| Line | Source | Count |
| 1 | | - |
| 2 | | - |
| 3 | | - |
| 4 | | - |
| 5 | | - |
| 6 | | - |
| 7 | | - |
| 8 | | - |
| 9 | | - |
| 10 | | - |
| 11 | | - |
| 12 | | - |
| 13 | | - |
| 14 | | - |
| 15 | | - |
| 16 | | - |
| 17 | | - |
| 18 | | - |
| 19 | | - |
| 20 | | - |
| 21 | | - |
| 22 | | - |
| 23 | | - |
| 24 | | - |
| 25 | | - |
| 26 | #include "includes.h" | - |
| 27 | | - |
| 28 | #include <fcntl.h> | - |
| 29 | #ifdef HAVE_PATHS_H | - |
| 30 | #include <paths.h> | - |
| 31 | #endif | - |
| 32 | #include <pwd.h> | - |
| 33 | #include <stdarg.h> | - |
| 34 | #include <stdlib.h> | - |
| 35 | #include <string.h> | - |
| 36 | #include <unistd.h> | - |
| 37 | #include <errno.h> | - |
| 38 | | - |
| 39 | #ifdef WITH_OPENSSL | - |
| 40 | #include <openssl/evp.h> | - |
| 41 | #include <openssl/rand.h> | - |
| 42 | #include <openssl/rsa.h> | - |
| 43 | #endif | - |
| 44 | | - |
| 45 | #include "xmalloc.h" | - |
| 46 | #include "log.h" | - |
| 47 | #include "sshkey.h" | - |
| 48 | #include "ssh.h" | - |
| 49 | #include "ssh2.h" | - |
| 50 | #include "misc.h" | - |
| 51 | #include "sshbuf.h" | - |
| 52 | #include "authfile.h" | - |
| 53 | #include "msg.h" | - |
| 54 | #include "canohost.h" | - |
| 55 | #include "pathnames.h" | - |
| 56 | #include "readconf.h" | - |
| 57 | #include "uidswap.h" | - |
| 58 | #include "sshkey.h" | - |
| 59 | #include "ssherr.h" | - |
| 60 | | - |
| 61 | struct ssh *active_state = NULL; | - |
| 62 | | - |
| 63 | extern char *__progname; | - |
| 64 | | - |
| 65 | static int | - |
| 66 | valid_request(struct passwd *pw, char *host, struct sshkey **ret, | - |
| 67 | u_char *data, size_t datalen) | - |
| 68 | { | - |
| 69 | struct sshbuf *b; | - |
| 70 | struct sshkey *key = NULL; | - |
| 71 | u_char type, *pkblob; | - |
| 72 | char *p; | - |
| 73 | size_t blen, len; | - |
| 74 | char *pkalg, *luser; | - |
| 75 | int r, pktype, fail; | - |
| 76 | | - |
| 77 | if (ret != NULL)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 78 | *ret = NULL; never executed: *ret = ((void *)0) ; | 0 |
| 79 | fail = 0; | - |
| 80 | | - |
| 81 | if ((b = sshbuf_from(data, datalen)) == NULL)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 82 | fatal("%s: sshbuf_from failed", __func__); never executed: fatal("%s: sshbuf_from failed", __func__); | 0 |
| 83 | | - |
| 84 | | - |
| 85 | if ((r = sshbuf_get_string(b, NULL, &len)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 86 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 87 | if (len != 20 && len != 32)| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 88 | fail++; never executed: fail++; | 0 |
| 89 | | - |
| 90 | if ((r = sshbuf_get_u8(b, &type)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 91 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 92 | if (type != SSH2_MSG_USERAUTH_REQUEST)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 93 | fail++; never executed: fail++; | 0 |
| 94 | | - |
| 95 | | - |
| 96 | if ((r = sshbuf_skip_string(b)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 97 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 98 | | - |
| 99 | | - |
| 100 | if ((r = sshbuf_get_cstring(b, &p, NULL)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 101 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 102 | if (strcmp("ssh-connection", p) != 0) never executed: __result = (((const unsigned char *) (const char *) ( "ssh-connection" ))[3] - __s2[3]); never executed: end of block never executed: end of block never executed: __result = (((const unsigned char *) (const char *) ( p ))[3] - __s2[3]); never executed: end of block never executed: end of block | TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 103 | fail++; never executed: fail++; | 0 |
| 104 | free(p); | - |
| 105 | | - |
| 106 | | - |
