blob: 3e5706f4dbef5ecec1de720e5792251dea336e22 [file] [log] [blame]
djm@openbsd.org52763dd2017-01-30 01:03:00 +00001/* $OpenBSD: auth2-pubkey.c,v 1.62 2017/01/30 01:03:00 djm Exp $ */
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00002/*
3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
Damien Millerf17883e2006-03-15 11:45:54 +110027
28#include <sys/types.h>
29#include <sys/stat.h>
Damien Miller09d3e122012-10-31 08:58:58 +110030#include <sys/wait.h>
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000031
Damien Miller09d3e122012-10-31 08:58:58 +110032#include <errno.h>
Darren Tucker06db5842008-06-13 14:51:28 +100033#include <fcntl.h>
Darren Tucker737f7af2012-11-05 17:07:43 +110034#ifdef HAVE_PATHS_H
35# include <paths.h>
36#endif
Damien Miller9f2abc42006-07-10 20:53:08 +100037#include <pwd.h>
Damien Miller09d3e122012-10-31 08:58:58 +110038#include <signal.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100039#include <stdio.h>
Damien Millerd7834352006-08-05 12:39:39 +100040#include <stdarg.h>
Damien Miller0a80ca12010-02-27 07:55:05 +110041#include <string.h>
42#include <time.h>
Darren Tuckerd9526a52008-06-14 09:01:24 +100043#include <unistd.h>
djm@openbsd.orgf69b69b2014-12-22 07:51:30 +000044#include <limits.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100045
Damien Millerd7834352006-08-05 12:39:39 +100046#include "xmalloc.h"
Darren Tucker22cc7412004-12-06 22:47:41 +110047#include "ssh.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000048#include "ssh2.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000049#include "packet.h"
50#include "buffer.h"
51#include "log.h"
Damien Miller7acefbb2014-07-18 14:11:24 +100052#include "misc.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000053#include "servconf.h"
54#include "compat.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000055#include "key.h"
Damien Millerd7834352006-08-05 12:39:39 +100056#include "hostfile.h"
57#include "auth.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000058#include "pathnames.h"
59#include "uidswap.h"
60#include "auth-options.h"
61#include "canohost.h"
Damien Millerd7834352006-08-05 12:39:39 +100062#ifdef GSSAPI
63#include "ssh-gss.h"
64#endif
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000065#include "monitor_wrap.h"
Damien Miller1aed65e2010-03-04 21:53:35 +110066#include "authfile.h"
Damien Miller30da3442010-05-10 11:58:03 +100067#include "match.h"
djm@openbsd.org24232a32015-05-21 06:38:35 +000068#include "ssherr.h"
69#include "channels.h" /* XXX for session.h */
70#include "session.h" /* XXX for child_set_env(); refactor? */
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000071
72/* import */
73extern ServerOptions options;
74extern u_char *session_id2;
Darren Tucker502d3842003-06-28 12:38:01 +100075extern u_int session_id2_len;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000076
77static int
78userauth_pubkey(Authctxt *authctxt)
79{
80 Buffer b;
81 Key *key = NULL;
djm@openbsd.orgebacd372016-01-27 00:53:12 +000082 char *pkalg, *userstyle, *fp = NULL;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000083 u_char *pkblob, *sig;
84 u_int alen, blen, slen;
85 int have_sig, pktype;
86 int authenticated = 0;
87
88 if (!authctxt->valid) {
djm@openbsd.orgebacd372016-01-27 00:53:12 +000089 debug2("%s: disabled because of invalid user", __func__);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000090 return 0;
91 }
92 have_sig = packet_get_char();
93 if (datafellows & SSH_BUG_PKAUTH) {
djm@openbsd.orgebacd372016-01-27 00:53:12 +000094 debug2("%s: SSH_BUG_PKAUTH", __func__);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000095 /* no explicit pkalg given */
96 pkblob = packet_get_string(&blen);
97 buffer_init(&b);
98 buffer_append(&b, pkblob, blen);
99 /* so we have to extract the pkalg from the pkblob */
100 pkalg = buffer_get_string(&b, &alen);
101 buffer_free(&b);
102 } else {
103 pkalg = packet_get_string(&alen);
104 pkblob = packet_get_string(&blen);
105 }
106 pktype = key_type_from_name(pkalg);
107 if (pktype == KEY_UNSPEC) {
108 /* this is perfectly legal */
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000109 logit("%s: unsupported public key algorithm: %s",
110 __func__, pkalg);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000111 goto done;
112 }
113 key = key_from_blob(pkblob, blen);
114 if (key == NULL) {
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000115 error("%s: cannot decode key: %s", __func__, pkalg);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000116 goto done;
117 }
118 if (key->type != pktype) {
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000119 error("%s: type mismatch for decoded key "
120 "(received %d, expected %d)", __func__, key->type, pktype);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000121 goto done;
122 }
Damien Miller324541e2013-12-31 12:25:40 +1100123 if (key_type_plain(key->type) == KEY_RSA &&
124 (datafellows & SSH_BUG_RSASIGMD5) != 0) {
125 logit("Refusing RSA key because client uses unsafe "
126 "signature scheme");
127 goto done;
128 }
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000129 fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_DEFAULT);
djm@openbsd.orgf69b69b2014-12-22 07:51:30 +0000130 if (auth2_userkey_already_used(authctxt, key)) {
131 logit("refusing previously-used %s key", key_type(key));
132 goto done;
133 }
djm@openbsd.orge661a862015-05-04 06:10:48 +0000134 if (match_pattern_list(sshkey_ssh_name(key),
135 options.pubkey_key_types, 0) != 1) {
djm@openbsd.org1f729f02015-01-13 07:39:19 +0000136 logit("%s: key type %s not in PubkeyAcceptedKeyTypes",
137 __func__, sshkey_ssh_name(key));
138 goto done;
139 }
140
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000141 if (have_sig) {
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000142 debug3("%s: have signature for %s %s",
143 __func__, sshkey_type(key), fp);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000144 sig = packet_get_string(&slen);
145 packet_check_eom();
146 buffer_init(&b);
147 if (datafellows & SSH_OLD_SESSIONID) {
148 buffer_append(&b, session_id2, session_id2_len);
149 } else {
150 buffer_put_string(&b, session_id2, session_id2_len);
151 }
152 /* reconstruct packet */
153 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
Damien Miller4ce189d2013-04-23 15:17:52 +1000154 xasprintf(&userstyle, "%s%s%s", authctxt->user,
155 authctxt->style ? ":" : "",
156 authctxt->style ? authctxt->style : "");
157 buffer_put_cstring(&b, userstyle);
158 free(userstyle);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000159 buffer_put_cstring(&b,
160 datafellows & SSH_BUG_PKSERVICE ?
