lindstrom7339b2a2002-05-15 16:25:01 +00001020 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSAKEYALLOWED, &m);
1021 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSAKEYALLOWED, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001022
1023 allowed = buffer_get_int(&m);
1024
Damien Miller06ebedf2003-02-24 12:03:38 +11001025 /* fake forced command */
1026 auth_clear_options();
1027 have_forced = buffer_get_int(&m);
1028 forced_command = have_forced ? xstrdup("true") : NULL;
1029
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001030 if (allowed && rkey != NULL) {
1031 blob = buffer_get_string(&m, &blen);
1032 if ((key = key_from_blob(blob, blen)) == NULL)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +00001033 fatal("%s: key_from_blob failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001034 *rkey = key;
1035 xfree(blob);
1036 }
1037 mm_send_debug(&m);
1038 buffer_free(&m);
1039
1040 return (allowed);
1041}
1042
1043BIGNUM *
1044mm_auth_rsa_generate_challenge(Key *key)
1045{
1046 Buffer m;
1047 BIGNUM *challenge;
1048 u_char *blob;
1049 u_int blen;
1050
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +00001051 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001052
1053 if ((challenge = BN_new()) == NULL)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +00001054 fatal("%s: BN_new failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001055
1056 key->type = KEY_RSA; /* XXX cheat for key_to_blob */
1057 if (key_to_blob(key, &blob, &blen) == 0)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +00001058 fatal("%s: key_to_blob failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001059 key->type = KEY_RSA1;
1060
1061 buffer_init(&m);
1062 buffer_put_string(&m, blob, blen);
1063 xfree(blob);
1064
Ben Lindstrom7339b2a2002-05-15 16:25:01 +00001065 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSACHALLENGE, &m);
1066 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSACHALLENGE, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001067
1068 buffer_get_bignum2(&m, challenge);
1069 buffer_free(&m);
1070
1071 return (challenge);
1072}
1073
1074int
1075mm_auth_rsa_verify_response(Key *key, BIGNUM *p, u_char response[16])
1076{
1077 Buffer m;
1078 u_char *blob;
1079 u_int blen;
1080 int success = 0;
1081
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +00001082 debug3("%s entering", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001083
1084 key->type = KEY_RSA; /* XXX cheat for key_to_blob */
1085 if (key_to_blob(key, &blob, &blen) == 0)
Ben Lindstrom7d9c38f2002-06-06 21:40:51 +00001086 fatal("%s: key_to_blob failed", __func__);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001087 key->type = KEY_RSA1;
1088
1089 buffer_init(&m);
1090 buffer_put_string(&m, blob, blen);
1091 buffer_put_string(&m, response, 16);
1092 xfree(blob);
1093
Ben Lindstrom7339b2a2002-05-15 16:25:01 +00001094 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSARESPONSE, &m);
1095 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSARESPONSE, &m);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +00001096
1097 success = buffer_get_int(&m);
1098 buffer_free(&m);
1099
1100 return (success);
1101}
Damien Miller25162f22002-09-12 09:47:29 +10001102
Darren Tucker2e0cf0d2005-02-08 21:52:47 +11001103#ifdef SSH_AUDIT_EVENTS
Darren Tucker269a1ea2005-02-03 00:20:53 +11001104void
1105mm_audit_event(ssh_audit_event_t event)
1106{
1107 Buffer m;
1108
1109 debug3("%s entering", __func__);
1110
1111 buffer_init(&m);
1112 buffer_put_int(&m, event);
1113
1114 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_EVENT, &m);
1115 buffer_free(&m);
1116}
1117
1118void
1119mm_audit_run_command(const char *command)
1120{
1121 Buffer m;
1122
1123 debug3("%s entering command %s", __func__, command);
1124
1125 buffer_init(&m);
1126 buffer_put_cstring(&m, command);
1127
1128 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
1129 buffer_free(&m);
1130}
Darren Tucker2e0cf0d2005-02-08 21:52:47 +11001131#endif /* SSH_AUDIT_EVENTS */
Darren Tucker269a1ea2005-02-03 00:20:53 +11001132
Darren Tucker0efd1552003-08-26 11:49:55 +10001133#ifdef GSSAPI
1134OM_uint32
Darren Tucker3f9fdc72004-06-22 12:56:01 +10001135mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)
Darren Tucker0efd1552003-08-26 11:49:55 +10001136{
1137 Buffer m;
1138 OM_uint32 major;
1139
1140 /* Client doesn't get to see the context */
1141 *ctx = NULL;
1142
1143 buffer_init(&m);
Darren Tucker3f9fdc72004-06-22 12:56:01 +10001144 buffer_put_string(&m, goid->elements, goid->length);
Darren Tucker0efd1552003-08-26 11:49:55 +10001145
1146 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSETUP, &m);
1147 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSETUP, &m);
1148
1149 major = buffer_get_int(&m);
1150
1151 buffer_free(&m);
1152 return (major);
1153}
1154
1155OM_uint32
1156mm_ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *in,
1157 gss_buffer_desc *out, OM_uint32 *flags)
1158{
1159 Buffer m;
1160 OM_uint32 major;
Darren Tucker600ad8d2003-08-26 12:10:48 +10001161 u_int len;
Darren Tucker0efd1552003-08-26 11:49:55 +10001162
1163 buffer_init(&m);
1164 buffer_put_string(&m, in->value, in->length);
1165
1166 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSTEP, &m);
1167 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSTEP, &m);
1168
1169 major = buffer_get_int(&m);
Darren Tucker600ad8d2003-08-26 12:10:48 +10001170 out->value = buffer_get_string(&m, &len);
1171 out->length = len;
Darren Tucker0efd1552003-08-26 11:49:55 +10001172 if (flags)
1173 *flags = buffer_get_int(&m);
1174
1175 buffer_free(&m);
1176
1177 return (major);
1178}
1179
Damien Miller0425d402003-11-17 22:18:21 +11001180OM_uint32
1181mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
1182{
1183 Buffer m;
1184 OM_uint32 major;
1185
1186 buffer_init(&m);
1187 buffer_put_string(&m, gssbuf->value, gssbuf->length);
1188 buffer_put_string(&m, gssmic->value, gssmic->length);
1189
1190 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSCHECKMIC, &m);
1191 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSCHECKMIC,
1192 &m);
1193
1194 major = buffer_get_int(&m);
1195 buffer_free(&m);
1196 return(major);
1197}
1198
Darren Tucker0efd1552003-08-26 11:49:55 +10001199int
1200mm_ssh_gssapi_userok(char *user)
1201{
1202 Buffer m;
1203 int authenticated = 0;
1204
1205 buffer_init(&m);
1206
1207 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, &m);
1208 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUSEROK,
1209 &m);
1210
1211 authenticated = buffer_get_int(&m);
1212
1213 buffer_free(&m);
1214 debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
1215 return (authenticated);
1216}
1217#endif /* GSSAPI */