1 /* $OpenBSD: monitor_wrap.c,v 1.147 2026/05/31 11:30:50 djm Exp $ */ 2 /* 3 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 4 * Copyright 2002 Markus Friedl <markus@openbsd.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include "includes.h" 29 30 #include <sys/types.h> 31 #include <sys/uio.h> 32 #include <sys/queue.h> 33 #include <sys/wait.h> 34 35 #include <errno.h> 36 #include <pwd.h> 37 #include <signal.h> 38 #include <stdarg.h> 39 #include <stdio.h> 40 #include <string.h> 41 #include <unistd.h> 42 43 #ifdef WITH_OPENSSL 44 #include <openssl/bn.h> 45 #include <openssl/dh.h> 46 #include <openssl/evp.h> 47 #endif 48 49 #include "xmalloc.h" 50 #include "ssh.h" 51 #ifdef WITH_OPENSSL 52 #include "dh.h" 53 #endif 54 #include "sshbuf.h" 55 #include "sshkey.h" 56 #include "cipher.h" 57 #include "kex.h" 58 #include "hostfile.h" 59 #include "auth.h" 60 #include "auth-options.h" 61 #include "packet.h" 62 #include "mac.h" 63 #include "log.h" 64 #include "auth-pam.h" 65 #include "monitor.h" 66 #ifdef GSSAPI 67 #include "ssh-gss.h" 68 #endif 69 #include "atomicio.h" 70 #include "monitor_fdpass.h" 71 #include "misc.h" 72 73 #include "channels.h" 74 #include "session.h" 75 #include "servconf.h" 76 #include "monitor_wrap.h" 77 #include "srclimit.h" 78 79 #include "ssherr.h" 80 81 /* Imports */ 82 extern struct monitor *pmonitor; 83 extern struct sshbuf *loginmsg; 84 extern ServerOptions options; 85 86 void 87 mm_log_handler(LogLevel level, int forced, const char *msg, void *ctx) 88 { 89 struct sshbuf *log_msg; 90 struct monitor *mon = (struct monitor *)ctx; 91 int r; 92 size_t len; 93 94 if (mon->m_log_sendfd == -1) 95 fatal_f("no log channel"); 96 97 if ((log_msg = sshbuf_new()) == NULL) 98 fatal_f("sshbuf_new failed"); 99 100 if ((r = sshbuf_put_u32(log_msg, 0)) != 0 || /* length; filled below */ 101 (r = sshbuf_put_u32(log_msg, level)) != 0 || 102 (r = sshbuf_put_u32(log_msg, forced)) != 0 || 103 (r = sshbuf_put_cstring(log_msg, msg)) != 0) 104 fatal_fr(r, "assemble"); 105 if ((len = sshbuf_len(log_msg)) < 4 || len > 0xffffffff) 106 fatal_f("bad length %zu", len); 107 POKE_U32(sshbuf_mutable_ptr(log_msg), len - 4); 108 if (atomicio(vwrite, mon->m_log_sendfd, 109 sshbuf_mutable_ptr(log_msg), len) != len) { 110 if (errno == EPIPE) { 111 debug_f("write: %s", strerror(errno)); 112 cleanup_exit(255); 113 } 114 fatal_f("write: %s", strerror(errno)); 115 } 116 sshbuf_free(log_msg); 117 } 118 119 static void 120 mm_reap(void) 121 { 122 int status = -1; 123 124 if (!mm_is_monitor()) 125 return; 126 while (waitpid(pmonitor->m_pid, &status, 0) == -1) { 127 if (errno == EINTR) 128 continue; 129 pmonitor->m_pid = -1; 130 fatal_f("waitpid: %s", strerror(errno)); 131 } 132 if (WIFEXITED(status)) { 133 if (WEXITSTATUS(status) != 0) { 134 debug_f("child exited with status %d", 135 WEXITSTATUS(status)); 136 cleanup_exit(255); 137 } 138 } else if (WIFSIGNALED(status)) { 139 error_f("child terminated by signal %d", 140 WTERMSIG(status)); 141 cleanup_exit(signal_is_crash(WTERMSIG(status)) ? 142 EXIT_CHILD_CRASH : 255); 143 } else { 144 error_f("child terminated abnormally (status=0x%x)", 145 status); 146 cleanup_exit(EXIT_CHILD_CRASH); 147 } 148 } 149 150 void 151 mm_request_send(int sock, enum monitor_reqtype type, struct sshbuf *m) 152 { 153 size_t mlen = sshbuf_len(m); 154 u_char buf[5]; 155 156 debug3_f("entering, type %d", type); 157 158 if (mlen >= MONITOR_MAX_MSGLEN) 159 fatal_f("bad length %zu", mlen); 160 POKE_U32(buf, mlen + 1); 161 buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */ 162 if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf) || 163 atomicio(vwrite, sock, sshbuf_mutable_ptr(m), mlen) != mlen) { 164 if (errno == EPIPE) { 165 debug3_f("monitor fd closed"); 166 mm_reap(); 167 cleanup_exit(255); 168 } 169 fatal_f("write: %s", strerror(errno)); 170 } 171 } 172 173 void 174 mm_request_receive(int sock, struct sshbuf *m) 175 { 176 u_char buf[4], *p = NULL; 177 u_int msg_len; 178 int oerrno, r; 179 180 debug3_f("entering"); 181 182 if (atomicio(read, sock, buf, sizeof(buf)) != sizeof(buf)) { 