161 "ssh-userauth" :
162 authctxt->service);
163 if (datafellows & SSH_BUG_PKAUTH) {
164 buffer_put_char(&b, have_sig);
165 } else {
166 buffer_put_cstring(&b, "publickey");
167 buffer_put_char(&b, have_sig);
168 buffer_put_cstring(&b, pkalg);
169 }
170 buffer_put_string(&b, pkblob, blen);
171#ifdef DEBUG_PK
172 buffer_dump(&b);
173#endif
Damien Miller20bdcd72013-07-18 16:10:09 +1000174 pubkey_auth_info(authctxt, key, NULL);
Darren Tucker74836ae2013-06-02 07:32:00 +1000175
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000176 /* test for correct signature */
177 authenticated = 0;
djm@openbsd.org179be0f2015-05-01 03:23:51 +0000178 if (PRIVSEP(user_key_allowed(authctxt->pw, key, 1)) &&
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000179 PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
djm@openbsd.orgf69b69b2014-12-22 07:51:30 +0000180 buffer_len(&b))) == 1) {
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000181 authenticated = 1;
djm@openbsd.orgf69b69b2014-12-22 07:51:30 +0000182 /* Record the successful key to prevent reuse */
183 auth2_record_userkey(authctxt, key);
184 key = NULL; /* Don't free below */
185 }
Damien Millerfb1310e2004-01-21 11:02:50 +1100186 buffer_free(&b);
Darren Tuckera627d422013-06-02 07:31:17 +1000187 free(sig);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000188 } else {
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000189 debug("%s: test whether pkalg/pkblob are acceptable for %s %s",
190 __func__, sshkey_type(key), fp);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000191 packet_check_eom();
192
193 /* XXX fake reply and always send PK_OK ? */
194 /*
195 * XXX this allows testing whether a user is allowed
196 * to login: if you happen to have a valid pubkey this
197 * message is sent. the message is NEVER sent at all
198 * if a user is not allowed to login. is this an
199 * issue? -markus
200 */
djm@openbsd.org179be0f2015-05-01 03:23:51 +0000201 if (PRIVSEP(user_key_allowed(authctxt->pw, key, 0))) {
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000202 packet_start(SSH2_MSG_USERAUTH_PK_OK);
203 packet_put_string(pkalg, alen);
204 packet_put_string(pkblob, blen);
205 packet_send();
206 packet_write_wait();
207 authctxt->postponed = 1;
208 }
209 }
210 if (authenticated != 1)
211 auth_clear_options();
212done:
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000213 debug2("%s: authenticated %d pkalg %s", __func__, authenticated, pkalg);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000214 if (key != NULL)
215 key_free(key);
Darren Tuckera627d422013-06-02 07:31:17 +1000216 free(pkalg);
217 free(pkblob);
djm@openbsd.orgebacd372016-01-27 00:53:12 +0000218 free(fp);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000219 return authenticated;
220}
221
Darren Tucker74836ae2013-06-02 07:32:00 +1000222void
Damien Miller20bdcd72013-07-18 16:10:09 +1000223pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)
Darren Tucker74836ae2013-06-02 07:32:00 +1000224{
Damien Miller20bdcd72013-07-18 16:10:09 +1000225 char *fp, *extra;
226 va_list ap;
227 int i;
228
229 extra = NULL;
230 if (fmt != NULL) {
231 va_start(ap, fmt);
232 i = vasprintf(&extra, fmt, ap);
233 va_end(ap);
234 if (i < 0 || extra == NULL)
235 fatal("%s: vasprintf failed", __func__);
236 }
Darren Tucker74836ae2013-06-02 07:32:00 +1000237
238 if (key_is_cert(key)) {
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000239 fp = sshkey_fingerprint(key->cert->signature_key,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000240 options.fingerprint_hash, SSH_FP_DEFAULT);
Damien Miller20bdcd72013-07-18 16:10:09 +1000241 auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s",
Darren Tucker74836ae2013-06-02 07:32:00 +1000242 key_type(key), key->cert->key_id,
243 (unsigned long long)key->cert->serial,
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000244 key_type(key->cert->signature_key),
djm@openbsd.org13a39412015-02-17 00:14:05 +0000245 fp == NULL ? "(null)" : fp,
Damien Miller20bdcd72013-07-18 16:10:09 +1000246 extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
Darren Tucker74836ae2013-06-02 07:32:00 +1000247 free(fp);
248 } else {
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000249 fp = sshkey_fingerprint(key, options.fingerprint_hash,
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000250 SSH_FP_DEFAULT);
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000251 auth_info(authctxt, "%s %s%s%s", key_type(key),
djm@openbsd.org13a39412015-02-17 00:14:05 +0000252 fp == NULL ? "(null)" : fp,
Damien Miller20bdcd72013-07-18 16:10:09 +1000253 extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
Darren Tucker74836ae2013-06-02 07:32:00 +1000254 free(fp);
255 }
Damien Miller20bdcd72013-07-18 16:10:09 +1000256 free(extra);
Darren Tucker74836ae2013-06-02 07:32:00 +1000257}
258
djm@openbsd.org24232a32015-05-21 06:38:35 +0000259/*
260 * Splits 's' into an argument vector. Handles quoted string and basic
261 * escape characters (\\, \", \'). Caller must free the argument vector
262 * and its members.
