diff options
| -rw-r--r-- | auth.h | 27 | ||||
| -rw-r--r-- | cli-auth.c | 19 | ||||
| -rw-r--r-- | cli-authpubkey.c | 146 | ||||
| -rw-r--r-- | cli-service.c | 4 | ||||
| -rw-r--r-- | cli-session.c | 32 | ||||
| -rw-r--r-- | dbutil.c | 2 | ||||
| -rw-r--r-- | debug.h | 2 | ||||
| -rw-r--r-- | session.h | 10 | ||||
| -rw-r--r-- | svr-session.c | 11 |
9 files changed, 222 insertions, 31 deletions
@@ -30,24 +30,24 @@ void svr_authinitialise(); void cli_authinitialise(); -void svr_auth_password(); -void svr_auth_pubkey(); - -int cli_auth_password(); -int cli_auth_pubkey(); - /* Server functions */ void recv_msg_userauth_request(); void send_msg_userauth_failure(int partial, int incrfail); void send_msg_userauth_success(); +void svr_auth_password(); +void svr_auth_pubkey(); /* Client functions */ void recv_msg_userauth_failure(); void recv_msg_userauth_success(); +void recv_msg_userauth_pk_ok(); void cli_get_user(); void cli_auth_getmethods(); void cli_auth_try(); void recv_msg_userauth_banner(); +void cli_pubkeyfail(); +int cli_auth_password(); +int cli_auth_pubkey(); #define MAX_USERNAME_LEN 25 /* arbitrary for the moment */ @@ -63,6 +63,9 @@ void recv_msg_userauth_banner(); #define AUTH_METHOD_PASSWORD "password" #define AUTH_METHOD_PASSWORD_LEN 8 +/* For a 4096 bit DSS key, empirically determined to be 1590 bytes */ +#define MAX_PUBKEY_SIZE 1600 + /* This structure is shared between server and client - it contains * relatively little extraneous bits when used for the client rather than the * server */ @@ -83,4 +86,16 @@ struct AuthState { }; +struct PubkeyList; +/* A singly linked list of pubkeys */ +struct PubkeyList { + + sign_key *key; + int type; /* The type of key */ + struct PubkeyList *next; + /* filename? or the buffer? for encrypted keys, so we can later get + * the private key portion */ + +}; + #endif /* _AUTH_H_ */ @@ -7,7 +7,6 @@ #include "packet.h" #include "runopts.h" -#undef DROPBEAR_PUBKEY_AUTH void cli_authinitialise() { @@ -30,7 +29,6 @@ void cli_auth_getmethods() { buf_putstring(ses.writepayload, "none", 4); /* 'none' method */ encrypt_packet(); - cli_ses.state = USERAUTH_METHODS_SENT; TRACE(("leave cli_auth_getmethods")); } @@ -88,6 +86,20 @@ void recv_msg_userauth_failure() { TRACE(("<- MSG_USERAUTH_FAILURE")); TRACE(("enter recv_msg_userauth_failure")); + if (cli_ses.state != USERAUTH_REQ_SENT) { + /* Perhaps we should be more fatal? */ + TRACE(("But we didn't send a userauth request!!!!!!")); + return; + } + +#ifdef DROPBEAR_PUBKEY_AUTH + /* If it was a pubkey auth request, we should cross that key + * off the list. */ + if (cli_ses.lastauthtype == AUTH_TYPE_PUBKEY) { + cli_pubkeyfail(); + } +#endif + methods = buf_getstring(ses.payload, &methlen); partial = buf_getbyte(ses.payload); @@ -154,12 +166,14 @@ void cli_auth_try() { #ifdef DROPBEAR_PUBKEY_AUTH if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) { finished = cli_auth_pubkey(); + cli_ses.lastauthtype = AUTH_TYPE_PUBKEY; } #endif #ifdef DROPBEAR_PASSWORD_AUTH if (!finished && ses.authstate.authtypes & AUTH_TYPE_PASSWORD) { finished = cli_auth_password(); + cli_ses.lastauthtype = AUTH_TYPE_PASSWORD; } #endif @@ -167,6 +181,5 @@ void cli_auth_try() { dropbear_exit("No auth methods could be used."); } - cli_ses.state = USERAUTH_REQ_SENT; TRACE(("leave cli_auth_try")); } diff --git a/cli-authpubkey.c b/cli-authpubkey.c new