183 if (errno == EPIPE) { 184 debug3_f("monitor fd closed"); 185 mm_reap(); 186 cleanup_exit(255); 187 } 188 fatal_f("read: %s", strerror(errno)); 189 } 190 msg_len = PEEK_U32(buf); 191 if (msg_len > MONITOR_MAX_MSGLEN) 192 fatal_f("read: bad msg_len %d", msg_len); 193 sshbuf_reset(m); 194 if ((r = sshbuf_reserve(m, msg_len, &p)) != 0) 195 fatal_fr(r, "reserve"); 196 if (atomicio(read, sock, p, msg_len) != msg_len) { 197 oerrno = errno; 198 error_f("read: %s", strerror(errno)); 199 if (oerrno == EPIPE) 200 mm_reap(); 201 cleanup_exit(255); 202 } 203 } 204 205 void 206 mm_request_receive_expect(int sock, enum monitor_reqtype type, struct sshbuf *m) 207 { 208 u_char rtype; 209 int r; 210 211 debug3_f("entering, type %d", type); 212 213 mm_request_receive(sock, m); 214 if ((r = sshbuf_get_u8(m, &rtype)) != 0) 215 fatal_fr(r, "parse"); 216 if (rtype != type) 217 fatal_f("read: rtype %d != type %d", rtype, type); 218 } 219 220 #ifdef WITH_OPENSSL 221 DH * 222 mm_choose_dh(int min, int nbits, int max) 223 { 224 BIGNUM *p, *g; 225 int r; 226 u_char success = 0; 227 struct sshbuf *m; 228 229 if ((m = sshbuf_new()) == NULL) 230 fatal_f("sshbuf_new failed"); 231 if ((r = sshbuf_put_u32(m, min)) != 0 || 232 (r = sshbuf_put_u32(m, nbits)) != 0 || 233 (r = sshbuf_put_u32(m, max)) != 0) 234 fatal_fr(r, "assemble"); 235 236 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_MODULI, m); 237 238 debug3_f("waiting for MONITOR_ANS_MODULI"); 239 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_MODULI, m); 240 241 if ((r = sshbuf_get_u8(m, &success)) != 0) 242 fatal_fr(r, "parse success"); 243 if (success == 0) 244 fatal_f("MONITOR_ANS_MODULI failed"); 245 246 if ((r = sshbuf_get_bignum2(m, &p)) != 0 || 247 (r = sshbuf_get_bignum2(m, &g)) != 0) 248 fatal_fr(r, "parse group"); 249 250 debug3_f("remaining %zu", sshbuf_len(m)); 251 sshbuf_free(m); 252 253 return (dh_new_group(g, p)); 254 } 255 #endif 256 257 void 258 mm_sshkey_setcompat(struct ssh *ssh) 259 { 260 struct sshbuf *m; 261 int r; 262 263 debug3_f("entering"); 264 if ((m = sshbuf_new()) == NULL) 265 fatal_f("sshbuf_new failed"); 266 if ((r = sshbuf_put_u32(m, ssh->compat)) != 0) 267 fatal_fr(r, "assemble"); 268 269 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SETCOMPAT, m); 270 } 271 272 int 273 mm_sshkey_sign(struct ssh *ssh, struct sshkey *key, u_char **sigp, size_t *lenp, 274 const u_char *data, size_t datalen, const char *hostkey_alg, 275 const char *sk_provider, const char *sk_pin, u_int compat) 276 { 277 struct sshbuf *m; 278 int r; 279 280 debug3_f("entering"); 281 if ((m = sshbuf_new()) == NULL) 282 fatal_f("sshbuf_new failed"); 283 if ((r = sshkey_puts(key, m)) != 0 || 284 (r = sshbuf_put_string(m, data, datalen)) != 0 || 285 (r = sshbuf_put_cstring(m, hostkey_alg)) != 0 || 286 (r = sshbuf_put_u32(m, compat)) != 0) 287 fatal_fr(r, "assemble"); 288 289 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, m); 290 291 debug3_f("waiting for MONITOR_ANS_SIGN"); 292 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SIGN, m); 293 if ((r = sshbuf_get_string(m, sigp, lenp)) != 0) 294 fatal_fr(r, "parse"); 295 sshbuf_free(m); 296 debug3_f("%s signature len=%zu", hostkey_alg ? hostkey_alg : "(null)", 297 *lenp); 298 299 return (0); 300 } 301 302 void 303 mm_decode_activate_server_options(struct ssh *ssh, struct sshbuf *m) 304 { 305 struct sshbuf *config; 306 int r; 307 u_int i; 308 309 if ((r = sshbuf_froms(m, &config)) != 0) 310 fatal_fr(r, "parse opts"); 311 if ((r = deserialise_server_options(config, &options)) != 0) 312 fatal_fr(r, "deserialise_server_options"); 313 sshbuf_free(config); 314 315 log_change_level(options.log_level); 316 log_verbose_reset(); 317 for (i = 0; i < options.num_log_verbose; i++) 318 log_verbose_add(options.log_verbose[i]); 319 } 320 321 #define GETPW(b, id) \ 322 do { \ 323 if ((r = sshbuf_get_string_direct(b, &p, &len)) != 0) \ 324 fatal_fr(r, "parse pw %s", #id); \ 325 if (len != sizeof(pw->id)) \ 326 fatal_fr(r, "bad length for %s", #id); \ 327 memcpy(&pw->id, p, len); \ 328 } while (0) 329 330 struct