263 */
264static int
265split_argv(const char *s, int *argcp, char ***argvp)
266{
267 int r = SSH_ERR_INTERNAL_ERROR;
268 int argc = 0, quote, i, j;
269 char *arg, **argv = xcalloc(1, sizeof(*argv));
270
271 *argvp = NULL;
272 *argcp = 0;
273
274 for (i = 0; s[i] != '\0'; i++) {
275 /* Skip leading whitespace */
276 if (s[i] == ' ' || s[i] == '\t')
277 continue;
278
279 /* Start of a token */
280 quote = 0;
281 if (s[i] == '\\' &&
282 (s[i + 1] == '\'' || s[i + 1] == '\"' || s[i + 1] == '\\'))
283 i++;
284 else if (s[i] == '\'' || s[i] == '"')
285 quote = s[i++];
286
287 argv = xreallocarray(argv, (argc + 2), sizeof(*argv));
288 arg = argv[argc++] = xcalloc(1, strlen(s + i) + 1);
289 argv[argc] = NULL;
290
291 /* Copy the token in, removing escapes */
292 for (j = 0; s[i] != '\0'; i++) {
293 if (s[i] == '\\') {
294 if (s[i + 1] == '\'' ||
295 s[i + 1] == '\"' ||
296 s[i + 1] == '\\') {
297 i++; /* Skip '\' */
298 arg[j++] = s[i];
299 } else {
300 /* Unrecognised escape */
301 arg[j++] = s[i];
302 }
303 } else if (quote == 0 && (s[i] == ' ' || s[i] == '\t'))
304 break; /* done */
305 else if (quote != 0 && s[i] == quote)
306 break; /* done */
307 else
308 arg[j++] = s[i];
309 }
310 if (s[i] == '\0') {
311 if (quote != 0) {
312 /* Ran out of string looking for close quote */
313 r = SSH_ERR_INVALID_FORMAT;
314 goto out;
315 }
316 break;
317 }
318 }
319 /* Success */
320 *argcp = argc;
321 *argvp = argv;
322 argc = 0;
323 argv = NULL;
324 r = 0;
325 out:
326 if (argc != 0 && argv != NULL) {
327 for (i = 0; i < argc; i++)
328 free(argv[i]);
329 free(argv);
330 }
331 return r;
332}
333
334/*
335 * Reassemble an argument vector into a string, quoting and escaping as
336 * necessary. Caller must free returned string.
337 */
338static char *
339assemble_argv(int argc, char **argv)
340{
341 int i, j, ws, r;
342 char c, *ret;
343 struct sshbuf *buf, *arg;
344
345 if ((buf = sshbuf_new()) == NULL || (arg = sshbuf_new()) == NULL)
346 fatal("%s: sshbuf_new failed", __func__);
347
348 for (i = 0; i < argc; i++) {
349 ws = 0;
350 sshbuf_reset(arg);
351 for (j = 0; argv[i][j] != '\0'; j++) {
352 r = 0;
353 c = argv[i][j];
354 switch (c) {
355 case ' ':
356 case '\t':
357 ws = 1;
358 r = sshbuf_put_u8(arg, c);
359 break;
360 case '\\':
361 case '\'':
362 case '"':
363 if ((r = sshbuf_put_u8(arg, '\\')) != 0)
364 break;
365 /* FALLTHROUGH */
366 default:
367 r = sshbuf_put_u8(arg, c);
368 break;
369 }
370 if (r != 0)
371 fatal("%s: sshbuf_put_u8: %s",
372 __func__, ssh_err(r));
373 }
374 if ((i != 0 && (r = sshbuf_put_u8(buf, ' ')) != 0) ||
375 (ws != 0 && (r = sshbuf_put_u8(buf, '"')) != 0) ||
376 (r = sshbuf_putb(buf, arg)) != 0 ||
377 (ws != 0 && (r = sshbuf_put_u8(buf, '"')) != 0))
378 fatal("%s: buffer error: %s", __func__, ssh_err(r));
379 }
380 if ((ret = malloc(sshbuf_len(buf) + 1)) == NULL)
381 fatal("%s: malloc failed", __func__);
382 memcpy(ret, sshbuf_ptr(buf), sshbuf_len(buf));
383 ret[sshbuf_len(buf)] = '\0';
384 sshbuf_free(buf);
385 sshbuf_free(arg);
386 return ret;
387}
388
389/*
390 * Runs command in a subprocess. Returns pid on success and a FILE* to the
391 * subprocess' stdout or 0 on failure.
392 * NB. "command" is only used for logging.
393 */
394static pid_t
395subprocess(const char *tag, struct passwd *pw, const char *command,
396 int ac, char **av, FILE **child)
397{
398 FILE *f;
399 struct stat st;
400 int devnull, p[2], i;
401 pid_t pid;
402 char *cp, errmsg[512];
403 u_int envsize;
404 char **child_env;
405
406 *child = NULL;
407
408 debug3("%s: %s command \"%s\" running as %s", __func__,
409 tag, command, pw->pw_name);
410
411 /* Verify the path exists and is safe-ish to execute */
412 if (*av[0] != '/') {
413 error("%s path is not absolute", tag);
414 return 0;
415 }
416 temporarily_use_uid(pw);
417 if (stat(av[0], &st) < 0) {
418 error("Could not stat %s \"%s\": %s", tag,
419 av[0], strerror(errno));
420 restore_uid();
421 return 0;
422 }
423 if (auth_secure_path(av[0], &st, NULL, 0,
424 errmsg, sizeof(errmsg)) != 0) {
425 error("Unsafe %s \"%s\": %s", tag, av[0], errmsg);
426 restore_uid();
427 return 0;
428 }
429
430 /*
431 * Run the command; stderr is left in place, stdout is the
432 * authorized_keys output.
433 */
434 if (pipe(p) != 0) {
435 error("%s: pipe: %s", tag, strerror(errno));
436 restore_uid();
437 return 0;
438 }
439
440 /*
441 * Don't want to call this in the child, where it can fatal() and
442 * run cleanup_exit() code.