| 107 | if ((r = sshbuf_get_cstring(b, &p, NULL)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 108 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 109 | if (strcmp("hostbased", p) != 0) never executed: __result = (((const unsigned char *) (const char *) ( "hostbased" ))[3] - __s2[3]); never executed: end of block never executed: end of block never executed: __result = (((const unsigned char *) (const char *) ( p ))[3] - __s2[3]); never executed: end of block never executed: end of block | TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 110 | fail++; never executed: fail++; | 0 |
| 111 | free(p); | - |
| 112 | | - |
| 113 | | - |
| 114 | if ((r = sshbuf_get_cstring(b, &pkalg, NULL)) != 0 ||| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 115 | (r = sshbuf_get_string(b, &pkblob, &blen)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 116 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 117 | | - |
| 118 | pktype = sshkey_type_from_name(pkalg); | - |
| 119 | if (pktype == KEY_UNSPEC)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 120 | fail++; never executed: fail++; | 0 |
| 121 | else if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 122 | error("%s: bad key blob: %s", __func__, ssh_err(r)); | - |
| 123 | fail++; | - |
| 124 | } else if (key->type != pktype) never executed: end of block | TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 125 | fail++; never executed: fail++; | 0 |
| 126 | free(pkalg); | - |
| 127 | free(pkblob); | - |
| 128 | | - |
| 129 | | - |
| 130 | if ((r = sshbuf_get_cstring(b, &p, &len)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 131 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 132 | debug2("%s: check expect chost %s got %s", __func__, host, p); | - |
| 133 | if (strlen(host) != len - 1)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 134 | fail++; never executed: fail++; | 0 |
| 135 | else if (p[len - 1] != '.')| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 136 | fail++; never executed: fail++; | 0 |
| 137 | else if (strncasecmp(host, p, len - 1) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 138 | fail++; never executed: fail++; | 0 |
| 139 | free(p); | - |
| 140 | | - |
| 141 | | - |
| 142 | if ((r = sshbuf_get_cstring(b, &luser, NULL)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 143 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
| 144 | | - |
| 145 | if (strcmp(pw->pw_name, luser) != 0) never executed: __result = (((const unsigned char *) (const char *) ( pw->pw_name ))[3] - __s2[3]); never executed: end of block never executed: end of block never executed: __result = (((const unsigned char *) (const char *) ( luser ))[3] - __s2[3]); never executed: end of block never executed: end of block | TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 146 | fail++; never executed: fail++; | 0 |
| 147 | free(luser); | - |
| 148 | | - |
| 149 | | - |
| 150 | if (sshbuf_len(b) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 151 | fail++; never executed: fail++; | 0 |
| 152 | sshbuf_free(b); | - |
| 153 | | - |
| 154 | debug3("%s: fail %d", __func__, fail); | - |
| 155 | | - |
| 156 | if (fail)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 157 | sshkey_free(key); never executed: sshkey_free(key); | 0 |
| 158 | else if (ret != NULL)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 159 | *ret = key; never executed: *ret = key; | 0 |
| 160 | | - |
| 161 | return (fail ? -1 : 0); never executed: return (fail ? -1 : 0); | TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 162 | } | - |
| 163 | | - |
| 164 | int | - |
| 165 | main(int argc, char **argv) | - |
| 166 | { | - |
| 167 | struct sshbuf *b; | - |
| 168 | Options options; | - |
| 169 | #define NUM_KEYTYPES 5 | - |
| 170 | struct sshkey *keys[NUM_KEYTYPES], *key = NULL; | - |
| 171 | struct passwd *pw; | - |
| 172 | int r, key_fd[NUM_KEYTYPES], i, found, version = 2, fd; | - |
| 173 | u_char *signature, *data, rver; | - |