passwd * 331 mm_getpwnamallow(struct ssh *ssh, const char *username) 332 { 333 struct sshbuf *m; 334 struct passwd *pw; 335 size_t len; 336 int r; 337 u_char ok; 338 const u_char *p; 339 340 debug3_f("entering"); 341 342 if ((m = sshbuf_new()) == NULL) 343 fatal_f("sshbuf_new failed"); 344 if ((r = sshbuf_put_cstring(m, username)) != 0) 345 fatal_fr(r, "assemble"); 346 347 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, m); 348 349 debug3_f("waiting for MONITOR_ANS_PWNAM"); 350 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, m); 351 352 if ((r = sshbuf_get_u8(m, &ok)) != 0) 353 fatal_fr(r, "parse success"); 354 if (ok == 0) { 355 pw = NULL; 356 goto out; 357 } 358 359 /* XXX don't like passing struct passwd like this */ 360 pw = xcalloc(sizeof(*pw), 1); 361 GETPW(m, pw_uid); 362 GETPW(m, pw_gid); 363 #ifdef HAVE_STRUCT_PASSWD_PW_CHANGE 364 GETPW(m, pw_change); 365 #endif 366 #ifdef HAVE_STRUCT_PASSWD_PW_EXPIRE 367 GETPW(m, pw_expire); 368 #endif 369 if ((r = sshbuf_get_cstring(m, &pw->pw_name, NULL)) != 0 || 370 (r = sshbuf_get_cstring(m, &pw->pw_passwd, NULL)) != 0 || 371 #ifdef HAVE_STRUCT_PASSWD_PW_GECOS 372 (r = sshbuf_get_cstring(m, &pw->pw_gecos, NULL)) != 0 || 373 #endif 374 #ifdef HAVE_STRUCT_PASSWD_PW_CLASS 375 (r = sshbuf_get_cstring(m, &pw->pw_class, NULL)) != 0 || 376 #endif 377 (r = sshbuf_get_cstring(m, &pw->pw_dir, NULL)) != 0 || 378 (r = sshbuf_get_cstring(m, &pw->pw_shell, NULL)) != 0) 379 fatal_fr(r, "parse pw"); 380 381 out: 382 /* copy options block as a Match directive may have changed some */ 383 mm_decode_activate_server_options(ssh, m); 384 server_process_permitopen(ssh); 385 server_process_channel_timeouts(ssh); 386 kex_set_server_sig_algs(ssh, options.pubkey_accepted_algos); 387 sshbuf_free(m); 388 389 return (pw); 390 } 391 392 char * 393 mm_auth2_read_banner(void) 394 { 395 struct sshbuf *m; 396 char *banner; 397 int r; 398 399 debug3_f("entering"); 400 401 if ((m = sshbuf_new()) == NULL) 402 fatal_f("sshbuf_new failed"); 403 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, m); 404 sshbuf_reset(m); 405 406 mm_request_receive_expect(pmonitor->m_recvfd, 407 MONITOR_ANS_AUTH2_READ_BANNER, m); 408 if ((r = sshbuf_get_cstring(m, &banner, NULL)) != 0) 409 fatal_fr(r, "parse"); 410 sshbuf_free(m); 411 412 /* treat empty banner as missing banner */ 413 if (strlen(banner) == 0) { 414 free(banner); 415 banner = NULL; 416 } 417 return (banner); 418 } 419 420 /* Inform the privileged process about service and style */ 421 422 void 423 mm_inform_authserv(char *service, char *style) 424 { 425 struct sshbuf *m; 426 int r; 427 428 debug3_f("entering"); 429 430 if ((m = sshbuf_new()) == NULL) 431 fatal_f("sshbuf_new failed"); 432 if ((r = sshbuf_put_cstring(m, service)) != 0 || 433 (r = sshbuf_put_cstring(m, style ? style : "")) != 0) 434 fatal_fr(r, "assemble"); 435 436 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, m); 437 438 sshbuf_free(m); 439 } 440 441 /* Do the password authentication */ 442 int 443 mm_auth_password(struct ssh *ssh, char *password) 444 { 445 struct sshbuf *m; 446 int r, authenticated = 0; 447 #ifdef USE_PAM 448 u_int maxtries = 0; 449 #endif 450 451 debug3_f("entering"); 452 453 if ((m = sshbuf_new()) == NULL) 454 fatal_f("sshbuf_new failed"); 455 if ((r = sshbuf_put_cstring(m, password)) != 0) 456 fatal_fr(r, "assemble"); 457 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHPASSWORD, m); 458 459 debug3_f("waiting for MONITOR_ANS_AUTHPASSWORD"); 460 mm_request_receive_expect(pmonitor->m_recvfd, 461 MONITOR_ANS_AUTHPASSWORD, m); 462 463 if ((r = sshbuf_get_u32(m, &authenticated)) != 0) 464 fatal_fr(r, "parse"); 465 #ifdef USE_PAM 466 if ((r = sshbuf_get_u32(m, &maxtries)) != 0) 467 fatal_fr(r, "parse PAM"); 468 if (maxtries > INT_MAX) 469 fatal_fr(r, "bad maxtries"); 470 sshpam_set_maxtries_reached(maxtries); 471 #endif 472 473 sshbuf_free(m); 474 475 debug3_f("user %sauthenticated", authenticated ? "" : "not "); 476 return (authenticated); 477 } 478 479 int 480 mm_user_key_allowed(struct ssh *ssh, struct passwd *pw, struct sshkey *key, 481 int pubkey_auth_attempt, struct sshauthopt **authoptp) 482 { 483 return (mm_key_allowed(MM_USERKEY, NULL, NULL, key, 484 pubkey_auth_attempt, authoptp)); 485 } 486 487 int 488 mm_hostbased_key_allowed(struct ssh *ssh, struct passwd *pw, 489 const char *user, const char *host, struct sshkey *key) 490 { 491 return (mm_key_allowed(MM_HOSTKEY, user, host, key, 0, NULL)); 492 } 493 494 int 495 mm_key_allowed(enum mm_keytype type, const char *user, const char *host, 496 struct sshkey *key, int pubkey_auth_attempt, struct sshauthopt **authoptp) 497 { 498 struct sshbuf *m; 499 int r, allowed = 0; 500 struct sshauthopt *opts = NULL; 501 502 debug3_f("entering"); 503 504 if (authoptp != NULL) 505 *authoptp = NULL; 506 507 if ((m = sshbuf_new()) == NULL) 508 fatal_f("sshbuf_new failed"); 509 if ((r = sshbuf_put_u32(m, type)) != 0 || 510 (r = sshbuf_put_cstring(m, user ? user : "")) != 0 || 511 (r = sshbuf_put_cstring(m, host ? host : "")) != 0 || 512 (r = sshkey_puts(key, m)) != 0 || 513 (r = sshbuf_put_u32(m, pubkey_auth_attempt)) != 0) 514 fatal_fr(r, "assemble"); 515 516 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, m); 517 518 debug3_f("waiting for MONITOR_ANS_KEYALLOWED"); 519 mm_request_receive_expect(pmonitor->m_recvfd, 520 MONITOR_ANS_KEYALLOWED, m); 521 522 if ((r = sshbuf_get_u32(m, &allowed)) != 0) 523 fatal_fr(r, "parse"); 524 if (allowed && type == MM_USERKEY && 525 (r = sshauthopt_deserialise(m, &opts)) != 0) 526 fatal_fr(r, "sshauthopt_deserialise"); 527 sshbuf_free(m); 528 529 if (authoptp != NULL) { 530 *authoptp = opts; 531 opts = NULL; 532 } 533 sshauthopt_free(opts); 534 535 return allowed; 536 } 537 538 /* 539 * This key verify needs to send the key type along, because the 540 * privileged parent makes the decision if the key is allowed 541 * for authentication. 542 */ 543 544 int 545 mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen, 546 const u_char *data, size_t datalen, const char *sigalg, u_int compat, 547 struct sshkey_sig_details **sig_detailsp) 548 { 549 struct sshbuf *m; 550 u_int encoded_ret = 0; 551 int r; 552 u_char sig_details_present, flags; 553 u_int counter; 554 555 debug3_f("entering"); 556 557 if (sig_detailsp != NULL) 558 *sig_detailsp = NULL; 559 if ((m = sshbuf_new()) == NULL) 560 fatal_f("sshbuf_new failed"); 561 if ((r = sshkey_puts(key, m)) != 0 || 562 (r = sshbuf_put_string(m, sig, siglen)) != 0 || 563 (r = sshbuf_put_string(m, data, datalen)) != 0 || 564 (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0) 565 fatal_fr(r, "assemble"); 566 567 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, m); 568 569 debug3_f("waiting for MONITOR_ANS_KEYVERIFY"); 570 mm_request_receive_expect(pmonitor->m_recvfd, 571 MONITOR_ANS_KEYVERIFY, m); 572 573 if ((r = sshbuf_get_u32(m, &encoded_ret)) != 0 || 574 (r = sshbuf_get_u8(m, &sig_details_present)) != 0) 575 fatal_fr(r, "parse"); 576 if (sig_details_present && encoded_ret == 0) { 577 if ((r = sshbuf_get_u32(m, &counter)) != 0 || 578 (r = sshbuf_get_u8(m, &flags)) != 0) 579 fatal_fr(r, "parse sig_details"); 580 if (sig_detailsp != NULL) { 581 *sig_detailsp = xcalloc(1, sizeof(**sig_detailsp)); 582 (*sig_detailsp)->sk_counter = counter; 583 (*sig_detailsp)->sk_flags = flags; 584 } 585 } 586 587 sshbuf_free(m); 588 589 if (encoded_ret != 0) 590 return SSH_ERR_SIGNATURE_INVALID; 591 return 0; 592 } 593 594 void 595 mm_send_keystate(struct ssh *ssh, struct monitor *monitor) 596 { 597 struct sshbuf *m; 598 int r; 599 600 if ((m = sshbuf_new()) == NULL) 601 fatal_f("sshbuf_new failed"); 602 if ((r = ssh_packet_get_state(ssh, m)) != 0) 603 fatal_fr(r, "ssh_packet_get_state"); 604 mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, m); 605 debug3_f("Finished sending state"); 606 sshbuf_free(m); 607 } 608 609 int 610 mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen) 611 { 612 struct sshbuf *m; 613 char *p, *msg; 614 int success = 0, tmp1 = -1, tmp2 = -1, r; 615 616 /* Kludge: ensure there are fds free to receive the pty/tty */ 617 if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 || 