443 */
444 restore_uid();
445
446 switch ((pid = fork())) {
447 case -1: /* error */
448 error("%s: fork: %s", tag, strerror(errno));
449 close(p[0]);
450 close(p[1]);
451 return 0;
452 case 0: /* child */
453 /* Prepare a minimal environment for the child. */
454 envsize = 5;
455 child_env = xcalloc(sizeof(*child_env), envsize);
456 child_set_env(&child_env, &envsize, "PATH", _PATH_STDPATH);
457 child_set_env(&child_env, &envsize, "USER", pw->pw_name);
458 child_set_env(&child_env, &envsize, "LOGNAME", pw->pw_name);
459 child_set_env(&child_env, &envsize, "HOME", pw->pw_dir);
460 if ((cp = getenv("LANG")) != NULL)
461 child_set_env(&child_env, &envsize, "LANG", cp);
462
463 for (i = 0; i < NSIG; i++)
464 signal(i, SIG_DFL);
465
466 if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
467 error("%s: open %s: %s", tag, _PATH_DEVNULL,
468 strerror(errno));
469 _exit(1);
470 }
471 /* Keep stderr around a while longer to catch errors */
472 if (dup2(devnull, STDIN_FILENO) == -1 ||
473 dup2(p[1], STDOUT_FILENO) == -1) {
474 error("%s: dup2: %s", tag, strerror(errno));
475 _exit(1);
476 }
477 closefrom(STDERR_FILENO + 1);
478
479 /* Don't use permanently_set_uid() here to avoid fatal() */
480 if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
481 error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid,
482 strerror(errno));
483 _exit(1);
484 }
485 if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) {
486 error("%s: setresuid %u: %s", tag, (u_int)pw->pw_uid,
487 strerror(errno));
488 _exit(1);
489 }
490 /* stdin is pointed to /dev/null at this point */
491 if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) {
492 error("%s: dup2: %s", tag, strerror(errno));
493 _exit(1);
494 }
495
496 execve(av[0], av, child_env);
497 error("%s exec \"%s\": %s", tag, command, strerror(errno));
498 _exit(127);
499 default: /* parent */
500 break;
501 }
502
503 close(p[1]);
504 if ((f = fdopen(p[0], "r")) == NULL) {
505 error("%s: fdopen: %s", tag, strerror(errno));
506 close(p[0]);
507 /* Don't leave zombie child */
508 kill(pid, SIGTERM);
509 while (waitpid(pid, NULL, 0) == -1 && errno == EINTR)
510 ;
511 return 0;
512 }
513 /* Success */
514 debug3("%s: %s pid %ld", __func__, tag, (long)pid);
515 *child = f;
516 return pid;
517}
518
519/* Returns 0 if pid exited cleanly, non-zero otherwise */
520static int
521exited_cleanly(pid_t pid, const char *tag, const char *cmd)
522{
523 int status;
524
525 while (waitpid(pid, &status, 0) == -1) {
526 if (errno != EINTR) {
527 error("%s: waitpid: %s", tag, strerror(errno));
528 return -1;
529 }
530 }
531 if (WIFSIGNALED(status)) {
532 error("%s %s exited on signal %d", tag, cmd, WTERMSIG(status));
533 return -1;
534 } else if (WEXITSTATUS(status) != 0) {
535 error("%s %s failed, status %d", tag, cmd, WEXITSTATUS(status));
536 return -1;
537 }
538 return 0;
539}
540
Damien Miller30da3442010-05-10 11:58:03 +1000541static int
Damien Miller86687062014-07-02 15:28:02 +1000542match_principals_option(const char *principal_list, struct sshkey_cert *cert)
Damien Miller30da3442010-05-10 11:58:03 +1000543{
544 char *result;
545 u_int i;
546
547 /* XXX percent_expand() sequences for authorized_principals? */
548
549 for (i = 0; i < cert->nprincipals; i++) {
550 if ((result = match_list(cert->principals[i],
551 principal_list, NULL)) != NULL) {
552 debug3("matched principal from key options \"%.100s\"",
553 result);
Darren Tuckera627d422013-06-02 07:31:17 +1000554 free(result);
Damien Miller30da3442010-05-10 11:58:03 +1000555 return 1;
556 }
557 }
558 return 0;
559}
560
561static int
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000562process_principals(FILE *f, char *file, struct passwd *pw,
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000563 const struct sshkey_cert *cert)
Damien Miller30da3442010-05-10 11:58:03 +1000564{
Damien Miller6018a362010-07-02 13:35:19 +1000565 char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts;
Damien Miller30da3442010-05-10 11:58:03 +1000566 u_long linenum = 0;
djm@openbsd.org52763dd2017-01-30 01:03:00 +0000567 u_int i, found_principal = 0;
Damien Miller30da3442010-05-10 11:58:03 +1000568
Damien Miller30da3442010-05-10 11:58:03 +1000569 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
djm@openbsd.org52763dd2017-01-30 01:03:00 +0000570 /* Always consume entire input */
571 if (found_principal)
572 continue;
Damien Miller6018a362010-07-02 13:35:19 +1000573 /* Skip leading whitespace. */
Damien Miller30da3442010-05-10 11:58:03 +1000574 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
575 ;
Damien Miller6018a362010-07-02 13:35:19 +1000576 /* Skip blank and comment lines. */
577 if ((ep = strchr(cp, '#')) != NULL)
578 *ep = '\0';
579 if (!*cp || *cp == '\n')
Damien Miller30da3442010-05-10 11:58:03 +1000580 continue;
Damien Miller6018a362010-07-02 13:35:19 +1000581 /* Trim trailing whitespace. */
582 ep = cp + strlen(cp) - 1;
583 while (ep > cp && (*ep == '\n' || *ep == ' ' || *ep == '\t'))
584 *ep-- = '\0';
585 /*
586 * If the line has internal whitespace then assume it has
587 * key options.
588 */
589 line_opts = NULL;
590 if ((ep = strrchr(cp, ' ')) != NULL ||
591 (ep = strrchr(cp, '\t')) != NULL) {
592 for (; *ep == ' ' || *ep == '\t'; ep++)
Damien Miller188ea812010-12-01 11:50:14 +1100593 ;
Damien Miller6018a362010-07-02 13:35:19 +1000594 line_opts = cp;
595 cp = ep;
596 }
Damien Miller30da3442010-05-10 11:58:03 +1000597 for (i = 0; i < cert->nprincipals; i++) {
598 if (strcmp(cp, cert->principals[i]) == 0) {
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000599 debug3("%s:%lu: matched principal \"%.100s\"",
600 file == NULL ? "(command)" : file,
601 linenum, cert->principals[i]);
Damien Miller6018a362010-07-02 13:35:19 +1000602 if (auth_parse_options(pw, line_opts,
603 file, linenum) != 1)
604 continue;
djm@openbsd.org52763dd2017-01-30 01:03:00 +0000605 found_principal = 1;
606 continue;
Damien Miller30da3442010-05-10 11:58:03 +1000607 }
608 }
609 }
djm@openbsd.org52763dd2017-01-30 01:03:00 +0000610 return found_principal;
Damien Miller09d3e122012-10-31 08:58:58 +1100611}
Damien Miller30da3442010-05-10 11:58:03 +1000612
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000613static int
614match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert)
615{
616 FILE *f;
617 int success;
618
619 temporarily_use_uid(pw);
620 debug("trying authorized principals file %s", file);
621 if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) {
622 restore_uid();
623 return 0;
624 }
625 success = process_principals(f, file, pw, cert);
626 fclose(f);
627 restore_uid();
628 return success;
629}
630
631/*
632 * Checks whether principal is allowed in output of command.