| 174 | char *host, *fp; | - |
| 175 | size_t slen, dlen; | - |
| 176 | #ifdef WITH_OPENSSL | - |
| 177 | u_int32_t rnd[256]; | - |
| 178 | #endif | - |
| 179 | | - |
| 180 | ssh_malloc_init(); | - |
| 181 | if (pledge("stdio rpath getpw dns id", NULL) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 182 | fatal("%s: pledge: %s", __progname, strerror(errno)); never executed: fatal("%s: pledge: %s", __progname, strerror( (*__errno_location ()) )); | 0 |
| 183 | | - |
| 184 | | - |
| 185 | if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 186 | exit(1); never executed: exit(1); | 0 |
| 187 | | - |
| 188 | if (fd > 2)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 189 | close(fd); never executed: close(fd); | 0 |
| 190 | | - |
| 191 | i = 0; | - |
| 192 | | - |
| 193 | key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY); | - |
| 194 | key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY); | - |
| 195 | key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY); | - |
| 196 | key_fd[i++] = open(_PATH_HOST_XMSS_KEY_FILE, O_RDONLY); | - |
| 197 | key_fd[i++] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY); | - |
| 198 | | - |
| 199 | if ((pw = getpwuid(getuid())) == NULL)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 200 | fatal("getpwuid failed"); never executed: fatal("getpwuid failed"); | 0 |
| 201 | pw = pwcopy(pw); | - |
| 202 | | - |
| 203 | permanently_set_uid(pw); | - |
| 204 | | - |
| 205 | seed_rng(); | - |
| 206 | | - |
| 207 | #ifdef DEBUG_SSH_KEYSIGN | - |
| 208 | log_init("ssh-keysign", SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0); | - |
| 209 | #endif | - |
| 210 | | - |
| 211 | | - |
| 212 | initialize_options(&options); | - |
| 213 | (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "", &options, 0); | - |
| 214 | fill_default_options(&options); | - |
| 215 | if (options.enable_ssh_keysign != 1)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 216 | fatal("ssh-keysign not enabled in %s", never executed: fatal("ssh-keysign not enabled in %s", "/var/tmp/openssh-test/etc" "/ssh_config"); | 0 |
| 217 | _PATH_HOST_CONFIG_FILE); never executed: fatal("ssh-keysign not enabled in %s", "/var/tmp/openssh-test/etc" "/ssh_config"); | 0 |
| 218 | | - |
| 219 | for (i = found = 0; i < NUM_KEYTYPES; i++) {| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 220 | if (key_fd[i] != -1)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 221 | found = 1; never executed: found = 1; | 0 |
| 222 | } never executed: end of block | 0 |
| 223 | if (found == 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 224 | fatal("could not open any host key"); never executed: fatal("could not open any host key"); | 0 |
| 225 | | - |
| 226 | #ifdef WITH_OPENSSL | - |
| 227 | OpenSSL_add_all_algorithms(); | - |
| 228 | arc4random_buf(rnd, sizeof(rnd)); | - |
| 229 | RAND_seed(rnd, sizeof(rnd)); | - |
| 230 | #endif | - |
| 231 | | - |
| 232 | found = 0; | - |
| 233 | for (i = 0; i < NUM_KEYTYPES; i++) {| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 234 | keys[i] = NULL; | - |
| 235 | if (key_fd[i] == -1)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 236 | continue; never executed: continue; | 0 |
| 237 | r = sshkey_load_private_type_fd(key_fd[i], KEY_UNSPEC, | - |
| 238 | NULL, &key, NULL); | - |
| 239 | close(key_fd[i]); | - |
| 240 | if (r != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 241 | debug("parse key %d: %s", i, ssh_err(r)); never executed: debug("parse key %d: %s", i, ssh_err(r)); | 0 |
| 242 | else if (key != NULL) {| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 243 | keys[i] = key; | - |
| 244 | found = 1; | - |
| 245 | } never executed: end of block | 0 |
| 246 | } never executed: end of block | 0 |
| 247 | if (!found)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 248 | fatal("no hostkey found"); never executed: fatal("no hostkey found"); | 0 |