618 (tmp2 = dup(pmonitor->m_recvfd)) == -1) { 619 error_f("cannot allocate fds for pty"); 620 if (tmp1 >= 0) 621 close(tmp1); 622 return 0; 623 } 624 close(tmp1); 625 close(tmp2); 626 627 if ((m = sshbuf_new()) == NULL) 628 fatal_f("sshbuf_new failed"); 629 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, m); 630 631 debug3_f("waiting for MONITOR_ANS_PTY"); 632 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PTY, m); 633 634 if ((r = sshbuf_get_u32(m, &success)) != 0) 635 fatal_fr(r, "parse success"); 636 if (success == 0) { 637 debug3_f("pty alloc failed"); 638 sshbuf_free(m); 639 return (0); 640 } 641 if ((r = sshbuf_get_cstring(m, &p, NULL)) != 0 || 642 (r = sshbuf_get_cstring(m, &msg, NULL)) != 0) 643 fatal_fr(r, "parse"); 644 sshbuf_free(m); 645 646 strlcpy(namebuf, p, namebuflen); /* Possible truncation */ 647 free(p); 648 649 if ((r = sshbuf_put(loginmsg, msg, strlen(msg))) != 0) 650 fatal_fr(r, "put loginmsg"); 651 free(msg); 652 653 if ((*ptyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1 || 654 (*ttyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1) 655 fatal_f("receive fds failed"); 656 657 /* Success */ 658 return (1); 659 } 660 661 void 662 mm_session_pty_cleanup2(Session *s) 663 { 664 struct sshbuf *m; 665 int r; 666 667 if (s->ttyfd == -1) 668 return; 669 if ((m = sshbuf_new()) == NULL) 670 fatal_f("sshbuf_new failed"); 671 if ((r = sshbuf_put_cstring(m, s->tty)) != 0) 672 fatal_fr(r, "assmble"); 673 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTYCLEANUP, m); 674 sshbuf_free(m); 675 676 /* closed dup'ed master */ 677 if (s->ptymaster != -1 && close(s->ptymaster) == -1) 678 error("close(s->ptymaster/%d): %s", 679 s->ptymaster, strerror(errno)); 680 681 /* unlink pty from session */ 682 s->ttyfd = -1; 683 } 684 685 #ifdef USE_PAM 686 void 687 mm_start_pam(struct ssh *ssh) 688 { 689 struct sshbuf *m; 690 691 debug3_f("entering"); 692 if (!options.use_pam) 693 fatal_f("UsePAM=no, but ended up in %s anyway", __func__); 694 if ((m = sshbuf_new()) == NULL) 695 fatal_f("sshbuf_new failed"); 696 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, m); 697 698 sshbuf_free(m); 699 } 700 701 u_int 702 mm_do_pam_account(void) 703 { 704 struct sshbuf *m; 705 u_int ret; 706 char *msg; 707 size_t msglen; 708 int r; 709 710 debug3_f("entering"); 711 if (!options.use_pam) 712 fatal_f("UsePAM=no, but ended up in %s anyway", __func__); 713 714 if ((m = sshbuf_new()) == NULL) 715 fatal_f("sshbuf_new failed"); 716 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_ACCOUNT, m); 717 718 mm_request_receive_expect(pmonitor->m_recvfd, 719 MONITOR_ANS_PAM_ACCOUNT, m); 720 if ((r = sshbuf_get_u32(m, &ret)) != 0 || 721 (r = sshbuf_get_cstring(m, &msg, &msglen)) != 0 || 722 (r = sshbuf_put(loginmsg, msg, msglen)) != 0) 723 fatal_fr(r, "buffer error"); 724 725 free(msg); 726 sshbuf_free(m); 727 728 debug3_f("returning %d", ret); 729 730 return (ret); 731 } 732 733 void * 734 mm_sshpam_init_ctx(Authctxt *authctxt) 735 { 736 struct sshbuf *m; 737 int r, success; 738 739 debug3_f("entering"); 740 if ((m = sshbuf_new()) == NULL) 741 fatal_f("sshbuf_new failed"); 742 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, m); 743 debug3_f("waiting for MONITOR_ANS_PAM_INIT_CTX"); 744 mm_request_receive_expect(pmonitor->m_recvfd, 745 MONITOR_ANS_PAM_INIT_CTX, m); 746 if ((r = sshbuf_get_u32(m, &success)) != 0) 747 fatal_fr(r, "buffer error"); 748 if (success == 0) { 749 debug3_f("pam_init_ctx failed"); 750 sshbuf_free(m); 751 return (NULL); 752 } 753 sshbuf_free(m); 754 return (authctxt); 755 } 756 757 int 758 mm_sshpam_query(void *ctx, char **name, char **info, 759 u_int *num, char ***prompts, u_int **echo_on) 760 { 761 struct sshbuf *m; 762 u_int i, n; 763 int r, ret; 764 765 debug3_f("entering"); 766 if ((m = sshbuf_new()) == NULL) 767 fatal_f("sshbuf_new failed"); 768 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_QUERY, m); 769 debug3_f("waiting for MONITOR_ANS_PAM_QUERY"); 770 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_QUERY, m); 771 if ((r = sshbuf_get_u32(m, &ret)) != 