633 * returns 1 if the principal is allowed or 0 otherwise.
634 */
635static int
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000636match_principals_command(struct passwd *user_pw, const struct sshkey *key)
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000637{
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000638 const struct sshkey_cert *cert = key->cert;
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000639 FILE *f = NULL;
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000640 int r, ok, found_principal = 0;
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000641 struct passwd *pw;
642 int i, ac = 0, uid_swapped = 0;
643 pid_t pid;
644 char *tmp, *username = NULL, *command = NULL, **av = NULL;
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000645 char *ca_fp = NULL, *key_fp = NULL, *catext = NULL, *keytext = NULL;
djm@openbsd.orgbfa9d962016-09-21 01:34:45 +0000646 char serial_s[16];
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000647 void (*osigchld)(int);
648
649 if (options.authorized_principals_command == NULL)
650 return 0;
651 if (options.authorized_principals_command_user == NULL) {
652 error("No user for AuthorizedPrincipalsCommand specified, "
653 "skipping");
654 return 0;
655 }
656
657 /*
658 * NB. all returns later this function should go via "out" to
659 * ensure the original SIGCHLD handler is restored properly.
660 */
661 osigchld = signal(SIGCHLD, SIG_DFL);
662
663 /* Prepare and verify the user for the command */
664 username = percent_expand(options.authorized_principals_command_user,
665 "u", user_pw->pw_name, (char *)NULL);
666 pw = getpwnam(username);
667 if (pw == NULL) {
668 error("AuthorizedPrincipalsCommandUser \"%s\" not found: %s",
669 username, strerror(errno));
670 goto out;
671 }
672
673 /* Turn the command into an argument vector */
674 if (split_argv(options.authorized_principals_command, &ac, &av) != 0) {
675 error("AuthorizedPrincipalsCommand \"%s\" contains "
676 "invalid quotes", command);
677 goto out;
678 }
679 if (ac == 0) {
680 error("AuthorizedPrincipalsCommand \"%s\" yielded no arguments",
681 command);
682 goto out;
683 }
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000684 if ((ca_fp = sshkey_fingerprint(cert->signature_key,
685 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
686 error("%s: sshkey_fingerprint failed", __func__);
687 goto out;
688 }
djm@openbsd.org00df97f2016-09-14 20:11:26 +0000689 if ((key_fp = sshkey_fingerprint(key,
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000690 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
691 error("%s: sshkey_fingerprint failed", __func__);
692 goto out;
693 }
694 if ((r = sshkey_to_base64(cert->signature_key, &catext)) != 0) {
695 error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
696 goto out;
697 }
698 if ((r = sshkey_to_base64(key, &keytext)) != 0) {
699 error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
700 goto out;
701 }
djm@openbsd.orgf83a0cf2016-09-21 17:44:20 +0000702 snprintf(serial_s, sizeof(serial_s), "%llu",
703 (unsigned long long)cert->serial);
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000704 for (i = 1; i < ac; i++) {
705 tmp = percent_expand(av[i],
706 "u", user_pw->pw_name,
707 "h", user_pw->pw_dir,
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000708 "t", sshkey_ssh_name(key),
709 "T", sshkey_ssh_name(cert->signature_key),
710 "f", key_fp,
711 "F", ca_fp,
712 "k", keytext,
713 "K", catext,
djm@openbsd.orgbfa9d962016-09-21 01:34:45 +0000714 "i", cert->key_id,
715 "s", serial_s,
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000716 (char *)NULL);
717 if (tmp == NULL)
718 fatal("%s: percent_expand failed", __func__);
719 free(av[i]);
720 av[i] = tmp;
721 }
722 /* Prepare a printable command for logs, etc. */
723 command = assemble_argv(ac, av);
724
725 if ((pid = subprocess("AuthorizedPrincipalsCommand", pw, command,
726 ac, av, &f)) == 0)
727 goto out;
728
729 uid_swapped = 1;
730 temporarily_use_uid(pw);
731
jsing@openbsd.orgaff3e942015-06-15 18:42:19 +0000732 ok = process_principals(f, NULL, pw, cert);
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000733
djm@openbsd.orgddd3d342016-12-30 22:08:02 +0000734 fclose(f);
735 f = NULL;
736
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000737 if (exited_cleanly(pid, "AuthorizedPrincipalsCommand", command) != 0)
738 goto out;
739
740 /* Read completed successfully */
741 found_principal = ok;
742 out:
743 if (f != NULL)
744 fclose(f);
745 signal(SIGCHLD, osigchld);
746 for (i = 0; i < ac; i++)
747 free(av[i]);
748 free(av);
749 if (uid_swapped)
750 restore_uid();
751 free(command);
752 free(username);
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000753 free(ca_fp);
754 free(key_fp);
755 free(catext);
756 free(keytext);
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000757 return found_principal;
758}
Damien Miller09d3e122012-10-31 08:58:58 +1100759/*
760 * Checks whether key is allowed in authorized_keys-format file,
761 * returns 1 if the key is allowed or 0 otherwise.