| 249 | | - |
| 250 | if (pledge("stdio dns", NULL) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 251 | fatal("%s: pledge: %s", __progname, strerror(errno)); never executed: fatal("%s: pledge: %s", __progname, strerror( (*__errno_location ()) )); | 0 |
| 252 | | - |
| 253 | if ((b = sshbuf_new()) == NULL)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 254 | fatal("%s: sshbuf_new failed", __progname); never executed: fatal("%s: sshbuf_new failed", __progname); | 0 |
| 255 | if (ssh_msg_recv(STDIN_FILENO, b) < 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 256 | fatal("ssh_msg_recv failed"); never executed: fatal("ssh_msg_recv failed"); | 0 |
| 257 | if ((r = sshbuf_get_u8(b, &rver)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 258 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
| 259 | if (rver != version)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 260 | fatal("bad version: received %d, expected %d", rver, version); never executed: fatal("bad version: received %d, expected %d", rver, version); | 0 |
| 261 | if ((r = sshbuf_get_u32(b, (u_int *)&fd)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 262 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
| 263 | if (fd < 0 || fd == STDIN_FILENO || fd == STDOUT_FILENO)| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 264 | fatal("bad fd"); never executed: fatal("bad fd"); | 0 |
| 265 | if ((host = get_local_name(fd)) == NULL)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 266 | fatal("cannot get local name for fd"); never executed: fatal("cannot get local name for fd"); | 0 |
| 267 | | - |
| 268 | if ((r = sshbuf_get_string(b, &data, &dlen)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 269 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
| 270 | if (valid_request(pw, host, &key, data, dlen) < 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 271 | fatal("not a valid request"); never executed: fatal("not a valid request"); | 0 |
| 272 | free(host); | - |
| 273 | | - |
| 274 | found = 0; | - |
| 275 | for (i = 0; i < NUM_KEYTYPES; i++) {| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 276 | if (keys[i] != NULL &&| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 277 | sshkey_equal_public(key, keys[i])) {| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 278 | found = 1; | - |
| 279 | break; never executed: break; | 0 |
| 280 | } | - |
| 281 | } never executed: end of block | 0 |
| 282 | if (!found) {| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 283 | if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 284 | SSH_FP_DEFAULT)) == NULL)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 285 | fatal("%s: sshkey_fingerprint failed", __progname); never executed: fatal("%s: sshkey_fingerprint failed", __progname); | 0 |
| 286 | fatal("no matching hostkey found for key %s %s", | - |
| 287 | sshkey_type(key), fp ? fp : ""); | - |
| 288 | } never executed: end of block | 0 |
| 289 | | - |
| 290 | if ((r = sshkey_sign(keys[i], &signature, &slen, data, dlen, NULL, 0))| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 291 | != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 292 | fatal("sshkey_sign failed: %s", ssh_err(r)); never executed: fatal("sshkey_sign failed: %s", ssh_err(r)); | 0 |
| 293 | free(data); | - |
| 294 | | - |
| 295 | | - |
| 296 | sshbuf_reset(b); | - |
| 297 | if ((r = sshbuf_put_string(b, signature, slen)) != 0)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 298 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
| 299 | if (ssh_msg_send(STDOUT_FILENO, version, b) == -1)| TRUE | never evaluated | | FALSE | never evaluated |
| 0 |
| 300 | fatal("ssh_msg_send failed"); never executed: fatal("ssh_msg_send failed"); | 0 |
| 301 | | - |
| 302 | return (0); never executed: return (0); | 0 |
| 303 | } | - |
| | |