0 || 772 (r = sshbuf_get_cstring(m, name, NULL)) != 0 || 773 (r = sshbuf_get_cstring(m, info, NULL)) != 0 || 774 (r = sshbuf_get_u32(m, &n)) != 0 || 775 (r = sshbuf_get_u32(m, num)) != 0) 776 fatal_fr(r, "buffer error"); 777 debug3_f("pam_query returned %d", ret); 778 sshpam_set_maxtries_reached(n); 779 if (*num > PAM_MAX_NUM_MSG) 780 fatal("%s: received %u PAM messages, expected <= %u", 781 __func__, *num, PAM_MAX_NUM_MSG); 782 *prompts = xcalloc((*num + 1), sizeof(char *)); 783 *echo_on = xcalloc((*num + 1), sizeof(u_int)); 784 for (i = 0; i < *num; ++i) { 785 if ((r = sshbuf_get_cstring(m, &((*prompts)[i]), NULL)) != 0 || 786 (r = sshbuf_get_u32(m, &((*echo_on)[i]))) != 0) 787 fatal_fr(r, "buffer error"); 788 } 789 sshbuf_free(m); 790 return (ret); 791 } 792 793 int 794 mm_sshpam_respond(void *ctx, u_int num, char **resp) 795 { 796 struct sshbuf *m; 797 u_int n, i; 798 int r, ret; 799 800 debug3_f("entering"); 801 if ((m = sshbuf_new()) == NULL) 802 fatal_f("sshbuf_new failed"); 803 if ((r = sshbuf_put_u32(m, num)) != 0) 804 fatal_fr(r, "buffer error"); 805 for (i = 0; i < num; ++i) { 806 if ((r = sshbuf_put_cstring(m, resp[i])) != 0) 807 fatal_fr(r, "buffer error"); 808 } 809 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_RESPOND, m); 810 debug3_f("waiting for MONITOR_ANS_PAM_RESPOND"); 811 mm_request_receive_expect(pmonitor->m_recvfd, 812 MONITOR_ANS_PAM_RESPOND, m); 813 if ((r = sshbuf_get_u32(m, &n)) != 0) 814 fatal_fr(r, "buffer error"); 815 ret = (int)n; /* XXX */ 816 debug3_f("pam_respond returned %d", ret); 817 sshbuf_free(m); 818 return (ret); 819 } 820 821 void 822 mm_sshpam_free_ctx(void *ctxtp) 823 { 824 struct sshbuf *m; 825 826 debug3_f("entering"); 827 if ((m = sshbuf_new()) == NULL) 828 fatal_f("sshbuf_new failed"); 829 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_FREE_CTX, m); 830 debug3_f("waiting for MONITOR_ANS_PAM_FREE_CTX"); 831 mm_request_receive_expect(pmonitor->m_recvfd, 832 MONITOR_ANS_PAM_FREE_CTX, m); 833 sshbuf_free(m); 834 } 835 #endif /* USE_PAM */ 836 837 /* Request process termination */ 838 839 void 840 mm_terminate(void) 841 { 842 struct sshbuf *m; 843 844 if ((m = sshbuf_new()) == NULL) 845 fatal_f("sshbuf_new failed"); 846 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_TERM, m); 847 sshbuf_free(m); 848 } 849 850 /* Request state information */ 851 852 void 853 mm_get_state(struct ssh *ssh, 854 ServerOptions *opts, struct sshbuf **confdatap, 855 uint64_t *timing_secretp, 856 struct sshbuf **hostkeysp, struct sshbuf **keystatep, 857 u_char **pw_namep, 858 struct sshbuf **authinfop, struct sshbuf **auth_optsp) 859 { 860 struct sshbuf *m, *config; 861 int r; 862 863 debug3_f("entering"); 864 865 if ((m = sshbuf_new()) == NULL || (config = sshbuf_new()) == NULL) 866 fatal_f("sshbuf_new failed"); 867 868 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_STATE, m); 869 870 debug3_f("waiting for MONITOR_ANS_STATE"); 871 mm_request_receive_expect(pmonitor->m_recvfd, 872 MONITOR_ANS_STATE, m); 873 874 if ((r = sshbuf_froms(m, &config)) != 0 || 875 (r = sshbuf_get_u64(m, timing_secretp)) != 0 || 876 (r = sshbuf_froms(m, hostkeysp)) != 0 || 877 (r = sshbuf_get_stringb(m, ssh->kex->server_version)) != 0 || 878 (r = sshbuf_get_stringb(m, ssh->kex->client_version)) != 0) 879 fatal_fr(r, "parse config"); 880 881 /* postauth */ 882 if (confdatap) { 883 if ((r = sshbuf_froms(m, confdatap)) != 0 || 884 (r = sshbuf_froms(m, keystatep)) != 0 || 885 (r = sshbuf_get_string(m, pw_namep, NULL)) != 0 || 886 (r = sshbuf_froms(m, authinfop)) != 0 || 887 (r = sshbuf_froms(m, auth_optsp)) != 0) 888 fatal_fr(r, "parse config postauth"); 889 } 890 if ((r = deserialise_server_options(config, opts)) != 0) 891 fatal_fr(r, "deserialise_server_options"); 892 893 sshbuf_free(m); 894 sshbuf_free(config); 895 896 debug3_f("done"); 897 } 898 899 static void 900 mm_chall_setup(char **name, char **infotxt, u_int *numprompts, 901 char ***prompts, u_int **echo_on) 902 { 903 *name = xstrdup(""); 904 *infotxt = xstrdup(""); 905 *numprompts = 1; 906 *prompts = xcalloc(*numprompts, sizeof(char *)); 907 *echo_on = xcalloc(*numprompts, sizeof(u_int)); 908 (*echo_on)[0] = 0; 909 } 910 911 int 912 mm_bsdauth_query(void *ctx, char **name, char **infotxt, 913 u_int *numprompts, char ***prompts, u_int **echo_on) 914 { 915 struct sshbuf *m; 916 u_int success; 917 char *challenge; 918 int r; 919 920 debug3_f("entering"); 921 922 if ((m = sshbuf_new()) == NULL) 923 fatal_f("sshbuf_new failed"); 924 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHQUERY, m); 925 926 mm_request_receive_expect(pmonitor->m_recvfd, 927 MONITOR_ANS_BSDAUTHQUERY, m); 928 if ((r = sshbuf_get_u32(m, &success)) != 0) 929 fatal_fr(r, "parse success"); 930 if (success == 0) { 931 debug3_f("no challenge"); 932 sshbuf_free(m); 933 return (-1); 934 } 935 936 /* Get the challenge, and format the response */ 937 if ((r = sshbuf_get_cstring(m, &challenge, NULL)) != 0) 938 fatal_fr(r, "parse challenge"); 939 sshbuf_free(m); 940 941 mm_chall_setup(name, infotxt, numprompts, prompts, echo_on); 942 (*prompts)[0] = challenge; 943 944 debug3_f("received challenge: %s", challenge); 945 946 return (0); 947 } 948 949 int 950 mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses) 951 { 952 struct sshbuf *m; 953 int r, authok; 954 955 debug3_f("entering"); 956 if (numresponses != 1) 957 return (-1); 958 959 if ((m = sshbuf_new()) == NULL) 960 fatal_f("sshbuf_new failed"); 961 if ((r = sshbuf_put_cstring(m, responses[0])) != 0) 962 fatal_fr(r, "assemble"); 963 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHRESPOND, m); 964 965 mm_request_receive_expect(pmonitor->m_recvfd, 966 MONITOR_ANS_BSDAUTHRESPOND, m); 967 968 if ((r = sshbuf_get_u32(m, &authok)) != 0) 969 fatal_fr(r, "parse"); 970 sshbuf_free(m); 971 972 return ((authok == 0) ? -1 : 0); 973 } 974 975 #ifdef SSH_AUDIT_EVENTS 976 void 977 mm_audit_event(struct ssh *ssh, ssh_audit_event_t event) 978 { 979 struct sshbuf *m; 980 int r; 981 982 debug3_f("entering"); 983 984 if ((m = sshbuf_new()) == NULL) 985 fatal_f("sshbuf_new failed"); 986 if ((r = sshbuf_put_u32(m, event)) != 0) 987 fatal_fr(r, "buffer error"); 988 989 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_EVENT, m); 990 sshbuf_free(m); 991 } 992 993 void 994 mm_audit_run_command(const char *command) 995 { 996 struct sshbuf *m; 997 int r; 998 999 debug3_f("entering command %s", command); 1000 1001 if ((m = sshbuf_new()) == NULL) 1002 fatal_f("sshbuf_new failed"); 1003 if ((r = sshbuf_put_cstring(m, command)) != 0) 1004 fatal_fr(r, "buffer error"); 1005 1006 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m); 1007 sshbuf_free(m); 1008 } 1009 #endif /* SSH_AUDIT_EVENTS */ 1010 1011 #ifdef GSSAPI 1012 OM_uint32 1013 mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid) 1014 { 1015 struct sshbuf *m; 1016 OM_uint32 major; 1017 int r; 1018 1019 /* Client doesn't get to see the context */ 1020 *ctx = NULL; 1021 1022 if ((m = sshbuf_new()) == NULL) 1023 fatal_f("sshbuf_new failed"); 1024 if ((r = sshbuf_put_string(m, goid->elements, goid->length)) != 0) 1025 fatal_fr(r, "assemble"); 1026 1027 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSETUP, m); 1028 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSETUP, m); 1029 1030 if ((r = sshbuf_get_u32(m, &major)) != 0) 1031 fatal_fr(r, "parse"); 1032 1033 sshbuf_free(m); 1034 return (major); 1035 } 1036 1037 OM_uint32 1038 mm_ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *in, 1039 gss_buffer_desc *out, OM_uint32 *flagsp) 1040 { 1041 struct sshbuf *m; 1042 OM_uint32 major; 1043 u_int flags; 1044 int r; 1045 1046 if ((m = sshbuf_new()) == NULL) 1047 fatal_f("sshbuf_new failed"); 1048 if ((r = sshbuf_put_string(m, in->value, in->length)) != 0) 1049 fatal_fr(r, "assemble"); 1050 1051 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSTEP, m); 1052 mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSTEP, m); 1053 1054 if ((r = sshbuf_get_u32(m, &major)) != 0 || 1055 (r = ssh_gssapi_get_buffer_desc(m, out)) != 0) 1056 fatal_fr(r, "parse"); 1057 if (flagsp != NULL) { 1058 if ((r = sshbuf_get_u32(m, &flags)) != 0) 1059 