762 */
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000763static int
Damien Miller09d3e122012-10-31 08:58:58 +1100764check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000765{
Darren Tucker22cc7412004-12-06 22:47:41 +1100766 char line[SSH_MAX_PUBKEY_BYTES];
Darren Tucker33c787f2008-07-02 22:37:30 +1000767 int found_key = 0;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000768 u_long linenum = 0;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000769 Key *found;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000770
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000771 found_key = 0;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000772
Darren Tucker74836ae2013-06-02 07:32:00 +1000773 found = NULL;
Darren Tucker22cc7412004-12-06 22:47:41 +1100774 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
djm@openbsd.orgfd6dcef2016-11-30 02:57:40 +0000775 char *cp, *key_options = NULL, *fp = NULL;
776 const char *reason = NULL;
777
djm@openbsd.org52763dd2017-01-30 01:03:00 +0000778 /* Always consume entrire file */
779 if (found_key)
780 continue;
Darren Tucker74836ae2013-06-02 07:32:00 +1000781 if (found != NULL)
782 key_free(found);
783 found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type);
Damien Miller0a80ca12010-02-27 07:55:05 +1100784 auth_clear_options();
785
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000786 /* Skip leading whitespace, empty and comment lines. */
787 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
788 ;
789 if (!*cp || *cp == '\n' || *cp == '#')
790 continue;
791
792 if (key_read(found, &cp) != 1) {
793 /* no key? check if there are options for this key */
794 int quoted = 0;
795 debug2("user_key_allowed: check options: '%s'", cp);
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000796 key_options = cp;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000797 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
798 if (*cp == '\\' && cp[1] == '"')
799 cp++; /* Skip both */
800 else if (*cp == '"')
801 quoted = !quoted;
802 }
803 /* Skip remaining whitespace. */
804 for (; *cp == ' ' || *cp == '\t'; cp++)
805 ;
806 if (key_read(found, &cp) != 1) {
807 debug2("user_key_allowed: advance: '%s'", cp);
808 /* still no key? advance to next line*/
809 continue;
810 }
811 }
Damien Miller4e270b02010-04-16 15:56:21 +1000812 if (key_is_cert(key)) {
Damien Miller0a80ca12010-02-27 07:55:05 +1100813 if (!key_equal(found, key->cert->signature_key))
814 continue;
Damien Miller84399552010-05-21 14:58:12 +1000815 if (auth_parse_options(pw, key_options, file,
816 linenum) != 1)
817 continue;
818 if (!key_is_cert_authority)
819 continue;
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000820 if ((fp = sshkey_fingerprint(found,
821 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
822 continue;
Damien Millere513a912010-03-22 05:51:21 +1100823 debug("matching CA found: file %s, line %lu, %s %s",
824 file, linenum, key_type(found), fp);
Damien Miller30da3442010-05-10 11:58:03 +1000825 /*
826 * If the user has specified a list of principals as
827 * a key option, then prefer that list to matching
828 * their username in the certificate principals list.
829 */
830 if (authorized_principals != NULL &&
831 !match_principals_option(authorized_principals,
832 key->cert)) {
833 reason = "Certificate does not contain an "
834 "authorized principal";
835 fail_reason:
Darren Tuckera627d422013-06-02 07:31:17 +1000836 free(fp);
Damien Miller0a80ca12010-02-27 07:55:05 +1100837 error("%s", reason);
838 auth_debug_add("%s", reason);
839 continue;
840 }
Damien Miller30da3442010-05-10 11:58:03 +1000841 if (key_cert_check_authority(key, 0, 0,
842 authorized_principals == NULL ? pw->pw_name : NULL,
843 &reason) != 0)
844 goto fail_reason;
djm@openbsd.orgfd6dcef2016-11-30 02:57:40 +0000845 if (auth_cert_options(key, pw, &reason) != 0)
846 goto fail_reason;
djm@openbsd.org63d18812015-10-27 01:44:45 +0000847 verbose("Accepted certificate ID \"%s\" (serial %llu) "
Damien Millere513a912010-03-22 05:51:21 +1100848 "signed by %s CA %s via %s", key->cert->key_id,
djm@openbsd.org63d18812015-10-27 01:44:45 +0000849 (unsigned long long)key->cert->serial,
Damien Millere513a912010-03-22 05:51:21 +1100850 key_type(found), fp, file);
Darren Tuckera627d422013-06-02 07:31:17 +1000851 free(fp);
Damien Miller0a80ca12010-02-27 07:55:05 +1100852 found_key = 1;
853 break;
Damien Miller84399552010-05-21 14:58:12 +1000854 } else if (key_equal(found, key)) {
855 if (auth_parse_options(pw, key_options, file,
856 linenum) != 1)
857 continue;
858 if (key_is_cert_authority)
859 continue;
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000860 if ((fp = sshkey_fingerprint(found,
861 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
862 continue;
Darren Tucker74836ae2013-06-02 07:32:00 +1000863 debug("matching key found: file %s, line %lu %s %s",
864 file, linenum, key_type(found), fp);
Darren Tuckera627d422013-06-02 07:31:17 +1000865 free(fp);
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000866 found_key = 1;
djm@openbsd.org52763dd2017-01-30 01:03:00 +0000867 continue;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000868 }
869 }
Darren Tucker74836ae2013-06-02 07:32:00 +1000870 if (found != NULL)
871 key_free(found);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000872 if (!found_key)
873 debug2("key not found");
874 return found_key;
875}
876
Damien Miller1aed65e2010-03-04 21:53:35 +1100877/* Authenticate a certificate key against TrustedUserCAKeys */
878static int
879user_cert_trusted_ca(struct passwd *pw, Key *key)
880{
Damien Miller30da3442010-05-10 11:58:03 +1000881 char *ca_fp, *principals_file = NULL;
Damien Miller1aed65e2010-03-04 21:53:35 +1100882 const char *reason;
jsing@openbsd.org596dbca2015-06-15 18:44:22 +0000883 int ret = 0, found_principal = 0, use_authorized_principals;
Damien Miller1aed65e2010-03-04 21:53:35 +1100884
885 if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
886 return 0;
887
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000888 if ((ca_fp = sshkey_fingerprint(key->cert->signature_key,
889 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
890 return 0;
Damien Miller1aed65e2010-03-04 21:53:35 +1100891
djm@openbsd.org5e39a492014-12-04 02:24:32 +0000892 if (sshkey_in_file(key->cert->signature_key,
893 options.trusted_user_ca_keys, 1, 0) != 0) {
Damien Miller1aed65e2010-03-04 21:53:35 +1100894 debug2("%s: CA %s %s is not listed in %s", __func__,
895 key_type(key->cert->signature_key), ca_fp,
896 options.trusted_user_ca_keys);
897 goto out;
898 }
Damien Miller30da3442010-05-10 11:58:03 +1000899 /*
900 * If AuthorizedPrincipals is in use, then compare the certificate
901 * principals against the names in that file rather than matching
902 * against the username.