file mode 100644 index 0000000..dd5a711 --- /dev/null +++ b/cli-authpubkey.c @@ -0,0 +1,146 @@ +#include "includes.h" +#include "buffer.h" +#include "dbutil.h" +#include "session.h" +#include "ssh.h" +#include "runopts.h" +#include "auth.h" + +static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign); + +/* Called when we receive a SSH_MSG_USERAUTH_FAILURE for a pubkey request. + * We use it to remove the key we tried from the list */ +void cli_pubkeyfail() { + + struct PubkeyList *keyitem; + + TRACE(("enter cli_pubkeyfail")); + /* Find the key we failed with, and remove it */ + for (keyitem = cli_ses.pubkeys; keyitem != NULL; keyitem = keyitem->next) { + if (keyitem->next == cli_ses.lastpubkey) { + keyitem->next = cli_ses.lastpubkey->next; + } + } + + sign_key_free(cli_ses.lastpubkey->key); /* It won't be used again */ + m_free(cli_ses.lastpubkey); + TRACE(("leave cli_pubkeyfail")); +} + +void recv_msg_userauth_pk_ok() { + + struct PubkeyList *keyitem; + buffer* keybuf; + char* algotype = NULL; + unsigned int algolen; + int keytype; + unsigned int remotelen; + + TRACE(("enter recv_msg_userauth_pk_ok")); + + algotype = buf_getstring(ses.payload, &algolen); + keytype = signkey_type_from_name(algotype, algolen); + m_free(algotype); + + keybuf = buf_new(MAX_PUBKEY_SIZE); + + remotelen = buf_getint(ses.payload); + + /* Iterate through our keys, find which one it was that matched, and + * send a real request with that key */ + for (keyitem = cli_ses.pubkeys; keyitem != NULL; keyitem = keyitem->next) { + + if (keyitem->type != keytype) { + /* Types differed */ + continue; + } + + /* Now we compare the contents of the key */ + keybuf->pos = keybuf->len = 0; + buf_put_pub_key(keybuf, keyitem->key, keytype); + + if (keybuf->len != remotelen) { + /* Lengths differed */ + continue; + } + + if (memcmp(keybuf->data, + buf_getptr(ses.payload, remotelen), remotelen) != 0) { + /* Data didn't match this key */ + continue; + } + + /* Success */ + break; + } + + if (keyitem != NULL) { + TRACE(("matching key")); + /* XXX TODO: if it's an encrypted key, here we ask for their + * password */ + send_msg_userauth_pubkey(keyitem->key, keytype, 1); + } else { + TRACE(("That was whacky. We got told that a key was valid, but it didn't match our list. Sounds like dodgy code on Dropbear's part")); + } + + TRACE(("leave recv_msg_userauth_pk_ok")); +} + +/* TODO: make it take an agent reference to use as well */ +static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign) { + + const char *algoname = NULL; + int algolen; + buffer* sigbuf = NULL; + + TRACE(("enter send_msg_userauth_pubkey")); + CHECKCLEARTOWRITE(); + + buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST); + + buf_putstring(ses.writepayload, cli_opts.username, + strlen(cli_opts.username)); + + buf_putstring(ses.writepayload, SSH_SERVICE_CONNECTION, + SSH_SERVICE_CONNECTION_LEN); + + buf_putstring(ses.writepayload, AUTH_METHOD_PUBKEY, + AUTH_METHOD_PUBKEY_LEN); + + buf_putbyte(ses.writepayload, realsign); + + algoname = signkey_name_from_type(type, &algolen); + + buf_putstring(ses.writepayload, algoname, algolen); + buf_put_pub_key(ses.writepayload, key, type); + + if (realsign) { + TRACE(("realsign")); + /* We put the signature as well - this contains string(session id), then + * the contents of the write payload to this point */ + sigbuf = buf_new(4 + SHA1_HASH_SIZE + ses.writepayload->len); + buf_putstring(sigbuf, ses.session_id, SHA1_HASH_SIZE); + buf_putbytes(sigbuf, ses.writepayload->data, ses.writepayload->len); + buf_put_sign(ses.writepayload, key, type, sigbuf->data, sigbuf->len); + buf_free(sigbuf); /* Nothing confidential in the buffer */ + } + + encrypt_packet(); + TRACE(("leave send_msg_userauth_pubkey")); +} + +int cli_auth_pubkey() { + + TRACE(("enter cli_auth_pubkey")); + + if (cli_ses.pubkeys != NULL) { + /* Send a trial request */ + send_msg_userauth_pubkey(cli_ses.pubkeys->key, + cli_ses.pubkeys->type, 0); + TRACE(("leave cli_auth_pubkey-success")); + return 1; + } else { + TRACE(("leave cli_auth_pubkey-failure")); + return 0; + } +} diff --git a/cli-service.c b/cli-service.c index 8ba06c6..8fbbad4 100644 --- a/cli-service.c +++ b/cli-service.c @@ -31,7 +31,7 @@ void recv_msg_service_accept() { servicename = buf_getstring(ses.payload, &len); /* ssh-userauth */ - if (cli_ses.state = SERVICE_AUTH_REQ_SENT + if (cli_ses.state == SERVICE_AUTH_REQ_SENT && len == SSH_SERVICE_USERAUTH_LEN && strncmp(SSH_SERVICE_USERAUTH, servicename, len) == 0) { @@ -42,7 +42,7 @@ void recv_msg_service_accept() { } /* ssh-connection */ - if (cli_ses.state = SERVICE_CONN_REQ_SENT + if (cli_ses.state == SERVICE_CONN_REQ_SENT && len == SSH_SERVICE_CONNECTION_LEN && strncmp(SSH_SERVICE_CONNECTION, servicename, len) == 0) { diff --git a/cli-session.c b/cli-session.c index e8c6ae6..987a79b 100644 --- a/cli-session.c +++ b/cli-session.c @@ -19,14 +19,18 @@ static void cli_finished(); struct clientsession cli_ses; /* GLOBAL */ +/* Sorted in decreasing frequency will be more efficient - data and window + * should be first */ static const packettype cli_packettypes[] = { /* TYPE, AUTHREQUIRED, FUNCTION */ - {SSH_MSG_KEXINIT, recv_msg_kexinit}, - {SSH_MSG_KEXDH_REPLY, recv_msg_kexdh_reply}, // client - {SSH_MSG_NEWKEYS, recv_msg_newkeys}, - {SSH_MSG_SERVICE_ACCEPT, recv_msg_service_accept}, // client {SSH_MSG_CHANNEL_DATA, recv_msg_channel_data}, {SSH_MSG_CHANNEL_WINDOW_ADJUST, recv_msg_channel_window_adjust}, + {SSH_MSG_USERAUTH_FAILURE, recv_msg_userauth_failure}, /* client */ + {SSH_MSG_USERAUTH_SUCCESS, recv_msg_userauth_success}, /* client */ + {SSH_MSG_KEXINIT, recv_msg_kexinit}, + {SSH_MSG_KEXDH_REPLY, recv_msg_kexdh_reply}, /* client */ + {SSH_MSG_NEWKEYS, recv_msg_newkeys}, + {SSH_MSG_SERVICE_ACCEPT, recv_msg_service_accept}, /* client */ {SSH_MSG_GLOBAL_REQUEST, recv_msg_global_request_remotetcp}, {SSH_MSG_CHANNEL_REQUEST, recv_msg_channel_request}, {SSH_MSG_CHANNEL_OPEN, recv_msg_channel_open}, @@ -34,9 +38,10 @@ static const packettype cli_packettypes[] = { {SSH_MSG_CHANNEL_CLOSE, recv_msg_channel_close}, {SSH_MSG_CHANNEL_OPEN_CONFIRMATION, recv_msg_channel_open_confirmation}, {SSH_MSG_CHANNEL_OPEN_FAILURE, recv_msg_channel_open_failure}, - {SSH_MSG_USERAUTH_FAILURE, recv_msg_userauth_failure}, // client - {SSH_MSG_USERAUTH_SUCCESS, recv_msg_userauth_success}, // client - {SSH_MSG_USERAUTH_BANNER, recv_msg_userauth_banner}, // client + {SSH_MSG_USERAUTH_BANNER, recv_msg_userauth_banner}, /* client */ +#ifdef DROPBEAR_PUBKEY_AUTH + {SSH_MSG_USERAUTH_PK_OK, recv_msg_userauth_pk_ok}, /* client */ +#endif {0, 0} /* End */ }; @@ -145,28 +150,35 @@ static void cli_sessionloop() { /* userauth code */ case SERVICE_AUTH_ACCEPT_RCVD: cli_auth_getmethods(); - cli_ses.state = USERAUTH_METHODS_SENT; + cli_ses.state = USERAUTH_REQ_SENT; TRACE(("leave cli_sessionloop: sent userauth methods req")); return; case USERAUTH_FAIL_RCVD: cli_auth_try(); + cli_ses.state = USERAUTH_REQ_SENT; TRACE(("leave cli_sessionloop: cli_auth_try")); return; - /* case USERAUTH_SUCCESS_RCVD: send_msg_service_request(SSH_SERVICE_CONNECTION); cli_ses.state = SERVICE_CONN_REQ_SENT; TRACE(("leave cli_sessionloop: sent ssh-connection service req")); return; - */ + case SERVICE_CONN_ACCEPT_RCVD: + cli_send_chansess_request(); + TRACE(("leave cli_sessionloop: cli_send_chansess_request")); + cli_ses.state = SESSION_RUNNING; + return; + + /* case USERAUTH_SUCCESS_RCVD: cli_send_chansess_request(); TRACE(("leave cli_sessionloop: cli_send_chansess_request")); cli_ses.state = SESSION_RUNNING; return; + */ case SESSION_RUNNING: if (ses.chancount < 1) { @@ -103,7 +103,6 @@ void dropbear_log(int priority, const char* format, ...) { #ifdef DEBUG_TRACE void dropbear_trace(const char* format, ...) { -#if 0 va_list param; va_start(param, format); @@ -111,7 +110,6 @@ void dropbear_trace(const char* format, ...) { vfprintf(stderr, format, param); fprintf(stderr, "\n"); va_end(param); -#endif } #endif /* DEBUG_TRACE */ @@ -36,7 +36,7 @@ /* Define this to print trace statements - very verbose */ /* Caution: Don't use this in an unfriendly environment (ie unfirewalled), * since the printing does not sanitise strings etc */ -#define DEBUG_TRACE +//#define DEBUG_TRACE /* All functions writing to the cleartext payload buffer call * CHECKCLEARTOWRITE() before writing. This is only really useful if you're @@ -194,7 +194,6 @@ typedef enum { SERVICE_AUTH_ACCEPT_RCVD, SERVICE_CONN_REQ_SENT, SERVICE_CONN_ACCEPT_RCVD, - USERAUTH_METHODS_SENT, USERAUTH_REQ_SENT, USERAUTH_FAIL_RCVD, USERAUTH_SUCCESS_RCVD, @@ -215,6 +214,15 @@ struct clientsession { int winchange; /* Set to 1 when a windowchange signal happens */ + struct PubkeyList *pubkeys; /* Keys to use for public-key auth */ + int lastauthtype; /* either AUTH_TYPE_PUBKEY or AUTH_TYPE_PASSWORD, + for the last type of auth we tried */ + struct PubkeyList *lastpubkey; +#if 0 + TODO + struct AgentkeyList *agentkeys; /* Keys to use for public-key auth */ +#endif + }; /* Global structs storing the state */ diff --git a/svr-session.c b/svr-session.c index c9aed49..e63ba32 100644 --- a/svr-session.c +++ b/svr-session.c @@ -46,14 +46,13 @@ static void svr_remoteclosed(); struct serversession svr_ses; /* GLOBAL */ static const packettype svr_packettypes[] = { - /* TYPE, AUTHREQUIRED, FUNCTION */ - {SSH_MSG_SERVICE_REQUEST, recv_msg_service_request}, // server - {SSH_MSG_USERAUTH_REQUEST, recv_msg_userauth_request}, //server - {SSH_MSG_KEXINIT, recv_msg_kexinit}, - {SSH_MSG_KEXDH_INIT, recv_msg_kexdh_init}, // server - {SSH_MSG_NEWKEYS, recv_msg_newkeys}, {SSH_MSG_CHANNEL_DATA, recv_msg_channel_data}, {SSH_MSG_CHANNEL_WINDOW_ADJUST, recv_msg_channel_window_adjust}, + {SSH_MSG_USERAUTH_REQUEST, recv_msg_userauth_request}, /* server */ + {SSH_MSG_SERVICE_REQUEST, recv_msg_service_request}, /* server */ + {SSH_MSG_KEXINIT, recv_msg_kexinit}, + {SSH_MSG_KEXDH_INIT, recv_msg_kexdh_init}, /* server */ + {SSH_MSG_NEWKEYS, recv_msg_newkeys}, {SSH_MSG_GLOBAL_REQUEST, recv_msg_global_request_remotetcp}, {SSH_MSG_CHANNEL_REQUEST, recv_msg_channel_request}, {SSH_MSG_CHANNEL_OPEN, recv_msg_channel_open}, |