fatal_fr(r, "parse flags"); 1060 *flagsp = flags; 1061 } 1062 1063 sshbuf_free(m); 1064 1065 return (major); 1066 } 1067 1068 OM_uint32 1069 mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) 1070 { 1071 struct sshbuf *m; 1072 OM_uint32 major; 1073 int r; 1074 1075 if ((m = sshbuf_new()) == NULL) 1076 fatal_f("sshbuf_new failed"); 1077 if ((r = sshbuf_put_string(m, gssbuf->value, gssbuf->length)) != 0 || 1078 (r = sshbuf_put_string(m, gssmic->value, gssmic->length)) != 0) 1079 fatal_fr(r, "assemble"); 1080 1081 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSCHECKMIC, m); 1082 mm_request_receive_expect(pmonitor->m_recvfd, 1083 MONITOR_ANS_GSSCHECKMIC, m); 1084 1085 if ((r = sshbuf_get_u32(m, &major)) != 0) 1086 fatal_fr(r, "parse"); 1087 sshbuf_free(m); 1088 return(major); 1089 } 1090 1091 int 1092 mm_ssh_gssapi_userok(char *user) 1093 { 1094 struct sshbuf *m; 1095 int r, authenticated = 0; 1096 1097 if ((m = sshbuf_new()) == NULL) 1098 fatal_f("sshbuf_new failed"); 1099 1100 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m); 1101 mm_request_receive_expect(pmonitor->m_recvfd, 1102 MONITOR_ANS_GSSUSEROK, m); 1103 1104 if ((r = sshbuf_get_u32(m, &authenticated)) != 0) 1105 fatal_fr(r, "parse"); 1106 1107 sshbuf_free(m); 1108 debug3_f("user %sauthenticated", authenticated ? "" : "not "); 1109 return (authenticated); 1110 } 1111 #endif /* GSSAPI */ 1112 1113 /* 1114 * Inform channels layer of permitopen options for a single forwarding 1115 * direction (local/remote). 1116 */ 1117 static void 1118 server_process_permitopen_list(struct ssh *ssh, int listen, 1119 char **opens, u_int num_opens) 1120 { 1121 u_int i; 1122 int port; 1123 char *host, *arg, *oarg; 1124 int where = listen ? FORWARD_REMOTE : FORWARD_LOCAL; 1125 const char *what = listen ? "permitlisten" : "permitopen"; 1126 1127 channel_clear_permission(ssh, FORWARD_ADM, where); 1128 if (num_opens == 0) 1129 return; /* permit any */ 1130 1131 /* handle keywords: "any" / "none" */ 1132 if (num_opens == 1 && strcmp(opens[0], "any") == 0) 1133 return; 1134 if (num_opens == 1 && strcmp(opens[0], "none") == 0) { 1135 channel_disable_admin(ssh, where); 1136 return; 1137 } 1138 /* Otherwise treat it as a list of permitted host:port */ 1139 for (i = 0; i < num_opens; i++) { 1140 oarg = arg = xstrdup(opens[i]); 1141 host = hpdelim(&arg); 1142 if (host == NULL) 1143 fatal_f("missing host in %s", what); 1144 host = cleanhostname(host); 1145 if (arg == NULL || ((port = permitopen_port(arg)) < 0)) 1146 fatal_f("bad port number in %s", what); 1147 /* Send it to channels layer */ 1148 channel_add_permission(ssh, FORWARD_ADM, 1149 where, host, port); 1150 free(oarg); 1151 } 1152 } 1153 1154 /* 1155 * Inform channels layer of permitopen options from configuration. 1156 */ 1157 void 1158 server_process_permitopen(struct ssh *ssh) 1159 { 1160 server_process_permitopen_list(ssh, 0, 1161 options.permitted_opens, options.num_permitted_opens); 1162 server_process_permitopen_list(ssh, 1, 1163 options.permitted_listens, options.num_permitted_listens); 1164 } 1165 1166 void 1167 server_process_channel_timeouts(struct ssh *ssh) 1168 { 1169 u_int i, secs; 1170 char *type; 1171 1172 debug3_f("setting %u timeouts", options.num_channel_timeouts); 1173 channel_clear_timeouts(ssh); 1174 for (i = 0; i < options.num_channel_timeouts; i++) { 1175 if (parse_pattern_interval(options.channel_timeouts[i], 1176 &type, &secs) != 0) { 1177 fatal_f("internal error: bad timeout %s", 1178 options.channel_timeouts[i]); 1179 } 1180 channel_add_timeout(ssh, type, secs); 1181 free(type); 1182 } 1183 } 1184 1185 struct connection_info * 1186 server_get_connection_info(struct ssh *ssh, int populate, int use_dns) 1187 { 1188 static struct connection_info ci; 1189 1190 if (ssh == NULL || !populate) 1191 return &ci; 1192 ci.host = use_dns ? ssh_remote_hostname(ssh) : ssh_remote_ipaddr(ssh); 1193 ci.address = ssh_remote_ipaddr(ssh); 1194 ci.laddress = ssh_local_ipaddr(ssh); 1195 ci.lport = ssh_local_port(ssh); 1196 ci.rdomain = ssh_packet_rdomain_in(ssh); 1197 return &ci; 1198 } 1199 1200