903 */
904 if ((principals_file = authorized_principals_file(pw)) != NULL) {
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000905 if (match_principals_file(principals_file, pw, key->cert))
906 found_principal = 1;
907 }
908 /* Try querying command if specified */
djm@openbsd.orge7907c12016-09-14 05:42:25 +0000909 if (!found_principal && match_principals_command(pw, key))
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000910 found_principal = 1;
jsing@openbsd.org596dbca2015-06-15 18:44:22 +0000911 /* If principals file or command is specified, then require a match */
912 use_authorized_principals = principals_file != NULL ||
913 options.authorized_principals_command != NULL;
914 if (!found_principal && use_authorized_principals) {
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000915 reason = "Certificate does not contain an authorized principal";
Damien Miller30da3442010-05-10 11:58:03 +1000916 fail_reason:
djm@openbsd.orgbcc50d82015-05-21 06:43:30 +0000917 error("%s", reason);
918 auth_debug_add("%s", reason);
919 goto out;
Damien Miller1aed65e2010-03-04 21:53:35 +1100920 }
Damien Miller30da3442010-05-10 11:58:03 +1000921 if (key_cert_check_authority(key, 0, 1,
jsing@openbsd.org596dbca2015-06-15 18:44:22 +0000922 use_authorized_principals ? NULL : pw->pw_name, &reason) != 0)
Damien Miller30da3442010-05-10 11:58:03 +1000923 goto fail_reason;
djm@openbsd.orgfd6dcef2016-11-30 02:57:40 +0000924 if (auth_cert_options(key, pw, &reason) != 0)
925 goto fail_reason;
Damien Miller1aed65e2010-03-04 21:53:35 +1100926
djm@openbsd.org63d18812015-10-27 01:44:45 +0000927 verbose("Accepted certificate ID \"%s\" (serial %llu) signed by "
928 "%s CA %s via %s", key->cert->key_id,
929 (unsigned long long)key->cert->serial,
930 key_type(key->cert->signature_key), ca_fp,
Damien Millere513a912010-03-22 05:51:21 +1100931 options.trusted_user_ca_keys);
Damien Miller1aed65e2010-03-04 21:53:35 +1100932 ret = 1;
933
934 out:
Darren Tuckera627d422013-06-02 07:31:17 +1000935 free(principals_file);
936 free(ca_fp);
Damien Miller1aed65e2010-03-04 21:53:35 +1100937 return ret;
938}
939
Damien Miller09d3e122012-10-31 08:58:58 +1100940/*
941 * Checks whether key is allowed in file.
942 * returns 1 if the key is allowed or 0 otherwise.
943 */
944static int
945user_key_allowed2(struct passwd *pw, Key *key, char *file)
946{
947 FILE *f;
948 int found_key = 0;
949
950 /* Temporarily use the user's uid. */
951 temporarily_use_uid(pw);
952
953 debug("trying public key file %s", file);
954 if ((f = auth_openkeyfile(file, pw, options.strict_modes)) != NULL) {
955 found_key = check_authkeys_file(f, file, key, pw);
956 fclose(f);
957 }
958
959 restore_uid();
960 return found_key;
961}
962
963/*
964 * Checks whether key is allowed in output of command.
965 * returns 1 if the key is allowed or 0 otherwise.
966 */
967static int
968user_key_command_allowed2(struct passwd *user_pw, Key *key)
969{
djm@openbsd.org24232a32015-05-21 06:38:35 +0000970 FILE *f = NULL;
971 int r, ok, found_key = 0;
Damien Miller09d3e122012-10-31 08:58:58 +1100972 struct passwd *pw;
djm@openbsd.org24232a32015-05-21 06:38:35 +0000973 int i, uid_swapped = 0, ac = 0;
Damien Miller09d3e122012-10-31 08:58:58 +1100974 pid_t pid;
djm@openbsd.org24232a32015-05-21 06:38:35 +0000975 char *username = NULL, *key_fp = NULL, *keytext = NULL;
976 char *tmp, *command = NULL, **av = NULL;
977 void (*osigchld)(int);
Damien Miller09d3e122012-10-31 08:58:58 +1100978
djm@openbsd.org24232a32015-05-21 06:38:35 +0000979 if (options.authorized_keys_command == NULL)
Damien Miller09d3e122012-10-31 08:58:58 +1100980 return 0;
Damien Millerd0d10992012-11-04 22:23:14 +1100981 if (options.authorized_keys_command_user == NULL) {
982 error("No user for AuthorizedKeysCommand specified, skipping");
983 return 0;
Damien Miller09d3e122012-10-31 08:58:58 +1100984 }
985
djm@openbsd.org24232a32015-05-21 06:38:35 +0000986 /*
987 * NB. all returns later this function should go via "out" to
988 * ensure the original SIGCHLD handler is restored properly.
989 */
990 osigchld = signal(SIGCHLD, SIG_DFL);
991
992 /* Prepare and verify the user for the command */
Damien Millerd0d10992012-11-04 22:23:14 +1100993 username = percent_expand(options.authorized_keys_command_user,
994 "u", user_pw->pw_name, (char *)NULL);
995 pw = getpwnam(username);
996 if (pw == NULL) {
Damien Miller4018dc02013-02-15 10:28:55 +1100997 error("AuthorizedKeysCommandUser \"%s\" not found: %s",
998 username, strerror(errno));
Damien Miller09d3e122012-10-31 08:58:58 +1100999 goto out;
1000 }
1001
djm@openbsd.org24232a32015-05-21 06:38:35 +00001002 /* Prepare AuthorizedKeysCommand */
1003 if ((key_fp = sshkey_fingerprint(key, options.fingerprint_hash,
1004 SSH_FP_DEFAULT)) == NULL) {
1005 error("%s: sshkey_fingerprint failed", __func__);
1006 goto out;
1007 }
1008 if ((r = sshkey_to_base64(key, &keytext)) != 0) {
1009 error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
Damien Miller09d3e122012-10-31 08:58:58 +11001010 goto out;
1011 }
1012
djm@openbsd.org24232a32015-05-21 06:38:35 +00001013 /* Turn the command into an argument vector */
1014 if (split_argv(options.authorized_keys_command, &ac, &av) != 0) {
1015 error("AuthorizedKeysCommand \"%s\" contains invalid quotes",
1016 command);
1017 goto out;
1018 }
1019 if (ac == 0) {
1020 error("AuthorizedKeysCommand \"%s\" yielded no arguments",
1021 command);
1022 goto out;
1023 }
1024 for (i = 1; i < ac; i++) {
1025 tmp = percent_expand(av[i],
1026 "u", user_pw->pw_name,
1027 "h", user_pw->pw_dir,
1028 "t", sshkey_ssh_name(key),
1029 "f", key_fp,
1030 "k", keytext,
1031 (char *)NULL);
1032 if (tmp == NULL)
1033 fatal("%s: percent_expand failed", __func__);
1034 free(av[i]);
1035 av[i] = tmp;
1036 }
1037 /* Prepare a printable command for logs, etc. */
1038 command = assemble_argv(ac, av);
Damien Miller09d3e122012-10-31 08:58:58 +11001039
1040 /*
djm@openbsd.org24232a32015-05-21 06:38:35 +00001041 * If AuthorizedKeysCommand was run without arguments
1042 * then fall back to the old behaviour of passing the
1043 * target username as a single argument.
Damien Miller09d3e122012-10-31 08:58:58 +11001044 */
djm@openbsd.org24232a32015-05-21 06:38:35 +00001045 if (ac == 1) {
1046 av = xreallocarray(av, ac + 2, sizeof(*av));
1047 av[1] = xstrdup(user_pw->pw_name);
1048 av[2] = NULL;
1049 /* Fix up command too, since it is used in log messages */
1050 free(command);
1051 xasprintf(&command, "%s %s", av[0], av[1]);
Damien Miller09d3e122012-10-31 08:58:58 +11001052 }
1053
djm@openbsd.org24232a32015-05-21 06:38:35 +00001054 if ((pid = subprocess("AuthorizedKeysCommand", pw, command,
1055 ac, av, &f)) == 0)
1056 goto out;
1057
1058 uid_swapped = 1;
Damien Miller09d3e122012-10-31 08:58:58 +11001059 temporarily_use_uid(pw);
1060
Damien Miller09d3e122012-10-31 08:58:58 +11001061 ok = check_authkeys_file(f, options.authorized_keys_command, key, pw);
Damien Miller09d3e122012-10-31 08:58:58 +11001062
djm@openbsd.orgddd3d342016-12-30 22:08:02 +00001063 fclose(f);
1064 f = NULL;
1065
djm@openbsd.org24232a32015-05-21 06:38:35 +00001066 if (exited_cleanly(pid, "AuthorizedKeysCommand", command) != 0)
Damien Miller09d3e122012-10-31 08:58:58 +11001067 goto out;
djm@openbsd.org24232a32015-05-21 06:38:35 +00001068
1069 /* Read completed successfully */
Damien Miller09d3e122012-10-31 08:58:58 +11001070 found_key = ok;
1071 out:
djm@openbsd.org24232a32015-05-21 06:38:35 +00001072 if (f != NULL)
1073 fclose(f);
1074 signal(SIGCHLD, osigchld);
1075 for (i = 0; i < ac; i++)
1076 free(av[i]);
1077 free(av);
1078 if (uid_swapped)
1079 restore_uid();
1080 free(command);
1081 free(username);
1082 free(key_fp);
1083 free(keytext);
Damien Miller09d3e122012-10-31 08:58:58 +11001084 return found_key;
1085}
1086
1087/*
1088 * Check whether key authenticates and authorises the user.
1089 */
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00001090int
djm@openbsd.org179be0f2015-05-01 03:23:51 +00001091user_key_allowed(struct passwd *pw, Key *key, int auth_attempt)
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00001092{
Damien Millerd8478b62011-05-29 21:39:36 +10001093 u_int success, i;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00001094 char *file;
1095
Damien Miller1aed65e2010-03-04 21:53:35 +11001096 if (auth_key_is_revoked(key))
1097 return 0;
1098 if (key_is_cert(key) && auth_key_is_revoked(key->cert->signature_key))
1099 return 0;
1100
1101 success = user_cert_trusted_ca(pw, key);
1102 if (success)
1103 return success;
1104
Damien Miller09d3e122012-10-31 08:58:58 +11001105 success = user_key_command_allowed2(pw, key);
1106 if (success > 0)
1107 return success;
1108
Damien Millerd8478b62011-05-29 21:39:36 +10001109 for (i = 0; !success && i < options.num_authkeys_files; i++) {
Damien Miller09d3e122012-10-31 08:58:58 +11001110
1111 if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
1112 continue;
Damien Millerd8478b62011-05-29 21:39:36 +10001113 file = expand_authorized_keys(
1114 options.authorized_keys_files[i], pw);
Damien Miller09d3e122012-10-31 08:58:58 +11001115
Damien Millerd8478b62011-05-29 21:39:36 +10001116 success = user_key_allowed2(pw, key, file);
Darren Tuckera627d422013-06-02 07:31:17 +10001117 free(file);
Damien Millerd8478b62011-05-29 21:39:36 +10001118 }
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00001119
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00001120 return success;
1121}
1122
djm@openbsd.orgf69b69b2014-12-22 07:51:30 +00001123/* Records a public key in the list of previously-successful keys */
1124void
1125auth2_record_userkey(Authctxt *authctxt, struct sshkey *key)
1126{
1127 struct sshkey **tmp;
1128
1129 if (authctxt->nprev_userkeys >= INT_MAX ||
1130 (tmp = reallocarray(authctxt->prev_userkeys,
1131 authctxt->nprev_userkeys + 1, sizeof(*tmp))) == NULL)
1132 fatal("%s: reallocarray failed", __func__);
1133 authctxt->prev_userkeys = tmp;
1134 authctxt->prev_userkeys[authctxt->nprev_userkeys] = key;
1135 authctxt->nprev_userkeys++;
1136}
1137
1138/* Checks whether a key has already been used successfully for authentication */
1139int
1140auth2_userkey_already_used(Authctxt *authctxt, struct sshkey *key)
1141{
1142 u_int i;
1143
1144 for (i = 0; i < authctxt->nprev_userkeys; i++) {
1145 if (sshkey_equal_public(key, authctxt->prev_userkeys[i])) {
1146 return 1;
1147 }
1148 }
1149 return 0;
1150}
1151
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00001152Authmethod method_pubkey = {
1153 "publickey",
1154 userauth_pubkey,
1155 &options.pubkey_authentication
1156};